---
title: "Cyber Insurance for a Small Business: What It Covers, What It Costs, and What an Insurer Will Ask"
description: "Cyber insurance can pay a small business's breach response costs and claims by others. See what it covers, what drives cost and what an insurer will ask about."
url: "https://riskado.com/cyber-insurance-for-small-business/"
lang: "en"
published: "2026-10-13"
modified: "2026-10-13"
tags: ["cyber-insurance","data-breach","ransomware","small-business-insurance","business-interruption"]
image: "https://riskado.com/og/default.jpg"
alternates:
  es: "https://riskado.com/es/seguro-cibernetico-para-negocios.md"
---

# Cyber Insurance for a Small Business: What It Covers, What It Costs, and What an Insurer Will Ask

Riskado

Oct 13, 2026 · 12 min read

![A small office desk at dusk with a closed laptop, a router with status lights and a coffee mug, no screens or text visible](https://riskado.com/blog/cyber-insurance-for-small-business/featured.jpg)

[Cyber insurance](https://riskado.com/insurance-terms/cyber-liability-insurance/) is commercial [coverage](https://riskado.com/insurance-terms/coverage/) that can help pay a small business's own costs after a cyber incident and certain [claims](https://riskado.com/insurance-terms/claim/) brought by customers, partners or regulators. First-party coverage, which pays the business's own costs, can include legal counsel, forensic investigation, customer notification, data restoration, lost income from business interruption, cyber extortion and fraud, according to the [NAIC cyber insurance guide (opens in a new tab)](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf). Third-party coverage can address lawsuits, regulatory inquiries, settlements and judgments. Most [commercial property](https://riskado.com/insurance-terms/commercial-property-insurance/) and [general liability](https://riskado.com/insurance-terms/general-liability-insurance/) policies do not cover cyber risks, and cyber policies are highly customized, according to the [NAIC (opens in a new tab)](https://content.naic.org/insurance-topics/cybersecurity). Your data, systems, vendors, security controls and the [policy](https://riskado.com/insurance-terms/policy/)'s own wording decide what applies.

### Key takeaways

- **What it is**Commercial coverage for a small business's own costs after a cyber incident and for certain claims by customers, partners or regulators.
- **First-party costs**Legal counsel, forensic investigation, customer notification, data restoration, lost income, cyber extortion and fraud.
- **Third-party claims**Lawsuits, regulatory inquiries, settlements and judgments.
- **Existing policies**Most commercial property and general liability policies do not cover cyber risks.
- **What decides it**Your data, systems, vendors, security controls and the policy's own wording.

## Is cyber insurance relevant to your business?

If your business takes card payments, keeps customer or employee records, runs on email and cloud software, or depends on outside vendors to operate, a cyber incident can turn into a real bill. Businesses can be attractive targets for cyber criminals, and small businesses in particular may lack the means to protect their digital systems, according to the [SBA (opens in a new tab)](https://www.sba.gov/counseling/manage-your-business/#strengthen-your-cybersecurity). A business that keeps sensitive client information, such as health or banking files, may need to add data breach or cyber liability coverage, according to the [Texas Department of Insurance (opens in a new tab)](https://www.tdi.texas.gov/tips/what-insurance-do-i-need-to-run-a-business-from-home.html).

The numbers give a sense of scale. Losses reported to the FBI's Internet Crime Complaint Center reached $16.6 billion in 2024, and business email compromise accounted for about $2.77 billion of that, according to the [2024 IC3 Annual Report (opens in a new tab)](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf). Those figures cover all reported complaints, not only small businesses. In a Hiscox survey cited by the [SBA in October 2024 (opens in a new tab)](https://www.sba.gov/blog/2024/2024-10/todays-economy-cyber-safety-critical-small-business-success/), 41 percent of small businesses reported being victims of a cyberattack in 2023, with a median cost of $8,300.

A practical way to start is to list what could be affected: the data you hold, the systems you cannot work without, the vendors who touch your data, and the way your business sends and receives money.

## What does cyber insurance cover?

Cyber policies are usually built from two halves, and each half is read on its own terms.

First-party coverage pays the business's own costs. The NAIC guide lists legal counsel to work out notification and regulatory duties, recovery and replacement of lost or stolen data, customer notification and call center services, lost income from business interruption, crisis management and public relations, cyber extortion and fraud, forensic services to investigate the breach, and fees, fines and penalties related to the incident.

Third-party coverage pays when someone else makes a claim against you. The same guide lists payments to consumers affected by a breach, the cost of litigation and of responding to regulatory inquiries, claim and settlement expenses, settlements, damages and judgments, losses tied to defamation or copyright and trademark infringement, and accounting costs.

