As a business of any size, it is likely you will rely on information technology (IT) infrastructure to some degree. If so, you will be exposed to the risks of business interruption, income loss, damage management and repair, and possibly reputational damage if IT equipment or systems fail or are interrupted.
While existing insurance policies such as commercial property, business interruption or professional indemnity insurance, may provide some elements of cover against cyber risks, businesses are increasingly buying specialised cyber insurance policies to supplement their existing insurance arrangements, particularly if they:
- hold sensitive customer details such as names, addresses or banking information;
- rely heavily on IT systems and websites to conduct their business;
- process payment card information as a matter of course.
Policies generally include significant assistance and management of the incident itself, which can be essential when faced with reputational damage or regulatory enforcement. The Information Commissioner’s Office (ICO) should you have a breach where personal data has gone missing, will ask what countermeasures and internal processes had been put in place to protect your customers. If you have no evidence that you had taken advice on the best ways to protect your customers’ data then they will not look kindly upon this and in most cases, this will result in a fine.
Generally, cyber risks fall into the first party and third party risks. Insurance products exist to cover either or both of these types of risks.
First-party insurance covers your business’s own assets. This may include:
- Loss or damage to digital assets such as data or software programmes
- Business interruption from network downtime
- Cyber exhortation where third parties threaten to damage or release data if money is not paid to them
- Customer notification expenses when there is a legal or regulatory requirement to notify them of a security or privacy breach
- Reputational damage arising from a breach of data that results in loss of intellectual property or customers
- Theft of money or digital assets through theft of equipment or electronic theft
Third-party insurance covers the assets of others, typically your customers. This may include:
- Security and privacy breaches, the investigation, defence costs and civil damages associated with them
- Multimedia liability, to cover investigation, defence costs and civil damages arising from defamation, breach of privacy or negligence in publication in electronic or print media
- Loss of third-party data, including payment of compensation to customers for denial of access, and failure of software or systems
