Cyber Insurance Coverage Checklist

Cybercrime is not going away anytime soon. Naturally, organizations of all sizes and industries are paying more attention to cyber insurance companies and trying to learn how cyber insurance can mitigate the risks associated with potentially deadly cyber threats.

Today we’re taking a detailed look into the nuances of cyber insurances. We’ll cover what an organization should look for in a cyber insurance policy and how companies can reduce insurance costs.

Evaluate your risk level

With the current cybercrime climate, organizations should understand that it is a question of “when” rather than “if” they will be attacked. The first step would be to take the time to examine and understand the potential threats your organization might face. Some companies might be targeted more frequently because they may be handling large quantities of data that hackers are after. Some organizations might use outdated technology and have fewer resources to withstand a potential attack. Cyber insurance premiums are priced at your risk level like any other insurance policy. Take the time to evaluate your organization’s cyber risk profile before choosing the cyber insurance policy.

Understand your company's needs

Cyber insurance policies, like other insurance policies, can be dense and abstract once you get down to the nitty-gritty. But before you start engaging with the details outlined within the policy, it is first essential to understand your organization’s needs and vulnerabilities.

Technologically speaking, every company is unique in one way or another. Some companies might need a policy covering a more extensive infrastructure, while others might look for a policy that’s not as comprehensive. Therefore, it is critical to have an in-depth understanding of why the organization needs a cyber insurance policy and what that policy covers. Here’s a cyber insurance coverage checklist to help you understand cyber insurance policy coverage.

• Forensic expenses

  Forensic expenses — as the name suggests — include the costs for investigating and eliminating a threat. Such fees can also include the costs of hiring an IT professional, a forensic accountant, or other professional services required to deal with a security breach.

• Legal expenses

  Legal expenses include defense and settlement costs for defending against a lawsuit brought by customers as a result of a data leak.

• Notification expenses

  Notification expenses include the costs associated with notifying customers that their data may have been compromised in a data breach.

• Regulatory fines and penalties

  If an organization is subject to regulations such as the GDPR or PCI DSS, a cyber insurance policy can cover the costs of fines and other regulatory fees.

• Credit monitoring and ID theft repair

  Credit card monitoring and ID theft repair coverage include costs related to recovering from identity theft. A cyber insurance policy can cover expenses for your customer that might have experienced identity theft.

• Public relations expenses

  A cyber insurance policy can cover the costs of hiring a public relations agency to protect your company’s reputation following a cyberattack and the costs associated with implementing any of the PR firm’s strategies and recommendations for handling the crisis.

• Liability and defense costs

  Liability and defense costs include coverage for losses and the potential cost of defense for lawsuits related to network security liability.

• Coverage for various types of cyberattack

  Coverage for various types of cyberattacks can include costs for withstanding a specific attack, for example, a ransomware attack, a DDoS attack, or social engineering campaign, and expenses related to such attacks, such as ransom payments, losses associated with business interruption, or regulatory fines.

• Data restoration coverage

  Data restoration coverage includes the costs of recovering the lost data and data needed to investigate why a cyberattack or a data breach was successful.

• Losses in third-party systems

  If your network or IT infrastructure is negatively affected by a cybersecurity attack or data breach that impacts a third-party, the cyber insurance policy should cover potential lawsuits associated with such an incident.

Every organization needs to look at itself and decide what type of coverage it's looking for and why it's doing so. Not all companies need comprehensive coverage, and because cyber insurance policies are highly customizable, it is best to understand what such a policy brings to the table before committing to one.

Find out more about the types of cyber insurance

At first glance, cyber insurance policies can seem vague and abstract. However, the majority of cyber insurance policies fall into two distinct types of coverage:

First-party coverage

As the name indicates, first-party coverage is designed to cover costs related to the direct response to a cyber incident. If an attack or an incident occurs, first-party coverage takes care of the costs to help immediately resolve and mitigate the issue. Here are some examples that first-party coverage policies cover:

1. The cost of calculating the size or cost of an incident.

2. The cost of legal advice.

3. The cost of business interruptions.

4. The cost of notifying affected parties.

Third-party coverage

Third-party coverage covers all the affected parties. The coverage might include third-party service providers that the affected organization is in partnership with or customers that suffered damage due to an attack. Here are some examples of third-party coverage:

1. The cost of privacy liability lawsuits brought by customers or other parties affected by a data breach.

2. The cost of copyright lawsuits associated with the exposure of intellectual property.

3. The cost of investigations, fines, and penalties incurred by regulators.

Estimate your budget and look for the best policy and the best price

Whenever there’s talk about any kind of insurance, price often takes center stage. Knowing how much you can spend on a cyber insurance policy is critical because it will ultimately define what type of coverage you will have in case of an emergency.

It is also important to understand that cyber insurance is not standardized like, say, health insurance. The details of the costs can vary based on the provider and the fine print within the policy. To get the best deal for your buck, organizations need to have a good understanding of what the policy offers and why it is necessary for the company.