A single policy can carry both halves, but each grant can have its own exclusions, deductible or retention, waiting period and sublimit. A sublimit is a smaller cap inside the overall limit for one type of loss. The declarations page and the policy wording decide what a particular incident triggers.

First-party and third-party cyber coverage examples

Hover or tap a row to highlight it.

| Coverage half | What it can pay for | Source |
| --- | --- | --- |
| First-party | Legal counsel, forensics, customer notification and call center, data recovery, business interruption income, public relations, cyber extortion and fraud | [NAIC cyber insurance guide (opens in a new tab)](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf) |
| Third-party | Payments to affected consumers, litigation and regulatory inquiry costs, settlements, damages and judgments, defamation and copyright or trademark claims, accounting costs | [NAIC cyber insurance guide (opens in a new tab)](https://content.naic.org/sites/default/files/inline-files/cyber-insurance-naic.pdf) |

## What can it pay for after a breach or ransomware attack?

After a breach, the first costs usually come from bringing in help: a breach lawyer to work out who must be told, a forensic firm to find what was accessed, and a vendor to send notices and run a call center. Restoring data and systems comes next, along with the income lost while the business is down. A ransomware attack can add a ransom demand, negotiation expenses and the cost of rebuilding encrypted systems. Weeks or months later, customer claims or a regulator's inquiry can follow, which is where third-party coverage comes in.

Each of those items depends on the policy. Some policies require you to use the insurer's approved lawyers and forensic firms, and many require the insurer's consent before you spend money on a response, hire counsel, negotiate with an attacker or make any payment. Ask the agency which of these costs your policy pays, and whether it uses an approved vendor panel.

## What does general liability or a BOP leave out?

Most commercial property and general liability policies do not cover cyber risks, according to the [NAIC (opens in a new tab)](https://content.naic.org/insurance-topics/cybersecurity). A standard policy can contain exclusions for electronic data, privacy or network security. Some business owners policies (BOPs) and package policies offer a limited cyber endorsement, and an endorsement is not necessarily the same as a stand-alone cyber policy. If you are comparing general liability with other business coverages, [our guide to general liability vs professional liability insurance](https://riskado.com/general-liability-vs-professional-liability-insurance/) explains what each one is built for.

Pull your current policy and look for a few things: whether it excludes electronic data or privacy claims, whether a cyber endorsement is attached, whether that endorsement covers first-party costs, third-party claims or both, whether ransomware, fraud, business interruption, vendors and cloud services are included, and whether the endorsement has its own sublimits or waiting periods.

![A small office desk with a closed laptop, a router and a stack of paper files under soft daylight](https://riskado.com/blog/cyber-insurance-for-small-business/bop-gap.jpg)

Most general liability and property policies leave cyber risks out, so the endorsement or policy wording matters.

## What does cyber insurance cost?

Cyber insurance is priced business by business. Cyber policies are highly customized, according to the [NAIC (opens in a new tab)](https://content.naic.org/insurance-topics/cybersecurity), so a figure quoted for another company says little about yours. Factors that commonly shape underwriting and price include revenue and size, industry, how much sensitive data you store, card payment volume, how much you depend on email, cloud systems and vendors, your security controls, past incidents and claims, and the structure you ask for: limits, deductibles or retentions, waiting periods, sublimits, and whether you want first-party, third-party or both.

The way to get a number is a quote based on your own facts. An independent agent or broker can put applications in front of more than one insurer, and [our guide on how to choose an insurance agent](https://riskado.com/how-to-choose-an-insurance-agent/) covers what to ask before you share business details.

## What will an insurer ask about?

Cyber applications and renewal reviews ask how the business protects its systems. The questions track the same controls that federal agencies recommend for small businesses. Expect questions about:

- Multifactor authentication (MFA) for email, remote access, cloud services and administrator accounts. MFA requires a second step beyond a password, according to the [FTC (opens in a new tab)](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity).
- Backups, including whether they are offline, encrypted and tested. [CISA (opens in a new tab)](https://www.cisa.gov/stopransomware/ransomware-guide) recommends offline, encrypted backups of critical data and regular testing of their availability and integrity.
- Endpoint protection, patching and software updates.
- Employee training on phishing and on requests to change payment details.
- Access controls and encryption of sensitive data.
- Vendor access and the security terms in vendor contracts.
- A written incident response plan and a recovery plan that has been tested.

Answer every question accurately and keep evidence of the controls you describe. The application becomes part of what the insurer relies on, and a mismatch between the answers and the real setup is a question to raise with the agency before you sign, not after a claim.

![A wall-mounted network cabinet with neatly bundled blue cables and a small external backup drive](https://riskado.com/blog/cyber-insurance-for-small-business/security-controls.jpg)

Applications ask about MFA, backups, patching, training and an incident response plan.

