How to choose · Cyber insurance
How to choose cyber insurance for a small business
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Cyber policies typically combine first-party cover for your own losses, such as incident response, data restoration and business interruption, with third-party cover for claims from customers or regulators. Compare what triggers each section, the sub-limits and waiting periods, and what security controls the insurer expects. This is general information, not advice on what any business should buy.
Who this is for: An owner or manager of a small or mid-sized business weighing cyber cover alongside existing business policies.
What to evaluate
First-party and third-party sections
Some policies cover only one side, which leaves gaps after a breach.
How to check: List which losses, such as forensics, notification, restoration and liability, are included.
Business interruption terms
Waiting periods and the way lost income is calculated shape how useful this cover is.
How to check: Ask how the waiting period works and how loss is measured.
Sub-limits
Headline limits may be broken into smaller limits for specific events such as ransom or social engineering.
How to check: Read the schedule for each sub-limit and the retention that applies.
Security requirements
Insurers often expect controls such as multi-factor authentication and tested backups.
How to check: Review the application and note which statements you must stand behind.
Incident response support
Access to a panel of forensic and legal specialists can speed up recovery.
How to check: Ask how to report an incident and whether the panel is mandatory.
Retroactive date and claims-made basis
Most cyber policies respond to claims made during the policy period, and a retroactive date limits earlier events.
How to check: Confirm the retroactive date and the notification rules.
Comparison
| Section | What it generally pays for | Watch out for |
|---|---|---|
| Incident response | Forensic investigation, legal advice, notification and crisis communications | Panel requirements and sub-limits |
| Data restoration | Restoring or recreating lost data and systems | Betterment exclusions that do not pay for upgrades |
| Business interruption | Lost income and extra costs after a covered outage | Waiting periods and dependence on third-party providers |
| Liability | Defence and settlement of claims by customers and regulators | Exclusions for fines where not insurable by law |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 6 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| First-party and third-party sections | |||
| Business interruption terms | |||
| Sub-limits | |||
| Security requirements | |||
| Incident response support | |||
| Retroactive date and claims-made basis | |||
| Total (max 18) | 0 | 0 | 0 |
Questions to ask before you commit
- Which security controls does the application require and what happens if one lapses?
- How is business interruption calculated and what is the waiting period?
- Does the policy cover outages at a cloud or other service provider?
- Are ransom payments covered and under what conditions?
- Is cover for funds-transfer or invoice fraud included or excluded?
- Which regulatory fines and penalties are covered where the law allows?
- Do I have to use the insurer's panel of vendors during an incident?
- What is the notification deadline for a possible claim?
Typical trade-offs
Higher retention
- Upside
- Lower premium and fewer small claims
- Downside
- More out-of-pocket cost when an incident occurs
Broader cover with sub-limits
- Upside
- More event types are included
- Downside
- Real protection may be much lower than the headline limit
Invest in controls before buying
- Upside
- Better terms and lower likelihood of an incident
- Downside
- Upfront effort and expense
Common mistakes
- Answering the application loosely. Misstatements about controls can jeopardise a claim, so verify each answer with your IT lead.
- Treating cyber cover as a substitute for security. Insurers pay losses and do not prevent them.
- Overlooking sub-limits for ransom and fraud. Read the schedule, not just the summary.
- Not telling the insurer quickly about a suspected incident, which can breach notification terms.
Related questions
What is the difference between first-party and third-party cyber cover?
First-party cover pays for your own costs after an incident, such as investigators, restoring systems, notifying affected people and lost income. Third-party cover responds when someone else claims against you, for example customers whose data was exposed or a regulator investigating. Some policies include both, while others split them into optional sections. Check each section's limit, retention and exclusions separately because a business can have strong liability cover but little protection for its own downtime.
Do insurers require multi-factor authentication?
