What Is A Cyber Insurance Policy: What You Need To Know

A cyber insurance policy provides financial protection from any actual or suspected data breaches or cyber-attacks that occur on your company's computer systems.

The dramatic increase in cyber-attacks has made this type of coverage critically important for many types of businesses to obtain—virtually no one is safe from a cyber-attack. The most recent and notable example being the ransomware attack on the operator of the largest U.S. fuel pipeline, which shut down 45% of the fuel supply to the East Coast.

To make matters worse, I am writing this article from Tulsa, Oklahoma, which is currently suffering from a ransomware attack that shut
down the city government’s networks.

Cyber security risks are quickly becoming one of the most significant challenges that businesses face. And as time goes on, the chances of your business getting hit go up.

Keep in mind this doesn't just affect large organizations. More than 67% of companies with fewer than 1,000 employees have experienced a cyber-attack, and 58% have experienced a breach.

A cyber insurance policy can help cover your losses and provide expertise on how to deal with a cyber-attack. But what does cyber insurance cover?

Cyber insurance coverage is usually organized into three sections (although each insurance company will label these differently): First Party, Third Party, and Cyber Crime. Almost all policies include Third Party, but you will usually have the option of purchasing the additional First Party and Cyber Crime coverage. Here is what each type of coverage means:

First-Party Coverages

First-party cyber policies cover the costs you incur due to damage of your own property as a result of a cyber event. Think of it like a property insurance policy on a more intangible asset—your data and computer systems. First-party cyber insurance policies include these elements:

Cyber Incident Response

This first coverage is intended to give you resources to address and respond to the cyber-attack. Most insurance companies offer access to their cyber response team, assign a cyber response manager, advise you, provide legal assistance, and provide initial support during the attack.

Aside from the insurance company shouldering the costs for these response efforts, the real advantage is having access to a team of cybersecurity experts to not only stop the attack, but guide you through the process.

System Damage

Frequently, a cyber-attack can destroy your data and render your computer hardware useless. This coverage can provide you with staff or pay your current staff overtime to rebuild your data, recover your data, or even rebuild your systems from a backup.

Business Interruption And Extra Expense

When businesses are unable to provide their products or services, or simply have a disruption in operations due to a cyber-attack, it can lead to significant revenue loss. This coverage can pay for your income loss while you are restoring your systems.

Extortion/Ransomware

Ransomware, one of the most common cyber-attacks happening today, is when cyber criminals block access or threaten to publicize data if a ransom is not paid. This coverage, sometimes included under the crime section of the cyber insurance policy, reimburses you for any ransom you pay in response to an extortion demand.

LandesBlosch Recommendation: If you have remote employees, your chances of experiencing a cyber-attack are much
higher. Common risks include weaker corporate network security, increases in lost or stolen devices, or even more compelling social engineering scams (e.g.. a manager with a compromised account tells an employee to wire money to a "vendor").Having remote employees means you need to view cybersecurity as an increased priority and prepare for a breach to happen, which can include everything from turning on two-factor authentication to purchasing cyber insurance.

Third-Party Coverages

Whereas first-party cyber insurance policies provide coverage that pays for damages you incur as a result of a cyber-attack (or cyber risk liability insurance), third-party coverages provide funds and legal assistance to pay for damages that you cause other businesses, organizations, or individuals.

Network Security & Privacy Liability

One of the most important elements of the cyber liability insurance policy is the network security and privacy liability coverages. This coverage pays for damage done to others arising out of a cyber-attack.

For example, if a client’s confidential information is exposed due to a cyber-attack, resulting in harm to your client, or your breached systems were used to attack a customer's systems.

Regardless, lapses in network security can be a huge deal from both a monetary and reputational standpoint.

Regulatory Fines

Certain industries and types of information are subject to federal regulations and law. If your business operates within a regulated industry, you can be penalized if information is not kept confidential. Laws such as the Health Insurance Portability and Accountability Act (HIPAA) are put in place to protect sensitive data and breaches of that data will result in a certain fine amount per record compromised. These fines can result in millions of dollars.

Media Liability

Media liability is meant to be complementary to the personal and advertising injury liability section of the commercial general liability insurance policy. Usually, these cyber policies expands the list of materials that the commercial general liability policy insures against. For example, the commercial general liability policy covers injury resulting from defamation or intellectual property infringements in advertisements, whereas the cyber policy includes claims resulting from books, magazines, brochures, social media, websites, television, and radio.

Cybercrime

Although cybercrime could also be classified under property coverage, the commercial crime policy aligns with the coverages provided on the cyber insurance policy.

Social Engineering (Or Funds Transfer Fraud)

Social engineering has been and will continue to be one of the largest cyber-related losses for American businesses. This is typically when a hacker compromises someone's account and manipulates that employee into sending them corporate money.

The cyber policy can cover:

• Unauthorized transfer of funds from your bank
• Money theft from your bank by electronic means
• Money theft from your corporate credit card by electronic means
• Phishing, vishing, or other social engineering attacks that result in the transfer of your funds to an unintended party

Telephone Hacking

Although telephone hacking sounds silly, this is a very real threat that can happen if your computer systems are hacked. Especially now that many businesses are switching to VoIP phones to support their remote workers.

What usually happens is cyber-attackers dial a toll number (that they control) from your phone lines during out-of-office hours. You’re charged for every minute of the call, resulting in a transfer of money to the hackers’ account. With VoIP’s expanded functionality (compared to traditional phone lines), you are often not as limited on the number of calls you can place at a single time and these minute-by-minute charges can accumulate rapidly.

For example, many VoIP systems can handle up to 13 calls per user, simultaneously. If you had 50 employees and the phone lines of each were making fraudulent calls to toll numbers with fees, that could add up to substantial amounts of money.

Corporate Identity Theft

Similar to getting your personal identity stolen, the same thing can happen to a corporation. Unfortunately, corporate identities have a lot more moving parts and significant credit lines, so corporate identity theft can be even worse than personal identity theft. A cyber policy can help reimburse you for the costs associated with resolving a situation like this.

Summary

Cyber-attacks are becoming a more significant risk for organizations each year. As cybercriminals increase the sophistication of their attacks, many businesses (all businesses, really) struggle to protect themselves.

Although we always suggest implementing regular software updates, antivirus software, and two-factor authentication on email accounts, and other basic cybersecurity procedures, a cyber insurance policy is an excellent, if not one of the best, fail-safes if a cyber-attack were to happen.