A cyber incident can interrupt operations, expose information, and require outside help. Cyber insurance is one option to consider alongside prevention and an incident-response plan. The Federal Trade Commission's cyber insurance guide recommends discussing first-party and third-party protection with an agent. Coverage for a particular business depends on its application, insurer, form, limits, exclusions, and endorsements.

Start with the systems and information you use

List the services the business needs to operate: email, payment processing, customer records, booking software, vendors, and backups. Identify who can access them and how a disruption would affect revenue or customer service. The FTC's small-business cybersecurity guidance recommends inventorying systems and data, using multi-factor authentication where sensitive information is accessible, backing up files, and preparing a response plan. These steps are useful whether or not a business buys cyber insurance.

Compare first-party and third-party terms

Ask how the proposed policy handles the business's own response costs, such as forensic work, data restoration, notification, cyber extortion, and business interruption. Then ask how it handles third-party claims and regulatory inquiries. The FTC lists these as topics to consider; its list is not a promise that every cyber policy covers every item. Examine sublimits, waiting periods, deductibles, vendor incidents, consent requirements, and the circumstances in which a panel provider must be used.

Do not assume that a general liability or commercial property policy answers a cyber loss in the same way as a dedicated cyber policy. The wording of each issued policy controls. Ask your broker to compare the existing forms with the proposed cyber form and explain any overlap or gap in writing.

What about California privacy obligations?

A data incident may create notification, investigation, or legal obligations. The California Privacy Protection Agency's CCPA FAQ explains that the law applies to businesses meeting specific criteria, with separate duties for some service providers and contractors. Do not assume every business collecting customer information meets those criteria or that every incident gives rise to a private claim. Ask qualified privacy counsel which requirements apply to your business and incident. Ask the insurer how the policy addresses defense costs, regulatory proceedings, fines where insurable, and breach-response services.

Questions to take into a coverage review

  • Which first-party response costs and third-party claims are included, and what are their limits and sublimits?
  • What security controls must be in place when applying and throughout the policy period?
  • How are incidents involving a cloud provider, payment processor, or other vendor treated?
  • What notice, consent, and incident-response steps does the policy require?
  • How do business-interruption waiting periods, deductibles, and exclusions affect the likely scenarios?

There is no reliable universal premium increase, breach cost, or guaranteed coverage answer for a particular small business. Request quotes using accurate information about your operations and controls, then compare the actual forms. Ask Bollinsure for a coverage review if you want help with that comparison.

Primary sources