### Controls a cyber application commonly asks about

- **MFA**A second step beyond a password on email, remote access, cloud and administrator accounts.
- **Backups**Offline, encrypted copies of critical data, tested on a schedule.
- **Patching**Software and devices kept up to date, with endpoint protection in place.
- **Training**Staff trained to spot phishing and verify payment change requests.
- **Incident plan**A written response and recovery plan that names who does what.

## Does the policy cover cloud outages, social engineering or funds-transfer fraud?

These three are where policies differ most, and each usually needs its own wording.

A cloud or vendor outage stops your business even though nothing on your own network was attacked. Paying for that lost income usually takes dependent or contingent business interruption coverage, which can carry a separate limit and a waiting period, a set number of hours before lost income counts. Look for coverage of attacks on your data held by vendors and other third parties, as the NAIC guide recommends.

Social engineering is when someone tricks an employee into sending money or data, often by posing as a vendor or an executive. Funds-transfer fraud is an unauthorized transfer out of your accounts. A fraudulent wire can fall under computer fraud, funds-transfer fraud, a social engineering endorsement or a separate crime policy, and social engineering coverage is often subject to a sublimit and to verification procedures, such as calling back a known number before changing payment details. Ask which part of the policy, if any, would respond to a fake invoice paid by wire, and what limit applies.

![A server room aisle with rows of equipment racks under cool blue lighting](https://riskado.com/blog/cyber-insurance-for-small-business/vendor-fraud.jpg)

Cloud outages and payment fraud usually need their own policy wording and limits.

## What should you do first after a suspected breach?

The first hours shape both the recovery and the insurance claim. Act quickly to contain the breach, isolate affected systems, change credentials and preserve evidence, according to the [FTC data breach response guide (opens in a new tab)](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business).

### First steps after a suspected cyber incident

1.  ContainIsolate affected devices and systems without destroying evidence. Avoid shutting systems down unless responders tell you to, because evidence can be lost.
2.  Call the insurerUse the policy's breach hotline or notice address right away, before hiring vendors or paying anything.
3.  Bring in the right helpUse the insurer's approved lawyers and forensic firms when the policy requires them.
4.  Preserve evidenceKeep logs, emails, ransom notes, messages, payment records and affected devices.
5.  Report the crimeReport ransomware and other cybercrime to the FBI, IC3, CISA or local law enforcement.
6.  Check notice dutiesWork out which customers, employees, regulators and states must be told, and by when.

Prompt notice matters because cyber policies commonly carry notice conditions and can require the insurer's consent before you incur response costs, choose counsel or deal with an attacker. The notice clause in your own policy sets the rule.

Notice to customers is set by law, and every state, the District of Columbia, Puerto Rico and the Virgin Islands has a breach notification law, according to the FTC guide. Deadlines differ. For example, Connecticut requires notice to affected residents without unreasonable delay and no later than 60 days after the breach is found, under [Conn. Gen. Stat. § 36a-701b (opens in a new tab)](https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b), and New York requires notice within 30 days after the breach is found, plus notice to the Attorney General, the Department of State and the State Police, under [N.Y. Gen. Bus. Law § 899-aa (opens in a new tab)](https://www.nysenate.gov/legislation/laws/GBS/899-AA). California's rule is in [Cal. Civ. Code § 1798.82 (opens in a new tab)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.82.&lawCode=CIV). The rule that applies follows where the affected people live, so a breach touching customers in several states can trigger several sets of rules.

Some businesses also owe notice to a federal regulator. Under the FTC Safeguards Rule, a covered financial institution must notify the FTC as soon as possible and no later than 30 days after finding a breach involving the unencrypted information of at least 500 consumers, according to the [FTC (opens in a new tab)](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know).

![An office workspace at night with a desk lamp on and a laptop open beside a notepad](https://riskado.com/blog/cyber-insurance-for-small-business/incident-response.jpg)

Calling the insurer's breach hotline early protects both the recovery and the claim.

Breach notice deadlines by rule

Hover or tap a row to highlight it.

| Rule | Who it applies to | Deadline | Source |
| --- | --- | --- | --- |
| FTC Safeguards Rule | Covered financial institutions, breach of 500 or more consumers' unencrypted information | As soon as possible, no later than 30 days after the breach is found | [FTC (opens in a new tab)](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) |
| Example: Connecticut | Businesses holding Connecticut residents' personal information | Without unreasonable delay, no later than 60 days after the breach is found | [Conn. Gen. Stat. § 36a-701b (opens in a new tab)](https://www.cga.ct.gov/current/pub/chap_669.htm#sec_36a-701b) |
| Example: New York | Businesses holding New York residents' private information | Within 30 days after the breach is found, with notice to state agencies | [N.Y. Gen. Bus. Law § 899-aa (opens in a new tab)](https://www.nysenate.gov/legislation/laws/GBS/899-AA) |

## What do ransomware payments and sanctions mean for you?

CISA, the FBI and the NSA strongly discourage paying a ransom, and paying does not guarantee that a victim's files will be recovered, according to a [joint CISA advisory (opens in a new tab)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-291a). Companies that make or facilitate ransomware payments, including cyber insurance firms and incident response companies, may also risk violating U.S. sanctions rules if the attacker has a sanctions connection, according to the Treasury Department's [Office of Foreign Assets Control advisory of September 21, 2021 (opens in a new tab)](https://ofac.treasury.gov/media/912981/download?inline=).

