What does cyber insurance cover for a small business?
Cyber insurance can pay your own costs after an attack, like forensics, data recovery, customer notices and lost income, and claims others make against you. Policies vary widely. Use the FTC's checklist to compare them, expect insurers to ask about passkeys or two-step login and backups, and read the exclusions for payment fraud and ransomware.
The short version
- First-party coverage pays your own costs: investigation, recovery, notices, lost income.
- Third-party coverage pays claims against you: lawsuits, settlements, regulatory inquiries.
- Ask about payment fraud. Invoice and wire scams are often excluded or limited unless you add them.
- Expect a security questionnaire. Two-step login, backups and updates are standard questions.
- Prices and terms vary. Get quotes through a licensed agent. This isn’t insurance or legal advice.
What can it cover?
The FTC’s cyber insurance guidance splits coverage into two kinds.
| First-party: your own costs | Third-party: claims against you |
|---|---|
| Legal advice on notification and regulatory duties | Payments to customers affected by a breach |
| Recovering and replacing lost or stolen data | Claims and settlement costs |
| Customer notification and call center services | Losses from defamation and copyright or trademark infringement |
| Lost income from business interruption | Costs of litigation and responding to regulators |
| Crisis management and public relations | Other settlements, damages and judgments |
| Cyber extortion and fraud | Accounting costs |
| Forensic investigation | |
| Fees, fines and penalties tied to the incident |
Not every policy includes every line. Some sell them as separate parts.
What should I look for in a policy?
The FTC suggests checking whether a policy:
- Covers data breaches, including breaches of data your vendors hold for you.
- Covers attacks on your network, and attacks from inside and outside the US.
- Will defend you in a lawsuit or regulatory investigation, sometimes called a “duty to defend.”
- Gives coverage above any other insurance you already have.
- Offers a breach hotline that’s open around the clock, every day of the year.
- Says how it handles ransom demands.
Add your own questions:
- Payment fraud. Is a wire sent to a scammer after a fake invoice covered? Often it’s under a separate “social engineering” or “funds transfer fraud” part with a lower limit. See business email compromise.
- Waiting periods. How many hours of downtime before business interruption pays out?
- Approved vendors. Must you use the insurer’s forensics firm and lawyers?
- Notice time. How quickly must you report an incident?
- Your website and email providers. Are outages at a provider covered?
What will the insurer ask me?
Expect an application asking about your security. Common questions include whether you use multifactor authentication on email and remote access, how you back up and whether backups are offline, how quickly you install updates, whether staff are trained, and how payment changes are verified.
Answer honestly. A wrong answer can give the insurer grounds to deny a claim. If you can’t say yes yet, fix it first. Our guides on passkeys, backups and ransomware and staff training cover the usual questions.
Does it pay ransoms?
Some policies help with ransom demands. Paying is still a hard decision. The FBI doesn’t support paying, and the US Treasury’s sanctions advisory warns that paying certain groups can break sanctions law. Talk to your insurer and a lawyer before any decision.
What are the common mistakes?
- Assuming general liability covers cyber. Many standard business policies exclude it or cover very little.
- Overstating your security on the application.
- Missing the notice deadline because nobody knew the insurer’s number. Put the breach hotline in your security plan.
- Calling your own IT firm first when the policy requires the insurer’s chosen responders. Check the rules before you need them.
- Not reading the payment fraud limits.
What if I already had an incident?
Call the insurer’s breach line straight away and follow their instructions. Keep notes of what happened and when. If customer data was exposed, also read what to do after a data breach.
How much does it cost, and how long does it take?
Premiums depend on your business, revenue, data and security, and we don’t quote them. Ask a licensed agent for quotes. Filling in an application takes an hour or two if your security plan is written down.
How does E-3 handle this?
E-3 doesn’t sell insurance. For websites we look after through website care, we run tested updates, daily backups and security alerts, which are the kind of practices insurers ask about. Ask your agent which ones they need described.
Related questions
Next step
- Next: What should my business do after a data breach?The next guide in Cybersecurity basics.
- Website careUptime monitoring, tested updates, daily backups and security alerts.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled cybersecurity basics for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.