Cyber Insurance Coverage: Know Its Ins and Outs

The notion of cybersecurity insurance seems pretty straightforward. Like how vehicle insurance is considered as a wise option for any vehicle on the road, a cyber-insurance coverage is a popular contract to help organizations reduce the financial threats associated with data breaches and other security events.

These policies are intended to help companies endure major cyber-attacks by offsetting the recovery costs. And, there’s no question that cyber insurance is on the rise. In recent years, this segment has seen a significant uptick. Insurers penned just about $4.5 billion in global cyber insurance premiums in 2017, and the number is expected to reach $17.5 billion in 2023, as per Orbis Research.

However, knowing exactly what’s covered in cyber insurance can be quite tricky. Since this segment is new, there isn’t much standardization in the way risks are determined or defined.

This write-up offers essential info about cyber insurance, including cyber insurance coverage types and challenges.

Cyber Insurance Industry Challenges

Cyber threats are continually changing. A cyber policy that primarily covers all the losses that occurred due to data exposure or network outages may not cover high-risk threats of today, such as ransomware, cryptojacking, etc. Likewise, IT infrastructures are experiencing endless changes resulting in the changes in risks associated with it. These challenges affect both insurers and consumers.

Furthermore, cyber coverage options are often unclear and not standardized. It can overlap with some of the standard property and liability coverage, leading to misinterpretation of who is responsible for covering a loss.

Types of Cyber Insurances

Cyber coverage can be either first-party or third-party. First-party insurance covers losses such as data destruction or lost revenue that affects the insured organization. Third-party coverage includes liability regarding other parties because of a data breach or cybersecurity incident such as banks and card brands impacted by a payment card data breach, or consumers affected by leakage of their data.

Here are some of the common cyber insurance options:

• • Response Services

    This coverage insures the costs allied with breach response. In a few cases, the insurer will also offer breach response services such as:

    1. Legal counsel
    2. Crisis management
    3. Forensics services
    4. Credit monitoring
    5. Notification
    6. Public relations
    7. Call center services

• Regulatory Defense & Penalties

  The insurance covers the costs associated with the regulatory action, including assessment, investigation, or penalties due to privacy or security regulations violation.

• Information Security & Privacy Liability

  It includes claims and damages payable in line for parties because of a computer security failure or a data breach. This can also cover some of the explicit violations of security-related laws, such as liability for failure to inform affected parties immediately following a breach.

• Payment Card Industry (PCI) Penalties & Costs

  PCI is a contractual requirement, and thereby, associated fines and costs are usually not covered under governing defense and penalties. Some insurance policies clearly dismiss contractual compulsions. Establishments storing or processing payment card data must consider PCI-specific coverage.

• Media Liability

  This coverage involves costs that the policyholder is required to pay because of plagiarism, defamation, copyright infringement, libel, or other slack acts concerning the publication of media.

• Cyber Extortion

  It includes ransom payments and other fees related to extortion containing digital assets. This type of coverage classically covers the expenses of retaining security specialists to resolve the event.

• Cyber Terrorism

  This coverage is meant for damages caused by a cyber-terrorism act, as defined by the federal Terrorism Risk Insurance Act. Here the losses must surpass $5 million in aggregate, and it must be a violent act that is dangerous to property, infrastructure, or human life. And this act must be committed as part of an effort to compel the civilian population of the U.S or to affect the policy or the conduct of the U.S Government by force.

Bottom Line

Cyber insurance policy isn’t one-size-fits-all. If it’s not aligned with your business needs or risk profile, it will just be a waste of money. So, invest some time researching the different policies and pick the one that’s right for you!

Michael Stewart