Cyber Insurance for Businesses: Requirements, Coverage and Cost Factors
Learn what cyber insurance covers, the security controls insurers commonly require, what drives premiums and retentions, and how to compare quotes without overlooking exclusions.
Cyber insurance helps pay for costs after a security incident, such as forensic investigation, legal advice, notification, data recovery, business interruption and, depending on the policy, ransom-related events. To qualify, and to get reasonable terms, insurers typically require baseline security controls, most commonly multi-factor authentication, tested backups, endpoint protection and patching. Premiums depend on your industry, revenue, data volumes, controls, claims history and the limit and retention you choose. This guide explains the structure so you can compare quotes sensibly.
What cyber insurance usually covers
Policies are generally split into first-party coverage (your own losses and response costs) and third-party coverage (claims against you).
| Coverage | What it typically pays for |
|---|---|
| Incident response | Forensics, breach counsel, crisis communications |
| Notification and monitoring | Notifying affected individuals, credit monitoring where required |
| Data recovery | Restoring or recreating lost data and systems |
| Business interruption | Lost income and extra expenses during an outage |
| Cyber extortion | Negotiation and, depending on terms and law, ransom payments |
| Liability | Defense and settlements for privacy or network security claims |
| Regulatory | Defense costs and some fines and penalties where insurable |
| Social engineering or funds transfer fraud | Often limited by a sub-limit and specific conditions |
Coverage wording varies significantly. Two policies with the same total limit can treat ransomware, funds transfer fraud or system failure very differently.
Controls insurers commonly ask about
Application forms and underwriting questionnaires often ask whether you have:
- MFA on email, remote access, privileged accounts and backups
- Endpoint detection and response (EDR) on workstations and servers
- Regular, tested backups with offline or immutable copies
- A patching process for critical vulnerabilities
- Email filtering and employee security awareness training
- Network segmentation and secured remote access
- An incident response plan
- Limits on privileged access and service accounts
- End-of-life software removed
Answer truthfully. A misstatement on an application can give the insurer grounds to deny a claim or rescind the policy. If you are unsure whether a control is fully in place, say so and ask your broker or IT provider before submitting.
What drives the premium
Insurers evaluate your risk using several factors, and you can influence many of them:
- Industry: sectors that hold sensitive data or rely on uptime, such as healthcare, finance and professional services, are viewed differently from low-data businesses.
- Revenue and size: larger revenue generally means larger potential loss.
- Data volume: the number of records containing personal, health or payment information.
- Security controls: documented MFA, backups and monitoring can improve terms.
- Claims history: prior incidents influence pricing and eligibility.
- Limit and retention: higher limits cost more; higher retentions lower premium.
Limit and retention: a worked comparison
Retention is the amount you pay before the policy responds. Suppose a loss of $150,000 (an illustrative scenario) and three example quotes:
- Quote A: premium $2,400, retention $10,000, limit $1,000,000
- Quote B: premium $3,600, retention $2,500, limit $1,000,000
- Quote C: premium $1,800, retention $25,000, limit $250,000
Combined cost for this scenario is premium plus the portion you pay yourself. A: 2,400 + 10,000 = $12,400. B: 3,600 + 2,500 = $6,100. C: 1,800 + 25,000 = $26,800. Quote B costs the most in premium but least in this scenario. For a $5,000 loss, A would cost 2,400 + 5,000 = $7,400, B would cost 3,600 + 2,500 = $6,100 and C would cost 1,800 + 5,000 = $6,800. Use the quote comparison tool to test your own numbers.
Questions to ask your broker
- Is ransomware subject to a sub-limit or coinsurance?
- How is business interruption calculated, and is there a waiting period?
- Does the policy cover funds transfer fraud, and what verification steps are required?
- Must I use specific panel vendors for forensics and legal help?
- What are the exclusions, such as war, infrastructure failure or unpatched known vulnerabilities?
- Does the policy cover incidents caused by a vendor I depend on?
- What conditions could void coverage, for example failure to maintain stated controls?
How security services and insurance fit together
Insurance transfers part of the financial risk; it does not prevent incidents. Many underwriters look more favorably on organizations with MDR, tested backups and documented processes. If you are shopping for both, ask your broker which controls matter most before you spend money, so your security budget supports insurability. See what affects the price and how to get the best deal.
State laws and notification costs
All 50 U.S. states have data breach notification laws, and requirements differ on timing, content and who must be notified. Federal rules also apply in some sectors, such as the HIPAA Breach Notification Rule for covered entities and business associates. An attorney experienced in data privacy can explain your obligations. Insurance policies often pay for breach counsel, but you generally need to notify the insurer promptly, so keep the claims hotline number accessible offline.
Frequently asked questions
Is cyber insurance mandatory?
Not by general law, but customers, lenders or contracts may require it. Check your agreements.
Does insurance pay ransoms?
Some policies cover extortion payments subject to terms and legal restrictions; others exclude them. Ask specifically and review the wording.
Can I buy it without MFA?
Many insurers decline or restrict coverage without MFA. Adding it is often the single most valuable step.
Should I buy the highest limit?
Choose a limit based on realistic loss scenarios, such as downtime cost per day, notification costs for your record count and legal exposure. A broker can help model them.
Sources
- National Association of Insurance Commissioners (NAIC) — state insurance regulators and consumer information
- CISA — baseline controls and ransomware guidance
- U.S. Department of Health and Human Services — HIPAA Breach Notification Rule
- Federal Trade Commission — data breach response guidance for businesses
