How Much Cyber Liability Insurance Do You Need? | IT Governance

Cyber liability insurance helps organisations cover the financial costs of a data breach.

It’s essential for any business that wishes to adequately prepare for disruptive incidents. Without insurance, organisations spend £3.6 million on average recovering from security incidents.

That includes the costs associated with incident detection, notifying affected individuals and remediation. Plus, organisations will typically suffer lasting reputational damage that could lead to lost business.

By purchasing cyber liability insurance, organisations gain the resources they need at a fraction of the cost. Exactly how much you should expect to spend will depend on the amount of insurance you need.

Here are several questions you should ask to determine what amount of cyber liability insurance coverage is right for you.

What does cyber insurance include?

Cyber insurance can provide financial support for a range of activities depending on the type of coverage you require. This can include:

• Hiring cyber security experts to investigate the breach and determine its cause;
• Mitigating the damage;
• Additional activities that are required to meet regulatory requirements;
• Incident response;
• Implementing a system to notify affected individuals about the data breach;
• Credit monitoring services or anti-fraud protection for those affected; and
• Public relations support.

Some cyber insurance policies help organisations cover the costs of lost business if the security incident results in long-term disruption.

Policies have also historically included the cost of ransomware payments. However, these are less common nowadays with cyber security experts urging organisations not to negotiate with attackers.

This is because there is no guarantee the criminals will keep their word once they have been paid. Plus, there is the moral issue, with payments encouraging attackers to launch further attacks and funding their future endeavours.

First-party vs third-party insurance

As with many types of insurance, there is a differentiation between first-party and third-party coverage. This is based on what you are trying to protect.

First-party cyber insurance addresses the damage to an organisation’s own network and systems. It’s designed to address the damage to they face directly, whether that’s compromised data, systems being knocked offline and disruption in service delivery.

By contrast, third-party cyber insurance covers the damage that a security incident causes to other organisations.

Third-party cyber insurance helps covered organisations address knock-on effects of an information security incident. This can include the legal fees if a client sues the organisation for its role in the data breach.

How much cyber insurance do I need?

Organisations can purchase different insurance premiums that protect them from various scenarios.

To know which premium is right for your organisation, you should consider several issues. The first is your risk profile – i.e. the damage you would face if a security incident occurred.

This will depend on the types of information that you process and how it’s protected. For example, the damage caused by a data breach will be worse if it involves sensitive personal data, such as financial data.

By contrast, organisations that process only names and contact details will be exposed to a lower risk. Cyber criminals will still be able to misuse this data if they got hold of it, but it would cause less immediate damage.

Cyber liability insurers consider the risk profile alongside the likelihood of a data breach occurring when determining their premium. They can do this by reviewing the organisation’s existing cyber security controls and data protection policies.

Insurers will offer better premiums to organisations that have taken appropriate steps the mitigate the risk of a data breach. In many cases, there will be a baseline level of security that must be met if you are to be eligible for cyber insurance.

Buying cyber insurance

Until recently, organisations seeking to bolster their information security practices and gain cyber insurance had to do so as separate activities. But with IT Governance’s new Cyber Safeguard service, you receive everything you need in one package.

With this service, we provide cyber security insurance of up to £500,000 alongside our expert cyber security support, which is based on best-practice advice from ISO 27001, the GDPR and the UK’s National Cyber Security Centre.

The service is available in three tiers – gold, silver and bronze – with each package designed to meet particular security and insurance needs.

Cyber Safeguard is part of IT Governance’s market-leading cyber-defence-in-depth solutions.

Our suite of offerings – which includes consultancy support, audits, e-learning and software – is one of the most comprehensive in the world and unrivalled in the UK.

Find out how Cyber Safeguard can help your organisation from just £300 a month.