Cyber insurance: more than just financial protection
Cyber insurance helps reduce the financial impact of a cyberattack. It also provides businesses with a range of essential support services in the event of an incident.
Rapid assistance: Because every minute counts following a hacker attack, a cyber insurance policy for businesses also provides advice and support.
Today, even small businesses and self-employed professionals can hardly operate without computers. This applies equally to doctors, tradespeople, small guesthouses, and logistics companies. The more dependent a business is on technology, the more serious the consequences of a cyberattack can be. If a virus or other malicious software takes IT systems offline for an extended period, the survival of the business itself may be at risk.
Cyber insurance helps protect businesses against such consequences. It pays an agreed amount of compensation if a cyberattack causes business operations to come to a complete or partial standstill.
However, cyber insurance is more than simply financial protection against losses. After an attack, every minute counts when it comes to limiting the damage, and the rights and interests of third parties may also be affected. For this reason, cyber insurance policies typically include important support services. These can be particularly valuable for smaller businesses that may not have the necessary expertise in-house.
What a standard cyber insurance policy covers
-
Compensation for business interruption
Following a cyberattack, machinery may come to a standstill and office operations may become impossible if computer systems are unavailable. In such cases, the insurer steps in and pays an agreed daily amount until normal operations can resume. This effectively compensates the business for lost profits while also helping it meet ongoing expenses. The daily compensation amount can, for example, be calculated using the following formula:
Daily rate = annual revenue / 365 days × profit margin + annual costs / 365 days
However, the appropriate daily rate should also reflect the specific characteristics of the business. For example, a retailer may generate a particularly large proportion of its annual revenue during the Christmas season. Such seasonal dependencies should therefore be taken into account when determining the insured daily rate. For this reason, the amount is agreed individually.
-
Reimbursement of data recovery costs
Anyone who has ever had to reinstall a personal computer after a virus infection knows how time-consuming it can be to restore data and systems. For businesses, the effort and expense can be considerably greater. If data has to be painstakingly reconstructed, expensive specialists may be required. Cyber insurance covers the costs of reconstructing data and restoring computer systems.
The more data that needs to be recovered and the more complex the recovery process, the more expensive the work can become. Daily rates of €1,000 for IT specialists are not uncommon.
-
Coverage for third-party losses
If sensitive customer data is stolen from a company's network, the business may be held liable. Customers may be entitled to claim compensation from the company if their stolen data is misused.
Cyber insurance can compensate affected customers and defend the insured business against unjustified claims. Coverage may also apply if customers suffer losses because the company is unable to supply goods or services following a cyber incident.
-
Coverage of IT forensics costs
A cyberattack requires a rapid response. The insurer can provide specially trained experts to assist the affected business. These IT forensic specialists investigate why systems have failed or a network has been brought down. Identifying the cause of an incident is essential for assessing the extent of the damage and preventing further losses.
IT forensic expertise is also often essential for securing evidence in a manner that can be used in legal proceedings.
-
Legal advice following data protection breaches
If sensitive data is stolen, businesses may have to explain the incident to data protection authorities and affected individuals. Failure to handle the situation correctly can result in substantial fines. To help businesses meet their legal obligations and avoid unnecessary legal exposure, cyber insurance provides access to lawyers who specialize in IT and data protection law. The insurer covers the cost of obtaining legal advice on whether a data protection breach has occurred and how it should be handled.
-
Crisis communications and call center costs
A headline such as “Data Scandal at ...” can appear very quickly after a cyber incident. If a company handles the resulting public attention poorly, its reputation may suffer lasting damage. When necessary, cyber insurers can arrange and pay for crisis communications specialists to help handle any potential reputational harm.
Policies may also provide coverage for the cost of setting up or using a call center. This may be necessary, for example, when a publicly disclosed cyberattack results in so many customer inquiries that the company's normal telephone lines become overwhelmed.
What does my business need to do to qualify for cyber insurance coverage?
Before a business can obtain cyber insurance, its IT systems must meet certain minimum-security standards.
This is not unusual in the insurance industry. For example, household contents insurance would generally require a home to have a lockable door. Similarly, jewellers may be unable to obtain theft insurance unless they can demonstrate an appropriate level of protection for their valuable merchandise, such as approved safes and reinforced display windows.
To qualify for cyber insurance, businesses may therefore be required to have measures such as antivirus protection in place, protect company data through individual employee access credentials, and perform regular data backups.