What is Cyber Insurance?

A cyber insurance policy has two main components. First-party cover responds to costs the business itself incurs following an incident: system and data restoration, business interruption losses while IT systems are unavailable, ransom payments in ransomware cases, forensic investigation costs, legal fees, and crisis communications. Regulatory fines from data protection authorities may also be covered depending on the policy.

Third-party cover responds to claims from clients, suppliers, or other parties whose data was compromised or who suffered loss as a result of the incident. This includes the cost of defending such claims in addition to any damages paid.

Insuers increasingly require businesses to meet minimum security standards before issuing a cyber policy: multi-factor authentication on all remote access, an active patch management programme, regular offline backups, and a documented incident response plan. Failure to maintain these controls can void cover or result in substantially higher premiums.

In contracts with IT service providers, software developers, and data processors, cyber insurance is increasingly included as a procurement condition: the contractor must produce a current certificate of cyber cover and maintain it throughout the contract term. This mirrors the professional indemnity requirement for advisory service providers.

The minimum indemnity level required should be proportionate to the data volumes processed and the business-critical nature of the systems involved.

A cyber incident generates immediate and substantial costs: system recovery alone can run to tens of thousands; business interruption adds lost revenue on top; a data breach triggers GDPR obligations, potential fines, and reputational damage. Without cyber insurance, an SMB absorbs all of these directly.

As a buyer of IT services, you also have an indirect interest in your supplier's cyber cover. If a managed service provider is compromised, your systems may be affected. Require evidence of cyber insurance (with defined minimum limits) as a standard condition in IT and data processing contracts.