How can you select the right cybersecurity insurance policy?

What I’ve found over the past few years is that even if a business owner knows their risk, they don’t understand it enough to properly manage it.

Begin by comprehensively assessing your risk exposure, considering the multifaceted dimensions of your business. Factors to weigh include the size and industry specifics of your enterprise, the magnitude and sensitivity of data under your stewardship, the complexity and security of your systems and networks, your regulatory and compliance landscape, as well as the evolving cyber threats and vulnerabilities you encounter.

Assessing your likelihood of an attack shouldn't be the first step. Every business has a high enough likelihood where this is a non-factor. What you should be assessing, to begin your cyber insurance buying journey, are the various exposures your business may have due to the nature of operations. Do we have a high amount of customer data? Do we have a likelihood of physical harm? Whats our human risk? These factors will directly affect selecting the right cyber insurance policy for your firm.

It’s helpful to understand what your “current” cyber response strategy is when looking for cyber insurance. Some insurers have great partnerships with firms who can help respond and mitigate the impact of a cyber event. In some cases, an organization might already have a sophisticated cyber response strategy and primarily needs financial reimbursement from the policy. Understand what you are paying for and what resources are available in the event of a claim from your cyber insurer.

Your risk exposure really includes to controls or lack of controls that you have as well. Thinks like multi factor authentication at multiple levels, endpoint protection like EDR / MDR, segregated backups, etc.

Your coverage should be more than just an expense; it's an investment in your business's resilience. Combining first-party and third-party coverage can create a robust risk management strategy that leaves no stone unturned.

All reasonable stand alone cyber insurance policies would include both 1st and 3rd party coverages, but there is a lot more granular coverage detail that should be reviewed and considered. Make sure your broker approaches at a minimum 5-10 companies so you can see different coverage and prices.

Every policy is different. No two share the same terms or definitions. It is important to have a translator (cyber insurance agent) during this process.

This step, in my opinion, acknowledges the multifaceted nature of cybersecurity risks. Cyber incidents can incur direct costs such as data recovery and crisis management, which are covered by first-party insurance. They can also result in liability claims and lawsuits from affected parties, which are protected by third-party insurance.

By meticulously exploring policy limits, triggers, exclusions, requirements, and extensions, you forge a holistic understanding of your cybersecurity insurance. This equips you to build a resilient defense that covers the full spectrum of potential cyber threats and challenges..

Triggers, insuring agreements, and sublimits need to be scrutinized. If you don’t know what type of trigger your policy is activating for, it is very hard to create an incident response plan.

A thorough understanding of the terms and conditions ensures that your cybersecurity insurance policy is not only a safety net, but also a valuable asset for effectively managing and mitigating cyber risks.

This should be done in tandem with a dedicated cyber insurance agent who understands cybersecurity. If your agent doesn’t understand the security, they do not understand the risk.

The one that fits your company risk and damage exposure.... In infosec, asset value exposure factor. However do note that insurance can only cover monetary damages (fines and asset damages), reputation from a data breach will be lost forever.

Getting a baseline of your current situation is the first step. If you don't understand your baseline, either task your internal team to develop one, or bring in an expert to establish what your current situation is. Then begin the shopping and negotiation process. From your baseline develop your requirements documents, and since this is a relatively new space, get as many quotes and evaluations from as many potential insurance providers as possible. From these responses/quotes, you may find many other areas that need coverage that weren't previously thought about or even known. Because of the overall risk of an event, this area should be carefully evaluated, don't be in too big of a hurry. But do get it done.

Businesses can tailor the policy to their specific needs and potentially gain more extensive coverage at a lower cost by negotiating. This approach guarantees that your cybersecurity insurance is a strategic asset in managing and mitigating cyber threats, rather than just a financial safety net.

It's also critical to keep up with market trends and changes, such as rising risks, legislation, and technology, which can all have an impact on policy terms and conditions. Businesses may adapt to the ever-changing cyber landscape and ensure that their cybersecurity insurance policy provides the correct degree of protection and coverage for their specific needs and vulnerabilities by engaging in this continual process of evaluation and adjustment.

Your insurance policy should not sit on the shelf and collect dust. It should be used during the cyber incident response planning. Know your panel vendors and understand how playbooks work with your policy.

For SMB in particular, outside guidance should be used to understand and work towards a better cyber posture, ideally aligned to a framework like CIS. This will help you build a comprehensive cybersecurity and risk management program that can be used for defensibility purposes and demonstrating your commitment to security to potential insurers.

Know that this journey is constant. Your business will evolve, which means your risk exposure will evolve. I recommend revisiting your risk register at least annually, and at any policy events (such as renewal) to be sure that you are - Accurately representing yourself to insurers - Identifying and making decisions about new or different risk in your business

Just as important as knowing if a claim will be paid is knowing how a claim will be handled. Will your insurance company provide you with cyber-focused legal counsel, are they capable of conducting an identity theft investigation, can they help you mitigate future breaches of confidential customer data? Do they provide a dedicated Cyber Incident Response Team and cyber claims specialists who will keep you informed through the entire claims process?