Cyber insurance

The cover is usually broader than people expect. Alongside the direct costs, most policies include access to an incident response firm, a lawyer who has done this before, and someone to handle notification obligations. For a mid-sized organization, that panel of specialists is often worth more than the payout, because it arrives on day one when nobody internally knows who to call.

The questionnaire is the useful part

Before any of that, you fill in an application. It asks whether you enforce multi-factor authentication, whether every endpoint is monitored, how quickly you patch, whether backups are offline and tested, whether administrator accounts are separated, whether staff receive security training.

Answer it honestly and you have just completed a free security assessment written by people who pay out when it goes wrong. Every question is there because it correlates with a claim. The gaps in your answers are, quite reliably, your actual priority list, and you can work through them regardless of whether you ever buy the policy.

Why it matters to you

Two things, one of which surprises people.

The first is the cover itself. The second is that the questionnaire is now a document you have signed. If you attested to MFA everywhere and it turned out three administrator accounts were exempt, that is a real problem at claim time. Insurers do check, and the check happens at the worst possible moment.

So the rule is simple: do not answer aspirationally. If a control is partial, say it is partial. A slightly higher premium is much cheaper than a declined claim.

What to look at in the policy

• Business interruption: what triggers it, and how long the waiting period is
• Whether an outage at your supplier or cloud provider is covered, since that is a common cause and a common exclusion
• Sub-limits, social engineering and funds transfer fraud are often capped far below the headline figure
• Any panel requirement: some policies only pay for responders they approve, which affects who you are allowed to call at 2am

The honest framing

Insurance is not a security control and it does not reduce the chance of anything happening. It transfers part of the cost. It works best sitting on top of the basics, not in place of them, and the application process will tell you, for free, exactly which of those basics you are missing.