Every business relies on technology in some way. Maybe you accept electronic payments, communicate with customers by email, store employee information, use cloud-based software or simply depend on your computer systems to keep the business running.
That convenience also creates risks that traditional business insurance may not be designed to address.
October is Cybersecurity Awareness Month, making it a good time to take a fresh look at how your business protects its systems, information and operations. The good news is that cybersecurity doesn’t have to be overwhelming. A few smart precautions, combined with the right insurance protection, can help your business be better prepared.
What is cyber insurance?
Cyber insurance is designed to help businesses respond to certain losses and expenses associated with cyber incidents and data breaches.
Depending on the policy and circumstances, coverage may help with expenses related to investigating an incident, restoring data and systems, notifying affected customers, managing the business’s response and certain liability claims.
The important thing to remember is that cyber policies aren’t all the same. Coverage, limits and exclusions can vary, which makes understanding your particular policy especially important.
Does a small business really need cyber insurance?
It’s easy to think cybersecurity is mainly a concern for big companies with large databases and sophisticated technology. But businesses of all sizes can face cyber threats. The Federal Trade Commission specifically cautions that cybercriminals target companies of all sizes and recommends basic cybersecurity practices to reduce that risk.
Consider how much your business depends on technology during an ordinary day.
Do you:
- Store customer or employee information?
- Send invoices or payments electronically?
- Use email to communicate with customers or vendors?
- Allow employees to work remotely?
- Rely on software or cloud-based systems to operate?
For many businesses, the answer to several of those questions is yes. Cyber risk isn’t just about having a huge amount of sensitive data. It’s also about how a technology-related incident could affect your ability to operate.
Doesn’t my general liability policy cover cyber incidents?
This is an important question and one worth reviewing with your insurance agent.
A traditional commercial insurance program and a cyber insurance policy are designed to address different types of exposures. Rather than assuming your existing insurance would respond to a cyber event, it’s worth reviewing what protection you already have, where there may be gaps and whether dedicated cyber coverage makes sense for your business.
What can businesses do to reduce cyber risk?
Insurance is only one part of protecting your business.
For Cybersecurity Awareness Month, the Cybersecurity and Infrastructure Security Agency (CISA) highlights several fundamental steps businesses and individuals can take, including recognizing and reporting phishing attempts, using strong passwords and a password manager, requiring multifactor authentication and keeping software updated.
CISA also recommends additional measures for organizations, such as backing up and encrypting data, using system logging and having an incident response plan.
These don’t have to be viewed as one enormous cybersecurity project. They can simply become part of the way your business operates.
I outsource my IT. Do I still need to think about cyber insurance?
Yes. Working with an experienced IT provider can be an important part of protecting your business, but technology support and insurance serve different purposes.
Your IT provider can help strengthen and maintain your systems. Cyber insurance is designed to address certain financial consequences if a covered cyber incident occurs.
Think of them as different pieces of the same risk-management plan: reduce the likelihood of an incident where you can, and have a plan for responding if one occurs.
Is cyber insurance right for your business?
There’s no single answer for every business. A small contractor, professional office, retailer and manufacturer may use technology differently and have very different exposures.
That’s why the better question may be:
What would happen to our business if we couldn’t access our systems, information or email tomorrow?
If you’re not sure how your current insurance would respond, now is a great time to find out.
At Davis & Towle, we can help you review your current business insurance, talk through your cyber exposures and determine whether cyber insurance should be part of your overall protection. A conversation today can help you feel more prepared for whatever comes next.