What a Cyber Risk Insurance Policy Covers (and What It Doesn't)

Cyber risk insurance covers the financial costs and the impact on your business of incidents arising from a cyber attack: the technical response to contain the attack and restore systems, data recovery, the money you stop earning while you're at a standstill, and claims from affected third parties. What it doesn't do is pay to upgrade your IT or respond to risks you already knew about or didn't declare. In this article we go through each type of cover with examples for SMEs and the self-employed, what's usually excluded and what to check in the policy before signing.

Does a small business really need it?

The idea that cybercriminals only go after big companies is one of the most costly misconceptions around. Many attacks are automated: they're launched against thousands of email addresses or computers at once and get in wherever they find an open door, regardless of size. That's why any business or self-employed professional who uses email, accepts card payments, handles personal data, has staff working remotely, or uses mobile devices for work has an insurable risk.

Think of an accountancy firm in La Laguna with four employees, a workshop in Santa Cruz that invoices through a cloud programme, or a holiday let in the south of Tenerife that manages bookings and payments online. None of them has an IT department, and all three depend entirely on their data and their email to work.

The two sides of the policy: your losses and other people's

To understand what's covered, it helps to split the policy into two blocks:

• Your own losses: what the attack costs you. Technicians, data recovery, days without invoicing, money diverted through fraud, or handling an extortion attempt.
• Third-party liability: what others claim from you because the incident has affected them. For example, customers whose data has been leaked, or a business that received a virus from your email.

A good policy combines both blocks and adds a third element that is often the most valuable: access to cyber security experts to restore your systems, as well as to lawyers and communications specialists.

The standard types of cover, one by one

The specific cover and its limits depend on the insurer and the type of policy you take out, but these are the ones that usually form part of a cyber risk policy.

Incident response and system restoration

This is the cover that kicks in first. When you detect something strange — encrypted files, a program that won't start, emails you haven't sent — the insurer puts technicians at your disposal to analyse what's happened, cut off the attacker's access and return your systems to a safe state. For a self-employed professional with no IT contact they trust, having someone to call at that moment is the difference between losing a day or losing weeks.

Data loss and recovery

This covers the work of recovering or rebuilding information that has been damaged or deleted: the customer database, the accounts, the files. If you have backups, the work will be restoring them safely; if not, rebuilding from whatever remains. Ask whether the policy also covers the cost of re-entering data by hand when there's no backup.

Business interruption

This compensates the profit you stop earning while your activity is halted or reduced by the attack. For the holiday let, that would be the bookings you can't manage; for the workshop, the jobs you can't invoice. Check two details: the waiting period (the hours of downtime that must pass before it starts to count) and the maximum indemnity period.

There's a nuance that's often overlooked: your business doesn't have to be the one hit by the attack. If it paralyses your technology provider's systems and you can't work as a result, it's important to have cover for the loss of profit, fixed operating costs (including salaries) and expenses to mitigate that loss. Not every policy includes this as standard.

Third-party liability

If a security flaw in your systems leaks customer data or spreads a virus to another business, you can be sued. This cover pays for your defence and, where applicable, any compensation up to the agreed limit. It's the part that connects cyber risk with classic liability insurance, but applied to damage that general liability insurance often excludes.

Cyber fraud and identity theft

This covers money lost when someone impersonates you or your business, or accesses your systems to divert payments. This is where the most important small print in the product lies: it's not the same for an attacker to break into your online banking as for an employee to make a transfer after being deceived by a fake email. This second case, social engineering, is included by some insurers, limited by others and excluded altogether by others. We cover it in depth in CEO fraud, phishing and fake invoices.

Legal advice and reputation management

After an incident involving personal data, decisions have to be made against tight deadlines: who needs to be notified, how to inform those affected, what to say if a customer asks or if the matter reaches the local press. The policy usually covers specialist lawyers and communications consultants so you don't have to improvise.

Cyber extortion

This is the case of data being held hostage: your files are encrypted and you're asked for a payment to release them, or threatened with having them published. This cover usually includes crisis management with experts. The extent of cover for the payment itself varies a lot between insurers and has its own conditions, so never negotiate or pay anything without speaking to the insurer first.

What a cyber risk policy usually doesn't cover

Each insurer writes its own exclusions, but some come up frequently and are worth knowing before signing:

• Upgrades to your systems. The insurance returns you to the situation before the attack; renewing equipment or installing better software is down to you.
• Events prior to taking out the policy that you already knew about, or attacks that were already under way when you signed.
• Intentional acts by the insured party or their directors.
• Failure to comply with what was declared. If you said you made backups or that remote access went through a VPN and it wasn't true, the insurer can dispute the claim.
• Breakdowns without an attack, such as a hard drive failing from wear, which depending on the policy type may be excluded or handled separately.
• Administrative penalties: cover for these is limited and depends on the policy and on what the law allows in each case.

Quick table: which part of the policy responds

Situation	Cover that usually responds	What to check
A virus encrypts your computers and you can't invoice	Incident response, data recovery and business interruption	Waiting period and daily or total limit
Your cloud management software goes down because of an attack on the provider	Business interruption for a supplier incident	That it's expressly included
A customer complains because their data has been leaked	Third-party liability and legal advice	Limit and defence costs
An employee pays an invoice with a changed bank account	Cyber fraud or impersonation	Whether it includes social engineering and with what sub-limit
You're asked for a ransom not to publish your data	Cyber extortion	What expenses are covered and how they're authorised

The questionnaire and what you need to report afterwards

To issue the policy, the insurer usually asks for information about backups, antivirus software, remote access, card payments or the number of computers you have. Answer it together with whoever handles your IT and keep a copy. Those answers form part of the contract.

If you later change the way you work, that can be an increase in risk. If you already have cyber insurance, remember to tell your broker when staff start connecting remotely without meeting the same security standards, when there was no remote access before and now there is, when you start processing card payments remotely, or when personal devices are used that don't meet the company's security measures. We covered this in our article on cyber security and remote working.

Self-employed or SME: what changes

For a self-employed professional, the priority is usually technical assistance, data recovery and fraud, because a single day without a computer or a diverted transfer weighs heavily on their finances. For an SME with staff, business interruption, third-party liability and legal advice matter more, because it handles more data and more relationships with customers and suppliers. The policy is customisable: cover can be added or removed to suit each case.

Common mistakes when taking out cover

• Comparing only the price without looking at the sub-limits for fraud and extortion.
• Assuming that multi-risk or liability insurance already covers cyber incidents.
• Answering the questionnaire from memory and without whoever handles your IT.
• Not reviewing the policy when the way you work changes: remote working, an online shop, a new cloud programme.
• Not having the phone number or channel to report an incident to hand. In the first 48 hours after a cyber attack we explain why this is the very first step.

How we can help at Retuerto y Asociados

As brokers, we compare several insurers and set out in writing what each proposal covers, with its limits and exclusions, so you can decide with full information. We also review your current policies to avoid overlaps and gaps, as part of our risk management service. You'll find all the details on the cyber security insurance for businesses page, and you can ask us for a comparison at free quote.