Analecta Cyber Company Blog: Protecting Your Company’s Data with Cyber Insurance


Protecting Your Company’s Data with Cyber Insurance

Analecta LLC - Cyber Insurance Puzzle Graphic Protecting your company's data with a cyber insurance policy - Analecta LLC banner Purchasing insurance coverage against cybersecurity incidents is a best practice that all businesses should implement. There are a variety of companies willing to insure your business with various policies, including insurance against costs arising from:
  • hacking/viruses
  • data destruction, loss and/or theft
  • extortion demands/ransomware
  • denial of service attacks
  • crisis management activity related to data breaches
  • legal claims for defamation, fraud and privacy violations
The market for cyber insurance is evolving. Several of the core business components covered by cyber policies today did not exist just a few short years ago.

Timing is everything

Having insurance for potential cyber threats is a cost effective means to protecting your bottom line from catastrophic disasters. If you do purchase an insurance policy to cover your assets, the point at which you notify your insurance company of a confirmed security incident is not something to guess at. Not notifying them in a timely manner may put you in a deeper hole than you are already in.

NIST guidelines call on businesses to ensure they report incidents consistent with pre-established criteria. More likely than not, reporting requirements will be leveraged by the type of insurance policy you have and the carrier providing that insurance. If local, state, federal or business association laws have reporting time frames that are more restrictive, use that time frame if it is earlier than your policy. This way, you are compliant with any laws as well as your specific policy. Notification laws may differ from state to state, and some industries may have federally mandated reporting requirements. However, most of the notification laws focus more on notifying victims, not insurance companies.

Some insurance policies require an immediate notification to the insurance carrier as soon as a breach has been discovered. If your policy requires immediate notification, ensure that step is included in your incident response plan and checklist. The insurance company will assign a point-of-contact (POC) that will work with you and your company throughout the incident response process and post response cost assessment to get a clearer idea of the cost of your specific data breach. Your POC may be able to help you understand some of the additional, unexpected costs of your incident. Have your POC listed in your incident response plan and keep it updated regularly. 

It is also important to know that a cyber claim may involve more than one insurance company or include third-party liability claims. Knowing when and how to notify the required parties before an incident will help you when one occurs.

Analecta LLC - Cyber Insurance Puzzle Graphic
Notifying your insurance provider when you discover an incident is only one piece of the incident response puzzle. Find out what laws regarding notification apply to your industry and build them into your response plan.

Once a claim is filed

After you have notified the insurance provider and discussed any coverage issues that would apply to this breach, the insurance portion of incident response begins. Insurance companies will require an investigation, which may include legal and forensic analysis. This investigation is not a substitute for your response plan. The insurance provider’s investigation will focus on what is and is not covered by your policy, and it will not necessarily provide you with the information needed to make your systems more secure. Your insurance provider will often select approved third-party providers for the forensic analysis and investigation, depending on the size of your organization.

While the technical response actions are being performed, begin the other components of the response plan. Action items like victim notification, credit monitoring, public relations and data recovery add to the overall cost of the incident. Once again, prior to a data breach or incident, know what your policy includes and expect to make other financial arrangements for items not covered.

Insurance is not a replacement for a comprehensive security plan!

Consider cyber insurance to be an additional safety net that can protect you from the massive costs of a data breach. This should not be the only thing protecting your business from such an attack. Cyber insurance will not cover a number of scenarios that still pose a threat to your business, so you need to maintain a comprehensive security plan and be aware of what your policy will and will not cover. 

Be proactive and take steps to protect your organization prior to a data breach or cybersecurity incident. Here are some articles that can get you started!
It can be difficult to know if you have planned for an incident response properly. Analecta Cyber has a team of experts that can review your response plan as part of our 96-point Cyber Risk Assessment. We aim to enable small and medium-sized businesses to minimize or even eliminate the risk of data breaches that can cause customer loss, reputational damage and severe bottom-line impact. Visit our Cybersecurity website or email us at for more information.

 Further Resources

No comments :

Post a Comment