Do I need cyber insurance?

Understand what these policies actually cover, because the name suggests something broader than what is provided. First party cover addresses your own losses: investigating an incident, restoring data, business interruption while systems are down, and in some policies ransom payments. Third party cover addresses claims from others: notification costs when customer data is exposed, legal defence, and regulatory penalties where they are insurable. Those are different things and a policy may include one and not the other.

The threshold worth applying is what a realistic incident would actually cost you. A business holding no customer data beyond names and email addresses, running on hosted services somebody else secures, faces a smaller exposure than one holding payment details, health information, or a database its operations depend on. The second category should price cover early. The first can reasonably defer it.

Notification obligations are the cost most businesses underestimate and the one this cover addresses most usefully. If personal information is exposed, several states require you to tell the people affected within a defined period, and doing that properly involves legal advice, communication, and frequently credit monitoring. That process costs real money for a small business and arrives at a moment when revenue is already disrupted.

Check what you already have before buying anything new, since some general liability and business owner policies include limited cyber elements, and some payment processors and platforms provide narrow protections. Those are rarely sufficient on their own and they change the calculation of what you actually need to add.

Read the exclusions rather than the cover, which is the most useful advice for any policy in this area. Common exclusions include incidents arising from unpatched software, from failing to maintain stated security controls, and from acts of employees. A policy that requires two factor authentication and multi factor on remote access is not paying out if you did not have them, which means the insurance depends on doing the basics anyway.

Expect the application to ask about your practices, and treat that as useful rather than intrusive. Insurers ask about backups, two factor authentication, staff training, and patching because those correlate with claims, and answering honestly frequently reveals gaps worth closing regardless of whether you buy the policy.

Consider the requirement rather than only the risk, because contracts increasingly drive this. Larger clients, particularly in regulated sectors, may require evidence of cyber cover before signing, and that arrives as a condition rather than a choice. If you are moving toward that kind of client, pricing it early is sensible.

Then revisit it annually and whenever what you hold changes. Taking payments directly, adding a customer portal, storing health or financial information, or hiring staff each change the exposure materially, and a decision made in year one against a much smaller footprint should not stand unexamined.

Ask what the insurer actually provides beyond payment, because the response services frequently matter more than the cover for a business with no internal capability. Access to an incident response firm, legal advice on notification obligations, and communication support are things a small business cannot arrange under pressure, and their absence from a cheaper policy is worth noticing.

Then reassess after any incident, however minor, because a near miss is the cheapest evidence available about what your actual exposure looks like. A phishing attempt that nearly succeeded, or a supplier breach that touched your data, tells you more about the realistic scenario than any general assessment.