Cyber insurance for California small businesses

Short answer: If your business stores customer, patient or employee information, or relies on email and computers to get paid, a cyber incident can cost you money even if you're small. California law requires businesses to notify affected California residents of a data breach, and since January 1, 2026 that notice is generally due within 30 calendar days of discovering the breach. A cyber policy can pay for the forensic investigation, legal advice, notification letters, credit monitoring, ransomware response, lost income while systems are down, and lawsuits or regulatory claims that follow. Most policies today also require basic security controls, like multi-factor authentication and backups, before they'll quote.

This guide is general information for California small businesses. It's not legal advice; talk to a privacy attorney about your specific obligations. Your policy wording controls.

Step 1: Know the California rules that drive cyber costs

The California Privacy Protection Agency (cppa.ca.gov) administers the CCPA. Whether the CCPA applies to your business depends on thresholds in the law; ask your attorney.

Step 2: List what you'd actually lose in an incident

Most small business cyber losses fall into a few buckets:

• Ransomware: your files or systems are encrypted and you can't operate.
• Business email compromise (BEC): a criminal gets into an email account and tricks you, a client or a vendor into wiring money to the wrong account.
• Data breach: customer or patient data is stolen, triggering notice duties and possible lawsuits.
• Lost income: your website, booking system or point-of-sale system is down.
• Social engineering: an employee is tricked into sending money or gift cards.

Write down which systems you depend on, what data you keep and how money moves in and out. That's what an underwriter will ask about.

Step 3: Understand first-party and third-party coverage

A good small business policy includes both. Ask whether limits are shared or separate, and what the sub-limits are for ransomware, business interruption and social engineering.

Step 4: Close the funds transfer fraud gap

Many small business losses come from wire fraud, not hacking. Coverage for this is often split across:

• Funds transfer fraud: a criminal directly instructs your bank to move your money.
• Social engineering / fraudulent instruction: an employee is tricked into sending money.
• Invoice manipulation: a criminal changes a vendor's invoice and your client pays the criminal.

These can sit in the cyber policy or a crime policy, often with low sub-limits. Ask where each is covered and at what limit. If you suspect fraud, report it right away to your bank and to the FBI's Internet Crime Complaint Center (ic3.gov); speed matters for recovering wired funds.

Step 5: Get your controls in place before you apply

Cyber insurers now expect basic security. Applications commonly ask about:

• Multi-factor authentication (MFA) on email, remote access and admin accounts.
• Offline or immutable backups that are tested.
• Endpoint detection and response (EDR) or modern antivirus on all devices.
• Software updates and patching.
• Employee phishing training.
• Payment verification procedures, such as calling a known phone number before changing wire instructions.
• Encryption of laptops and sensitive data.

CISA's free cyber guidance for small businesses is a good place to start. Answer the application accurately; a wrong answer about MFA or backups can create claim problems later.

Step 6: Choose limits and retentions

There's no single right limit. Think about:

• The number of records you hold (customers, patients, employees).
• What a week or a month of downtime would cost.
• Contract requirements from clients, landlords or partners, especially in health care, finance and tech.
• Your appetite for a deductible (called a retention in cyber).

A common starting point is $1 million, adjusted up for firms that hold a lot of sensitive data.

Step 7: Read the important policy terms

• Claims-made: most cyber policies cover claims first made during the policy period. Keep coverage continuous and check the retroactive date.
• Panel vendors: many policies require using the insurer's approved breach coach and forensics firm. Call the insurer's hotline first.
• War and state-actor exclusions: read how broadly they're written.
• Unencrypted device exclusions and failure to maintain security exclusions.
• Voluntary shutdown: whether business interruption applies if you shut systems down to contain an attack.
• Contingent business interruption: losses when a key vendor (like your cloud software provider) goes down.
• Betterment: whether the policy pays to improve your systems after an incident.

Step 8: Line up your contracts

Clients and vendors increasingly require cyber coverage and specific limits. Read:

• Client contracts for cyber insurance and indemnity requirements.
• Vendor contracts (IT, payroll, cloud) for who's responsible if their breach exposes your data.
• Payment processor agreements for PCI obligations.

Step 9: Make an incident response plan

Write a one-page plan:

1. Who to call first: the insurer's breach hotline, your IT provider and your attorney.
2. How to isolate infected devices without destroying evidence.
3. Where your backups are and who can restore them.
4. Who decides about notifying customers, and how you'll meet the 30-day California deadline.
5. How to reach your bank fast if money was wired.

Keep a paper copy; your systems might be down.

Step 10: If you have an incident

1. Don't pay a ransom or delete anything before calling the insurer's hotline.
2. Call your insurer, then your IT provider, then counsel.
3. Preserve logs and affected devices.
4. Report wire fraud to your bank and to ic3.gov immediately.
5. Track all costs and lost income from day one.
6. Follow counsel's advice on notice to residents and, if over 500 residents are affected, to the Attorney General.

Step 11: Where cyber fits in your program

Cyber sits alongside general liability, property, crime and professional liability. GL and property policies usually exclude or sharply limit cyber losses. See Small business insurance in California: required vs. recommended, Cyber liability insurance and Cyber insurance for small businesses.

Questions to ask your agent

• Does this policy include both first- and third-party coverage?
• What are the sub-limits for ransomware, business interruption and social engineering?
• Is funds transfer fraud covered here or in a crime policy?
• What's the retention and the waiting period for business interruption?
• Which security controls are required, and what happens if one fails?
• Is there a war or state-actor exclusion, and how is it worded?
• Who are the panel vendors, and can I use my own IT firm?

Key terms

• Breach coach: A privacy attorney who guides your response.
• Retention: The cyber version of a deductible.
• BEC: Business email compromise.
• Social engineering: Tricking someone into sending money or data.
• Claims-made: Coverage tied to when the claim is first made.
• Retroactive date: The earliest date of incidents the policy will cover.

Common mistakes

• Assuming you're too small to be targeted.
• Assuming GL or property covers cyber.
• Answering "yes" to MFA when it isn't on every account.
• Paying a ransom before calling the insurer.
• Not having a plan to meet California's 30-day notice deadline.

Frequently asked questions

Alishahi Insurance · 439 N Canon Dr, Penthouse, Beverly Hills, CA 90210 · (877) 711-4545 · CA License #4348151. General information only. Not legal, tax or financial advice, and not a coverage determination. Coverage depends on policy language and underwriting.