Small business security
What to check before buying cyber insurance for your small business
Cyber insurance can pay for incident response, recovery, lost income and legal costs after an attack. It can also refuse a claim if what you said on the application doesn’t match reality. Understanding the policy before you need it matters as much as having one.
The short version
Before you sign
- Answer the security questions honestly and accurately.
- Check what’s covered: response, recovery, lost income, liability.
- Read the exclusions and notification time limits.
- Know who you must call first when something happens.
What it usually covers
Policies vary a lot, but common sections include:
| Cover | What it means |
|---|---|
| Incident response | Forensic investigators, IT recovery specialists and legal advice, often through the insurer’s panel |
| Data restoration | Costs to recover or rebuild data and systems |
| Business interruption | Lost income while systems are down, usually after a waiting period |
| Privacy and notification | Costs of notifying affected people and dealing with regulators |
| Liability | Claims from customers or others affected by the incident |
| Cyber extortion | Response to ransomware and extortion, subject to law and policy terms |
| Social engineering or funds transfer fraud | Sometimes included or available as an add-on, often with low limits |
Check specifically whether invoice and payment redirection fraud is covered. It’s one of the most common losses for small businesses and is often excluded or capped. See invoice scams.
What insurers will ask you
Expect questions like these on the application:
- Is multi-factor authentication required for email, remote access and admin accounts?
- Do you have backups stored separately from your network, and do you test them?
- Are devices and software kept updated?
- Do you use endpoint protection?
- Do staff get security awareness training?
- Do you verify changes to payment details by phone?
- Do you have an incident response plan?
Answer accurately
If you say MFA is on everywhere and it isn’t, a claim may be reduced or refused. If you’re not sure, check with your IT provider before answering. It’s better to describe what you have honestly and improve it.
Exclusions and conditions to read
- Failure to maintain security you said you had.
- Unpatched systems or end-of-life software.
- Acts of war or state-backed attacks, which some policies exclude.
- Prior known incidents that happened before the policy started.
- Notification time limits, such as notifying the insurer within a set number of hours or days.
- Panel requirements, meaning you must use the insurer’s chosen responders.
- Sub-limits on particular types of loss.
Questions to ask your broker or insurer
- What exactly happens when I call the claims line at 2am?
- Who are the panel responders, and are they available in Australia?
- Is payment redirection fraud covered, and what’s the limit?
- What is the waiting period for business interruption?
- What security controls are conditions of cover?
- Do I need to tell you about changes to our systems during the policy?
Insurance isn’t a substitute for security
Insurance helps you recover. It doesn’t stop the incident, and the disruption, stress and lost trust aren’t fully covered by any policy. The basics in our Essential Eight guide and a one-page incident plan are what make insurance a backstop rather than your only plan.
Common questions
Is cyber cover included in our business insurance already?
Sometimes in a limited form. Check your existing policies, then decide whether you need standalone cyber cover.
Will insurance pay a ransom?
It depends on the policy and the law. Some policies cover extortion costs. Paying is legal in many cases but not all, and must be reported in some circumstances. Get advice first.
How much cover do we need?
Think about what a week or two without your systems would cost, plus response and notification costs. A broker can help you model it.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.