Cyber Insurance for Small Businesses: What Insurers Ask and How to Qualify

The FTC also suggests checking that a policy covers data breaches, attacks on your network, attacks on your data held by vendors and other third parties, and attacks anywhere in the world, and asking whether the insurer will defend you in a lawsuit or regulatory investigation ("duty to defend" wording) and offers a breach hotline that is open every day at all hours (FTC).

Read the exclusions as carefully as the coverage. Fraud where an employee is tricked into sending money, for example, may need specific wording or a separate coverage part, so ask your agent how the policy handles it.

Some controls matter more than others. In April 2023 research that paired insurance claims with security questionnaires, Marsh McLennan found that automated hardening (applying secure baseline settings to servers and operating systems) had the strongest link to fewer incidents: organizations using it were nearly six times less likely to have one. The same release says the three controls insurers had recommended most often were EDR, MFA and privileged access management, and that patching high-severity flaws within seven days was in place at only 24 percent of the organizations studied (Marsh McLennan).

Requirements vary by insurer and by the size of the policy, so treat any list as a starting point and confirm the details with your agent or broker. Our free cyber insurance readiness checker walks through the controls commonly asked about and gives you a fix list in priority order.

Key takeaway: If an application asks about a control, assume the insurer will want proof that it is in place, not just a yes.

How a policy responds depends on its wording and on the facts, so have your agent or attorney walk you through the conditions before you need them. This guide is not legal advice.

Keep records of response costs and staff time as the incident happens, not afterward from memory. The free incident report form includes a cost and time tracker for exactly that, alongside the incident log.

• Answering for the company you plan to be, not the company you are today. If a control is half done, say so and explain the plan.
• Letting a control lapse after the policy starts, such as switching off multi-factor authentication for one executive or letting backups stop running.
• Missing the policy's own conditions, such as how quickly you must report an incident or which response firms you must use.
• Assuming the policy covers something it excludes. Read the exclusions and the definitions, not just the coverage summary.

Key takeaway: An honest "partly" on an application is far safer than a hopeful "yes".

Free templates can close paperwork gaps quickly: an incident response plan template, a tabletop exercise template whose after-action report gives you a dated record that the plan was rehearsed, a data backup and recovery policy, a wire transfer and payment verification policy and a written information security program. Our email security checker shows whether your domain has basic email protections set up, and the cybersecurity assessment gives a broader score.

Speed matters with payment fraud. Coalition says the sooner a policyholder reports suspicious activity, the more likely it is to recover some or all of the stolen money (Coalition). A written wire transfer verification policy, with a call back to a known number before any new or changed bank details, stops many of these losses before they start.

If an attacker demands a ransom, your insurer will usually be part of the decision, but the law still applies. The Treasury Department's sanctions office warns that companies helping victims pay, including cyber insurance firms, may risk violating sanctions rules, and that the U.S. government strongly discourages paying (OFAC advisory). Our ransomware guide covers prevention, the first 24 hours and the payment question in more detail.

If personal information is stolen, North Carolina law may require you to notify the people affected and the Attorney General. See our guide to North Carolina data breach law.