Cyber Insurance Considerations for your Organization

Cyber insurance, also known as cyber risk insurance or cyber liability insurance coverage can help organizations protect against losses resulting from a cyberattack. Cyber insurance generally helps organizations transfer the costs involved with recovery efforts due to a cyberattack such as a security breach, a ransomware attack, or other incidents.

The frequency and impact of cyberattacks continue to rise in the United States. In their 2021 report, the Government Accountability Office (GAO) said malicious cyber activity poses a significant risk to the federal government and the nation's businesses and critical infrastructure, and it costs the U.S. billions of dollars each year. The GAO goes on to say that threat actors are becoming increasingly capable of carrying out attacks, highlighting the need for a stable cyber insurance market.

Cyber Insurance Recommendations

Because recovering from a cyberattack can be costly, the Federal Trade Commission (FTC) has published the following general recommendations to consider if your organization is thinking about cyber insurance:

Make sure your policy includes coverage for:
Data breaches such as incidents involving theft of protected health information (PHI).
Cyberattacks on your data held by vendors and other third parties
Cyberattacks that involve breaches of your network
Cyberattacks that occur anywhere in the world (not only in the United States)
Terrorist acts

Furthermore, consider if your cyber insurance provider will:

Defend your organization in a lawsuit against a regulatory investigation
Provide coverage in excess of any other applicable insurance your organization has
Breach reporting hotline or another mechanism to easily report a suspected breach

First-party cyber coverage generally protects your data, including employee, customer, and patient information. This coverall includes costs related to:

Legal counsel to determine your notiﬁcation and regulatory obligations
Recovery and replacement of lost or stolen data
Customer notiﬁcation and call center services
Lost income due to business interruption
Crisis management and public relations
Cyber extortion and fraud
Forensic services to investigate the breach
Fees, ﬁnes, and penalties related to the cyber incident

Third-party cyber coverage generally protects your organization from liability if a third party brings claims against you. This coverage may include:

Payments to consumers aﬀected by the breach
Claims and settlement expenses relating to disputes or lawsuits
Losses related to defamation and copyright or trademark infringement
Costs for litigation and responding to regulatory inquiries
Other settlements, damages, and judgments
Accounting costs

Healthcare Compliance Pros Recommendations

While we are not recommending specific insurance companies, we do recommend discussing cyber insurance with your insurance agent. Whether your organization currently has or is considering cyber insurance, we are adding content in your Security Risk Analysis (SRA) and questionnaire so we understand any coverage your organization may have.

If you are considering coverage, we recommend using the tips the FTC has provided above to make sure your coverage is sufficient in the event of a cyberattack.