Cyber Insurance

Is your organization financially able to withstand a cyber-attack? What if you had to shut down for a week or a month? What kind of financial impact would that have on your company? These are important questions to ask yourself as you weigh investing in cyber-security insurance. 

First a few data points from recent studies: 

• While the large multinational companies affected by ransomware garner all the coverage, the threat was not among the top three cyber threats identified by small businesses. Business owners may be underestimating the threat of ransomware, however, MSPs are not. 85% of MSPs consider ransomware one of the biggest threats to their SMB clients.  
• 30% of small businesses consider phishing attacks to be their biggest cyber threat. 
• 83% of small and medium-sized businesses may not be financially prepared to recover from a cyber-attack. 
• Despite these sobering numbers, 91% of small businesses haven’t purchased cyber liability insurance.  

There are many reasons to invest in cyber insurance if you haven’t already. First, it can assist in the timely remediation of cyberattacks and incidents and help cover the financial losses that result from these events. Second, and perhaps most importantly, it will be increasingly difficult to operate your business in the future without it as more contracts that your business enters into will require that you have it and some may even dictate a minimum set of controls to be in place. 

Cyber insurance is a specialty insurance intended to protect businesses from Information Technology risks related to technology infrastructure, data privacy, and data governance liabilities. It is often excluded from a general liability policy.  

It covers losses due to: 

• Data Destruction /Ransomware 
• Extortion 
• Data Theft / Loss 
• Hacking 
• Denial of Service Attacks 

Other benefits include: 

• Specialized Legal Representation 
• Incident response and forensic analysis (The Cyber Insurance provider should be at the top of your contact list as referenced in your Incident Response Plan) 
• Public Relations Expertise 

• Negotiation and Payment of Ransom 

There are limitations however and they may include: 

• Ransomware payments (dollar amount) 
• Potential future lost profits 

• Loss of value due to theft of Intellectual Property 
• Betterment (The cost to improve technology systems or security upgrades) 
• Regulatory Fines (PCI DSS – Payment Card Industry Data Security Standards) 
• Security Standards Exclusions  

Like technology itself, the future of cyber insurance is ever evolving and there are many factors to consider when you are planning your investment: 

• Insurance companies are starting to mandate security controls. You can expect this list of mandates to grow. 
• As with all insurance, with increased payouts of benefits, you should expect premium costs to increase. 
• Likewise, cyber insurance companies will expand their list of exclusions  
• The various policies available today will converge and begin to standardize. 

It is vitally important, as part of your detailed incident response and business continuity plans, to engage with your carrier when you have: 

• Verified a ransomware attack 
• Discovered a data breach / loss 
• Experienced a meaningful interruption of business 

• Discovered Indicators of Compromise (IOCs) found on your network 
   

To acquire your cyber security insurance policy, it is best to first determine the right policy for your business. This process should be a cooperative effort between legal, risk management, IT, and your insurance specialists. Many Cyber Security MSPs can provide guidance to help you navigate this process. In addition, the MSPs can help you review and implement security controls in compliance with CIS, NIST, IS 27001, PCI DSS recommendations and/or requirements. 

To learn more about how Envision IT can maintain the health of your technology environment, strengthen your security posture, and help your organization address the ransomware crisis from “readiness to response”, visit us at www.envisionitllc.com or give us a call at 608.824.2060.