Prior to purchasing a cyber insurance plan, it’s important to understand important details concerning each area of coverage. Each plan has a different structure of coverage that should be compared to the cyber risks identified during your company’s business continuity and IT security planning to ensure there is adequate coverage for all potential cybersecurity risks.
As a standard, cyber insurance coverage covers both first-party and third-party expenses. As its name implies, first-party coverage refers to the direct costs an organization is or will incur as a result of an attack or breach of personal data. Third-party cyber expenses may be incurred as the result of litigation that is commenced by another entity, often as a result of sensitive information being compromised, and may include both legal fees and regulatory fines. The purpose of this post is to review the standard insurance coverage options offered by a cyber insurance policy.
Coverage for Business Interruption and Extortion
It’s important to note that various types of cybercrimes and incidents can directly or indirectly affect an individual’s business operations. Cyber Insurance is designed to provide coverage to help deal with specific issues and costs that may arise after one of these occurrences, which will aid the recovery of the business as quickly as possible.
- Cyber Extortion. The use of ransomware has been on the rise over the last few years and may allow a criminal to gain access to sensitive files and systems. Often, there will be a demand that a ransom payment is made in order to restore your access to your data. It is important to note that cyber insurance can offer support for hiring negotiators and reimbursement for ransom payments.
- Computer Attack. Data storage, networking, and other hardware and software components can be damaged by a targeted attack on a computer system. In some cases, this can lead to outages that affect a company’s ability to operate in a secure and safe manner. A cyber insurance policy can provide coverages for data re-creation services, loss prevention in the future, and resources used to recover from a system outage. Additionally, additional reimbursements can usually be applied to business contingency expenses and extended income recovery as well.
- Misdirected Payment Fraud. If an attacker hacks into a system directly or tricks an employee into opening a malicious email, it may be possible for them to misdirect a payment. Cyber insurance can assist in recovering direct costs and associated expenses associated with an unintended fund transfer.
- Computer Fraud. A third-party individual or group who gains access to a secure system can manipulate information or data in such a way as to commit fraud against the business. Erroneous data entry, tampering with secure information, and other deceitful practices can fall under this category.
- Telecommunications Fraud. In some cyber incidents, a telecommunications system may be compromised and affected by the event. The costs associated with a telephone service provider’s disruption of service or complications can be covered by cyber insurance.
Coverage of public relations and identity recovery
Oftentimes, when data is compromised during a cyber incident, it may affect sensitive information about customers or employees. One example is data related to the Healthcare Insurance Portability and Accountability Act (HIPAA). As a result of state and federal regulations, companies have obligations related to notifying and protecting individuals whose data they access and process in the course of their business. The following expenses may be covered by cyber insurance that is related to the affected individuals:
- Lost wages
- Child and elder care
- Mental health counseling
- Miscellaneous costs
Reputational damage could also be accompanied by the need to take time off so that you can regain your identity. In some cases, you may also be reimbursed for this time lost. Additional support that cyber insurance can provide a business includes costs associated with hiring a public relations firm and implementing improvements that may be recommended after an investigation has been completed.
Coverage of Crisis Management
It is important to understand that the resources required to recover from a cybersecurity incident can be extensive and require the help of third parties. The purpose of cyber insurance coverage is to provide support for a company in a number of important areas related to investigating, coordinating, and securing recovery services as well. Some of these expenses may include:
- Incident response
- Regulatory fines
- Notification of affected parties
- Payment card industry (PCI) assessments, fines, and penalties
- The hiring of a forensic accounting firm
As a result, there may also be additional services and expenses required to review information systems, prepare backups, and determine the exact scope of the breach.
Coverage of third-party lawsuits
Another important aspect of cyber insurance coverage is the potential for third parties to bring legal action against you. There can be a wide range of liabilities that a company may be liable for if their systems have been compromised or if their data has been breached. These are two of the most common types of liability relating to both network security and electronic media.
- Network Security Liability. Many cybercrimes, including ransomware and distributed denial of service (DDoS) attacks, may result in the loss of data related to a business or individual. Support from cyber insurance can help cover the costs of security legal resources, defense preparations, and losses related to the disclosure of third-party data.
- Electronic Media Liability. Compromised electronic media can result in potential liabilities related to copyright infringement, trademarks, and service marks. Cyber insurance coverage provides reimbursement for expenses related to legal violations such as unintended defamation and violation of privacy rights.
Cyber insurance coverage provides support in a number of different areas that may impact a business that has experienced a cybercrime or data breach incident. Although it may never be possible to prevent all forms of cybercrime, supplemental insurance is an effective way to reduce the risks and the potential legal liabilities that may result from such activities. Understanding these types of coverage can help you select a policy and provider that match well with your cybersecurity and overall business needs.