Cyber insurance cost

The cost of cyber insurance varies based on multiple factors, including the size of the business, the industry it operates in, and the level of protection it has established or is required to have. The cost of cyber liability insurance can range from about $600/year to $2,500/year.

For instance, small businesses with minimal online activity can expect to pay less for cyber insurance than a large corporation with a significant online presence. The more sensitive data a business handles, the higher the insurance premium will be. Similarly, businesses in high-risk industries, such as finance and healthcare, typically pay higher premiums because of the increased likelihood of a cyberattack.

Cyber liability insurance costs are also influenced by the level of protection required. A business can choose to purchase first-party or third-party coverage or a combination of both.

First-party coverage protects a business's assets, such as data recovery and business interruption costs, while third-party coverage protects against legal liability for data breaches that affect customers. A combination of both types of coverage costs more than opting for a single type of coverage, but it (combination of coverages) provides comprehensive protection for businesses that face both first-party and third-party risks.

Several other factors can affect the cost of cyber liability insurance. These include the business's security measures, past claims history, and deductibles. Businesses that have implemented strong cybersecurity measures, such as firewalls and intrusion detection systems, can reduce their insurance costs. A good claims history, meaning no previous claims or a low number of claims, can also lead to lower premiums.

Strengthen your cybersecurity to meet cyber insurance requirements

To qualify for a cyber insurance policy, it is essential to have a strong security infrastructure in place. Due to today’s heated cyberthreat climate, issuers require specific security controls to be in place as a starting point. Here are some of the ways that you can take to boost your organization’s overall cybersecurity stance.

• Cybersecurity training

  Cybersecurity training should be a crucial part of any organization that wants to be successful in the digital age. It is critical to get employees on the same page security-wise. Furthermore, it is essential to provide the team with clear information on what security threats they should look out for and how they should act in an emergency. A security-minded team will not only lower the price of a cyber insurance policy but will also make your organization as strong as it can be in the face of cybercriminal activity.

• Incident response and business continuity plans

  A cybersecurity incident response and business continuity plans are an organization’s systemic approaches designed to manage security-related incidents that could have a significant impact on organizational operations. In most instances, such plans are purpose-built to address malware attacks, data breaches, unauthorized network intrusions, and other cybersecurity-related events and the fallout after such incidents.

• Multi-factor authentication for everyone with remote access to company systems

  Multi-factor authentication (MFA) can be a critical point in your overall cybersecurity strategy. MFA is a form of authentication that provides an additional security layer to every platform or app you or your employees access and use. Ensuring that MFA is used by everyone with remote access to the company network can significantly lower the risk of a third-party breach.

• An audit of third-party vendors and partners

  Cyberattacks can be carried out indirectly. Often such attacks are known as supply chain attacks, and for the last few years, they’ve been growing in popularity. During a supply chain attack, bad actors usually target their victims via third-party partners. Thus, having an in-depth understanding of your partner’s security measures can greatly help you improve your company’s overall security infrastructure as well. When establishing a partnership with a third party or implementing new software for company-wide use, be sure to learn about the other party’s security practices as much as possible.

• Network security

  Ensure that your organization’s network is secure at all times. After all, it is the gateway into everything related to your business. One of the easiest yet most effective ways that you can provide security for your company’s network is by deploying a VPN for company-wide use. A VPN encrypts the internet connection and the data transferred over the network. Services like NordLayer also offer features such as a kill switch, which is designed to disconnect hardware from the network if the protected connection is suddenly compromised or lost.

• Business data backup

  Making regular data backups and securely storing them is critical for any business, regardless of its size or industry. Make backups your priority to proactively defend yourself from a variety of cybersecurity threats.

• Business password management

  Weak, compromised, or reused passwords are the leading reason for data breaches and other types of cyber incidents. Password fatigue is real and affects almost everyone online. By deploying a business password manager for company-wide use, you will be able to enforce certain password policies and help your employees ease the burden of password fatigue.

Don't forget to update your cyber insurance

Make sure to regularly review your cyber insurance policy details. Know when the policy expires and whether, upon renewal, you need new coverage, or maybe you can waive some of the coverage to lower the costs of the policy.

Guide to cyber insurance

Today cyber insurance is quickly becoming an essential part of any business that looks to succeed. The demand for such insurance policies has never been higher, which in turn makes it more difficult for companies to qualify. That’s why business leaders need to understand the cyber insurance landscape and how to overcome the biggest hurdles to getting coverage.

To gain essential insights from cyber insurance experts, and a way to navigate the whole thing, you should explore our whitepaper on this exact topic. Finally, it is critical to understand that while cyber insurance policies take some weight off an organization’s shoulders, it is ultimately a passive defense — it should complement a strong cybersecurity infrastructure rather than replace it.