Many insurers ask about multi-factor authentication, backups, endpoint protection, patching and staff training on the application form. Requirements differ and some applicants are declined or charged more without key controls. The answers become part of the contract, so accuracy matters. Ask the broker or insurer which controls are mandatory, which are preferred and whether cover can be restricted if a control fails after the policy starts.
Does cyber insurance pay a ransom?
Some policies include ransom-related costs, often with conditions such as notification to the insurer before payment, involvement of the incident response panel and compliance with sanctions and local law. Others exclude it or limit it by a sub-limit. Rules on paying ransoms differ by jurisdiction and may be restricted. Read the extortion section carefully and ask about legal constraints in your territory rather than assuming it is covered.
Is a small business too small to need cyber cover?
Size does not remove exposure. Small organisations hold customer data, use email and payments, and depend on a few systems, so one incident can stop trading. Whether insurance is worthwhile depends on your data, reliance on technology and ability to absorb losses. Compare it with improving security and backups, and use a broker or regulator guidance to understand the options rather than relying on a general assumption either way.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Cybersecurity and Infrastructure Security Agency — US Government, retrieved 27 October 2026
- Information for small and medium sized organisations — National Cyber Security Centre, retrieved 27 October 2026
- Insurance Information Institute — Insurance Information Institute, retrieved 27 October 2026
Related guides
Problems & fixes · Cyber insurance
Cyber insurance exclusions and common coverage gaps
Cyber policies commonly restrict cover for war and state-backed attacks, prior known incidents, failures to maintain stated security controls, infrastructure outages, betterment and some forms of fraud. Reading the exclusions and definitions matters more than the marketing summary. Ask how each exclusion works in practice and whether endorsements can narrow it.
Comparison · Cyber insurance
Cyber insurance versus investing in security controls
Insurance transfers some financial loss after an incident, while security controls lower the likelihood and impact. The two are complementary, and insurers often require certain controls as a condition of cover. A sensible comparison looks at which losses you could absorb, which you could not, and which controls reduce both risk and insurance friction. This is general information, not a recommendation.
Requirements · Cyber insurance
What happens when you make a cyber insurance claim
Claims depend on prompt notification, cooperation with the insurer and its appointed specialists, and keeping evidence. Policies are usually written on a claims-made basis with strict notice conditions. The insurer typically coordinates investigation, legal advice and recovery, then assesses what falls within cover. Read the claims conditions before an incident so you know whom to call and what not to do.
Comparison · Business insurance
Professional indemnity vs public liability insurance for a small firm
Public liability responds to injury or property damage suffered by third parties because of your business activity, such as a client tripping on your premises. Professional indemnity responds to financial loss caused by errors, omissions or poor advice in the service you deliver. A firm can need either, both, or neither depending on how it works, what clients require by contract, and any rules set by its profession.
Comparison · Car insurance
Comprehensive vs third-party car insurance: what actually differs
Third-party cover pays for damage and injury you cause to other people and their property, and nothing for your own vehicle. Intermediate tiers such as fire and theft add loss of your car to those events. Comprehensive cover also pays for accidental damage to your own vehicle, whoever was at fault. Which tier suits a vehicle depends on its replacement value, your ability to absorb a loss, and how the policy words each section.
How to choose · Claims and brokers
How to choose an insurance broker
A broker arranges cover on your behalf, while an agent may represent one insurer. Judge a broker on regulatory status, the range of insurers it can access, how it is paid, how it handles claims and whether it explains policy wording clearly. Ask whether it acts for you or for insurers. This is general information and not advice on any specific purchase.
How to choose · Pet insurance
How to choose excess, co-payment and reimbursement terms on pet insurance
Pet policies share costs through an excess per claim or per condition, a percentage co-payment, an annual or per-condition limit, and sometimes a sub-limit for categories like dental or behavioural care. These interact, so a lower charge may mean paying more at each vet visit. Compare how each feature applies, whether the co-payment increases with age, and how reimbursement is calculated against the vet's actual invoice.