Cyber insurance does not replace security, but it can limit the financial damage of an incident and provide specialists an SME would otherwise have to find first.
What is typically covered
Own damages such as forensics, restoration of data and systems and loss of income from business interruption; third-party liability claims, for example after customer data leaks; costs of crisis communication and legal advice; depending on the policy, costs related to extortion. The exact scope varies widely between policies and should be checked point by point.
What insurers require
Insurers assess the security posture before signing, often with detailed questionnaires. Typical requirements are multi-factor authentication for email and remote access, backups following the 3-2-1 rule with an offline copy, timely vulnerability management, endpoint protection and training. Those not meeting the requirements face higher premiums, exclusions or no cover at all.
The questionnaire matters
False or overly optimistic answers in the questionnaire are the biggest danger to cover. If after an incident it emerges that MFA was not enabled as stated, the insurer may reduce or refuse payment. Answers should therefore be checked and documented by IT.
In an emergency
Many policies require calling the insurer’s emergency number before engaging your own providers. This rule belongs in the incident response plan, together with statutory reporting duties. Preparation is described in our cyber insurance checklist.