A cyberattack, data breach, ransomware incident, or other cybersecurity events can disrupt operations, expose sensitive information, and create unexpected costs for a business. While strong cybersecurity practices are an essential first line of defense, businesses also need to consider what happens financially if an incident gets through.

That’s where commercial cyber liability insurance can play an important role.

What Is Commercial Cyber Liability Insurance?

Commercial cyber liability insurance is coverage designed to help businesses manage certain financial losses and expenses associated with cyberattacks, data breaches, and other covered cybersecurity incidents.

Depending on the policy, coverage may help with expenses such as:

• Notifying customers about a data breach
• Recovering compromised data
• Repairing damaged computer systems
• Providing credit monitoring services to affected individuals
• Legal expenses related to a covered cyber incident
• Certain losses associated with system downtime

The exact coverage, exclusions, deductibles, and limits vary by policy and business. That’s why it’s important for business owners to work with an insurance professional to understand what their policy actually covers.

Why Does Cyber Liability Insurance Matter?

Cyber incidents can affect businesses in ways that go beyond the initial technical problem.

Consider a business that discovers an employee account has been compromised. The business may need to investigate what happened, restore systems, recover data, notify affected customers, and potentially respond to legal or regulatory requirements. At the same time, employees may be unable to access the systems they need to do their jobs.

The result can be a combination of technical, operational, legal, and financial challenges. Cyber liability insurance can help businesses prepare for some of those potential costs before an incident occurs.

And cyber risk isn’t limited to large corporations. Small and midsized businesses may also store valuable customer information, employee data, financial information, and other sensitive records. Businesses of all sizes should consider whether cyber liability coverage is appropriate for their needs.

First-Party vs. Third-Party Cyber Coverage

One important concept to understand when discussing cyber liability insurance is the difference between first-party and third-party coverage.

First-Party Cyber Coverage

First-party coverage generally addresses certain costs that your business experiences as a result of a covered cyber incident. In other words, first-party coverage is focused on the impact a cyber incident has on your own business.

Depending on the policy, this could include expenses associated with:

• Recovering compromised data
• Restoring or repairing computer systems
• Responding to a data breach
• Notifying affected customers
• Providing credit monitoring
• Certain business income or operational losses

Third-Party Cyber Coverage

Third-party coverage generally addresses certain claims or expenses involving other parties that are connected to a cyber incident.

This can be particularly relevant for businesses that provide technology, cybersecurity, data processing, or other services where they may have responsibilities related to a client’s systems or information.

The specific protections available will depend on the policy, so businesses should carefully review their coverage with a qualified insurance professional.

What Can Cyber Liability Insurance Cover?

Every policy is different, but cyber liability insurance may help address a variety of expenses following a covered incident.

• Data recovery: Cyber incidents can compromise, encrypt, or otherwise damage business data. Coverage may help with certain costs associated with recovering that information.
• System restoration: If a cyberattack damages or disrupts computer systems, a policy may help cover certain costs associated with repairing or restoring those systems.
• Breach notification: When sensitive information is compromised, businesses may have expenses associated with notifying affected individuals.
• Credit monitoring: Some policies may help provide credit monitoring services to individuals affected by a covered data breach.
• Legal and response expenses: Depending on the policy, cyber coverage may help address certain legal, investigation, crisis-management, or response costs.
• Business interruption or income loss: Some policies may provide coverage for certain losses associated with system downtime following a covered cyber incident.

Again, these are examples, not a guarantee of coverage. Businesses should review the specific terms, conditions, exclusions, and limits of their policy.

Does Cyber Liability Insurance Replace Cybersecurity?

No.

Cyber liability insurance should be viewed as one component of a broader cybersecurity and risk-management strategy. Businesses should absolutely continue investing in cybersecurity fundamentals.

Insurance can help address certain financial consequences after a covered incident, while cybersecurity practices are designed to help prevent incidents or reduce their impact in the first place.

Make Insurance Part of the Conversation

Cybersecurity Awareness Month is a good reminder that protecting a business from cyber threats takes more than one solution.

Start with the basics: train your employees, secure your accounts, protect your data, keep systems updated, and have a plan for responding to an incident.

Then ask another important question: If something goes wrong, is your business financially prepared to respond? Commercial cyber liability insurance may be one part of that answer.

A conversation with a licensed insurance professional can help you evaluate your business’s cyber risks, understand potential coverage options, and determine whether your current insurance program provides the protection of your business needs.

Not a Deposit | Not FDIC Insured | May Lose Value