ISO 27001 certified
for Modern Work
Privacy claims
Claims against your business for the loss of employee, customer or corporate information, including legal defence costs and settlements.
IT systems
The cost of restoring, repairing or replacing IT systems, records and data after a cyber event.
Business interruption
Lost income and extra expenses when a cyber event stops your business operating normally.
Ransomware
The cost of responding to extortion attempts, including ransomware demands and the recovery that follows.
Reputation
Crisis management, public relations and communication with affected customers after a breach.
Regulatory
Fines and penalties for privacy breaches where the law allows them to be insured, plus legal defence and investigation costs.
A staff member emailed customers about a sale, but attached a spreadsheet of customer names, addresses and card details instead of the flyer. Under the Notifiable Data Breaches scheme that means telling every affected customer and the OAIC, plus investigation costs, possible penalties and credit monitoring.
A business found that someone unknown had accessed one of its servers and files holding customer names, addresses, bank and card details. It needed forensic investigators, notices to every affected person, a report to the OAIC and possibly identity protection for its customers.
If any of these apply to your business, cyber insurance should be part of how you manage risk.
Controls insurers commonly ask for
Insurers have denied claims where a business did not keep up the controls it declared on its application. Common reasons:
Having a policy is not enough. You need to keep the controls you declared, and be able to prove it.
01
Think about your industry, the information you hold and the impact if it were exposed. Healthcare, legal and financial services carry higher risk.
02
Work out what customer, staff and business data you hold, where it lives and who can reach it. It sets the level of cover you need.
03
Have the controls insurers look for running before you approach them. Most treat them as the minimum.
04
A managed IT provider gives insurers confidence that your security is looked after and watched, not set up once and forgotten.
In 2023 a critical infrastructure company we look after was quoted a premium of $105,000 for $2.5 million of cyber cover. We documented how its security controls met the CIS Critical Security Controls and the Essential Eight, and took that evidence to the insurer. The revised quote was $66,500, and the coverage limit doubled to $5 million. Reported by techpartner.news, 14 September 2023.
Reviewed by Elliot Munro, CISO at GCIT.
