Cyber Insurance for Small Businesses: A Plain-English Guide

Small businesses are frequent targets for cybercrime precisely because they're small: fewer IT staff, fewer controls, and owners who assume they're not worth attacking. The FBI's Internet Crime Complaint Center (IC3) publishes an annual report on reported cybercrime, and business email compromise and ransomware consistently rank among the most costly categories: FBI IC3 annual reports. The U.S. Small Business Administration also maintains a guide to small business cybersecurity: SBA – Strengthen your cybersecurity.

Cyber insurance helps pay for the response and the fallout when an incident happens. This guide explains what it covers, what it often doesn't, and what insurers will ask you before they'll offer coverage.

Why your other policies probably don't respond

General liability policies are built around bodily injury and property damage, and modern forms commonly exclude data breaches. Commercial property policies cover physical loss to tangible property; data and lost income from a network outage usually aren't covered. Crime policies may cover some theft of money but often exclude losses where an employee was tricked into sending funds unless a social engineering endorsement is added. Cyber insurance fills these gaps.

First-party coverages (your own losses)

• Incident response and forensics: investigating what happened and stopping it.
• Breach notification: notifying affected individuals as state laws require, plus call centers and credit monitoring where offered. Every state has a data breach notification law; the National Conference of State Legislatures tracks them: NCSL – Security breach notification laws.
• Legal counsel ("breach coach") to guide your response and notification obligations.
• Data restoration: recovering or recreating data and software.
• Cyber extortion / ransomware: response costs and, where lawful and covered, extortion payments. Note that U.S. Treasury guidance warns that paying ransoms to sanctioned parties can violate sanctions rules: OFAC advisory.
• Business interruption: lost income and extra expense when a covered cyber event shuts down your systems. Check the waiting period (often measured in hours) and whether outages at your cloud provider or vendors ("dependent business interruption") are covered.
• Funds transfer fraud and social engineering: money stolen by fraudulent instructions, often sublimited. Ask for the limit in dollars.
• Reputational harm coverage on some forms.

Third-party coverages (claims against you)

• Network security and privacy liability: lawsuits from customers or partners after a breach.
• Regulatory defense and penalties where insurable by law, for example investigations under state privacy laws or, for healthcare businesses, HIPAA. See HHS – HIPAA breach notification.
• PCI-DSS assessments from card brands after a payment card breach.
• Media liability for content on your website and social media.

Common exclusions and limits to read

• War and state-sponsored attacks: many insurers have revised their war exclusion wording.
• Unencrypted portable devices or failure to maintain promised controls.
• Prior known incidents and retroactive dates.
• Betterment: upgrading systems beyond their pre-incident state.
• Sublimits for social engineering, ransomware and regulatory penalties.
• Infrastructure outages such as widespread power or internet failures.
• Bodily injury and property damage, which go to other policies.

What underwriters ask about

Insurers have tightened underwriting, and the answers you give on the application matter. Expect questions about:

1. Multi-factor authentication (MFA) for email, remote access and admin accounts. Often a hard requirement.
2. Backups: frequency, encryption, offline or immutable copies, and tested restores.
3. Endpoint detection and response (EDR) on computers and servers.
4. Patching and end-of-life software.
5. Email security and phishing training for employees.
6. Payment verification procedures: call-back verification on a known number before changing wire instructions.
7. Privileged access and how admin rights are managed.
8. Incident response plan.

CISA, the federal Cybersecurity and Infrastructure Security Agency, offers free resources and services for small businesses, including its Cyber Essentials guide: CISA – Cyber Essentials. Implementing these controls reduces risk and generally improves insurability.

Be accurate. If the application says MFA is in place and it isn't, coverage could be contested after a claim.

How much coverage do you need?

There's no single answer, but consider:

• How many customer, patient or employee records you hold, and how sensitive they are.
• How long your business could operate with systems down, and your daily revenue.
• Contract requirements: clients, especially larger companies and government agencies, increasingly require vendors to carry specific cyber limits.
• Whether you process card payments or move client funds.

Which businesses need it most?

Any business that relies on email, stores customer data, takes payments, or can't operate without its systems. That includes professional firms (accounting, legal, real estate, consulting), healthcare practices, retailers and e-commerce, contractors (who frequently face wire fraud on progress payments), and trucking and logistics companies that rely on dispatch software.

When an incident happens

1. Call the insurer's breach hotline listed on your policy before hiring outside vendors, because policies often require approved vendors.
2. Preserve evidence; don't wipe machines.
3. Don't pay a ransom or communicate with attackers before talking to the insurer and counsel.
4. Report to the FBI through IC3, especially for wire fraud, where speed matters.
5. Follow counsel's guidance on notification deadlines.

Getting a quote

Be ready to describe your revenue, number of records, industry, security controls and any prior incidents. An independent broker can compare cyber forms, which vary considerably in their definitions and sublimits. Many businesses also pair cyber with professional liability (E&O) and crime coverage. See our small business insurance by industry guide. Contact Alishahi Insurance or call (877) 711-4545.

Frequently asked questions

Alishahi Insurance · 439 N Canon Dr, Penthouse, Beverly Hills, CA 90210 · (877) 711-4545 · CA License #4348151. General information only. This isn't legal, tax or financial advice or a coverage determination. Coverage depends on policy language and underwriting, and rules vary by state.