CYBERSECURITY WHITEPAPER

Cyber liability insurance covers financial losses from security incidents, but coverage scope varies significantly between policies, and many organizations don’t know where their gaps are until a claim is denied.

Stratify IT works with clients to understand their insurance coverage as part of broader cybersecurity planning. Knowing what your policy covers, and what it doesn’t, directly affects which controls you prioritize. Policies typically cover some combination of the following:

• Data Breaches: Unauthorized access to sensitive information.
• Ransomware Attacks: Malicious software that blocks access until a ransom is paid.
• Phishing Schemes: Deceptive attempts to acquire sensitive information by impersonating a trustworthy entity.
• Denial of Service (DoS) Attacks: Disruptions that make a network service unavailable.

In addition to incident types, understand what specific expenses your policy covers. This typically includes:

• Legal Fees: Costs associated with legal defense and liability.
• Notification Costs: Expenses incurred to inform affected parties of a breach.
• Credit Monitoring Services: Costs to monitor the credit of those impacted by a data breach.
• Public Relations Efforts: Fees associated with managing your business's reputation post-incident.

Review your policy limits and exclusions carefully. Each policy outlines the maximum payout and situations that may not be covered, understanding these details before an incident lets you address uncovered risks proactively.

Know the conditions that could lead to policy revocation and ensure your security controls remain compliant with policy requirements.

What to Verify in Your Policy

Beyond coverage types, review these specifics before a claim arises:

Identify exclusions for unencrypted data, unpatched systems, or undocumented security controls, policies can be denied on these grounds. Know your retroactive date, sub-limits by incident type, and whether vendor-caused incidents fall under your policy or your vendor’s. Confirm internally who contacts the carrier’s breach team when an incident occurs.

Reviewing your policy now, not after an incident, is the most direct way to maximize the protection your cyber liability insurance offers.

Cyber Liability Insurance and Your Security Program

Ransomware, data breaches, and business email compromise affect organizations of every size, not only large enterprises. This raises an important question: Do you have cyber liability insurance?

What is Cyber Liability Insurance?

Cyber liability insurance is a specialized form of insurance designed to cover the costs associated with cyberattacks and data breaches. This coverage can include:

• Legal fees related to data breaches.
• Notification costs to inform affected customers.
• Credit monitoring services for impacted individuals.
• Public relations efforts to manage your company’s reputation.
• Costs for restoring lost data and systems.

Why Do You Need It?

Without cyber liability insurance, your business could face severe financial setbacks. For small businesses, the cost of a single cyberattack can be significant enough to threaten operations. For larger enterprises, it can result in significant operational disruptions and damaged reputations. Here are a few key reasons why you need this coverage:

Financial Protection:

• Covers the direct costs of a cyber incident.
• Helps with legal expenses and settlements.

Customer Trust:

• Shows your commitment to protecting customer data.
• Enhances your credibility and reliability.

Business Continuity:

• Ensures quicker recovery from cyber incidents.
• Minimizes downtime and operational impact.

How to Obtain Cyber Liability Insurance

Obtaining cyber liability insurance involves:

• Assessing Your Risk:
  • Conduct a review of your digital assets.
  • Identify potential vulnerabilities in your systems.
• Choosing the Right Policy:
  • Compare policies from different insurers.
  • Consider coverage limits, exclusions, and premiums.
• Implementing Best Practices:
  • Establish strong cybersecurity measures.
  • Regularly update software and train employees on cyber hygiene.

Report Compliance Status to the Board of Directors

Maintaining strong governance practices around cyber liability insurance requires documented procedures. One key aspect of this is regularly reporting on compliance status to the Board of Directors. Here's how you can ensure effective communication on this critical topic:

1. Schedule Regular Updates: Establish a fixed schedule for compliance status reports. This could be monthly or quarterly, depending on the needs of your Board and the complexity of your compliance requirements.
2. Detailed Reporting: Prepare reports that include any policy changes, regulatory updates, and results from audits or assessments. Highlight any significant compliance issues and the steps being taken to address them.
3. Inclusion of IT Security: Ensure that IT and cybersecurity compliance are integral parts of your report. Detail any new threats, breaches, or improvements in your IT security protocols.
4. Use Clear Metrics: Use clear, measurable metrics to illustrate your compliance status. This might include the number of compliance incidents, duration of incident resolutions, and improvements over previous periods.
5. Encourage Two-Way Communication: Encourage feedback and questions from the Board. This dialogue can provide valuable insights and help in refining your compliance efforts.

By following these steps, you ensure that the Board of Directors remains well-informed about compliance status, helping to maintain the integrity and security of your organization.

Understand Your Cyber Liability Insurance

Policy Details: Ensure you have cyber liability insurance and are familiar with the fine print. Know the types of attacks or breaches covered, the specific expenses covered and their limits, and the types of events not covered.

Communication Strategy: Confirm whether your organization has a clear action and communication plan for security breaches. Who is responsible for activating this plan? Is there a designated crisis communication team?

Legal and Insurance Contacts: Identify who in your organization knows the insurance carrier’s breach team and attorneys. Establishing those connections before a breach occurs reduces response time and limits exposure when an incident does happen.

Build Internal Awareness and Preparedness

Build internal awareness about these protocols and ensure that key personnel are trained on the specifics of the response plan. Regular drills and updates to the plan as technology and threats evolve are also essential. This approach both reduces risk and positions your organization to respond quickly, minimizing potential damage.

By incorporating these strategies into your data breach response plan, you reinforce your defenses and ensure that your organization remains resilient in the face of cyber threats. Equip your team with the knowledge and tools they need to protect your data and respond effectively should a breach occur.

Discover how our cybersecurity solutions safeguard businesses from threats. Explore our leadership blogs for expert insights and best practices in cybersecurity.