What does cyber insurance cover for a small business?
In the cyber wordings we read: your own losses from a cyber event (lost income, ransomware, response costs) and your liability to others, such as after a data breach. Exclusions include prior incidents, war and outages.
- Source
- Cyber insurance PDSs from two Australian insurers
- Updated
Cyber Insurance — What It Covers for a Small Business
The cyber wordings we read cover losses to your own business, your legal liability to others, and the costs of responding to a cyber event, across a wide range of incident types. Optional extensions can add cover for outages at your suppliers and for cyber fraud.
Your Own Losses
▹ Business interruption: income lost and extra costs when your systems go down because of a cyber event, including in one wording human or system error.
▹ Cyber extortion: ransomware or threats to attack your systems unless you pay.
▹ Response costs: forensic investigation, data recovery, legal advice, public relations and credit monitoring. One wording extends this to incidents at your IT contractor or data processor.
▹ Increased utility costs: when criminals use your systems, phone lines or bandwidth.
Source: cyber insurance PDSs, first-party sections.
Liability to Others
The wordings cover amounts you are legally liable to pay others arising from:
▹ A cyber event in your business, such as a data breach
▹ Multimedia injury, such as defamation or intellectual property infringement in digital content
▹ Payment card industry liability under card scheme rules after a breach
Source: cyber insurance PDS, liability section.
Types of Cyber Event
One wording lists the events it responds to, including:
▹ Malware and hacking
▹ Denial of service attacks
▹ Misuse by employees or partners
▹ Privacy errors by staff that expose data
▹ Card skimming and point-of-sale intrusion
▹ Attacks on web applications
▹ Loss or theft of an IT device
The same wording covers losses enabled by artificial intelligence, if they otherwise fall within the policy. Source: cyber insurance PDS, definitions.
Optional Extensions
▹ Contingent business interruption: losses from a cyber event at a third-party system you rely on, such as a cloud provider.
▹ Social engineering and cyber fraud: direct financial loss from cyber fraud, including payments redirected by deception.
▹ Hardware replacement: repair or replacement of IT hardware damaged solely by a cyber event, within the response costs limit rather than in addition to it.
▹ Directors and officers liability, within the liability limit.
Source: cyber insurance PDSs, optional extensions.
Exclusions
▹ Incidents or circumstances you knew about before the policy started
▹ Intentional, criminal or fraudulent acts by you
▹ Bodily injury or death
▹ Upgrading systems beyond their condition before the incident
▹ Internet, telecommunications or power outages outside your control
▹ Letting a service contract or domain name lapse
▹ Insolvency of your business or a provider
▹ War and state-sponsored cyber operations
▹ Claims that would breach sanctions
Source: cyber insurance PDSs, exclusions sections.
Important Notes
Cyber wordings vary widely in what they include as standard, and limits and sub-limits differ between insurers and between retail and broker-arranged policies. Check the PDS and schedule for your own policy, or ask your broker.
Factual information from the policy wordings cited above, at the date above. It is not personal advice, financial product advice or a recommendation, and cover depends on your policy, schedule and circumstances. PolicyAI can make mistakes: check the current Product Disclosure Statement (PDS) or ask your broker before relying on it. Spotted an error? Tell us. See our disclaimer.
Have a question about your own policy?
Ask PolicyAI and get a sourced report like this one. Your first questions are free, no account needed.
Ask a question