Cyber extortion coverage can pay for ransom demands, negotiation, forensics and restoration, but it commonly requires the insurer's consent, the use of approved vendors, compliance with the law and sanctions screening, and it can carry its own limit or retention. Decisions about a ransom belong with qualified legal counsel, law enforcement and the insurer, under the policy's terms.

## How can you compare cyber policies?

Put two quotes side by side and compare the same items on each:

- Stand-alone policy or endorsement
- First-party, third-party or both
- How a covered incident is defined
- Triggers for breach, ransomware, fraud and business interruption
- Cloud and vendor coverage
- Social engineering and funds-transfer fraud, and their sublimits
- Exclusions, including prior known incidents
- Waiting periods for business interruption
- Deductibles and retentions
- Notice requirements and the breach hotline
- Approved lawyers and vendors
- Territory, meaning where in the world an attack is covered
- Whether the insurer is admitted in your state or the policy is placed in the surplus lines market

That last item matters for protection if an insurer fails. Surplus lines insurers cover risks not available in the admitted market, surplus lines brokers must be licensed, and state guaranty fund coverage is not available for surplus lines policies, according to the [NAIC (opens in a new tab)](https://content.naic.org/cipr_topics/topic_surplus_lines.htm).

## Questions to take to an agent or broker

- Is this a stand-alone cyber policy or an endorsement, and what does it add to my current coverage?
- Which first-party costs does it pay, and which third-party claims?
- Does it cover ransomware, and what consent and sanctions conditions apply?
- Is dependent business interruption included for a cloud or vendor outage, and what is the waiting period?
- Which part of the policy responds to a fraudulent wire or a fake invoice, and what is the sublimit?
- Must I use the insurer's lawyers and forensic firms?
- How quickly must I report an incident, and to whom?
- Which security statements on the application does the insurer rely on?
- Is the insurer admitted in my state, or is this a surplus lines placement?

You can find an insurance agency that handles business coverage in the [Riskado agency directory](https://riskado.com/agencies/), and check the agent's and insurer's license with [your state insurance department (opens in a new tab)](https://content.naic.org/state-insurance-departments) before you share business details. For the other policies a small business commonly carries, see [what insurance a small business needs](https://riskado.com/what-insurance-does-a-small-business-need/).

**Quiz: Check what you know about cyber insurance for a small business**

1. Which part of a cyber policy pays the business's own breach response costs?
   - Third-party coverage
   - First-party coverage **(correct answer)**
   - General liability
2. Do most general liability policies cover cyber risks?
   - Yes, always
   - No, most commercial property and general liability policies do not **(correct answer)**
   - Only for retailers
3. What kind of backups does CISA recommend against ransomware?
   - Backups stored on the same network
   - Offline, encrypted backups that are tested regularly **(correct answer)**
   - No backups are needed with insurance
4. Does paying a ransom guarantee recovery of your files?
   - Yes
   - No, payment does not guarantee recovery **(correct answer)**
5. What is a waiting period in business interruption coverage?
   - The time before a claim check is mailed
   - A set number of hours before lost income counts **(correct answer)**
   - The time to renew the policy

## Frequently asked questions

### Does cyber insurance cover ransomware?

Many cyber policies include cyber extortion coverage that can respond to a ransomware attack, along with restoration, forensics and business interruption. The coverage usually requires the insurer's consent before any payment and is subject to sanctions screening, exclusions and sublimits. Read the extortion section and its conditions before an incident happens.

### Is a small business really a target?

Yes. Small businesses may lack the means to protect their digital systems, which makes them attractive to criminals, according to the SBA. Email scams aimed at payments are one of the largest reported loss categories in the FBI's 2024 figures.

### Does cyber insurance pay fines and penalties?

Some policies include fees, fines and penalties related to a cyber incident among first-party costs, according to the NAIC guide. Whether a particular fine can be paid depends on the policy wording and on whether the law allows that fine to be insured. Ask the agency how the policy treats regulatory fines.

### Is MFA required to get cyber insurance?

Requirements are set by each insurer, not by a single national rule. MFA on email, remote access and administrator accounts is a standard application question, and the answer can affect whether a policy is offered and on what terms. Answer accurately and keep proof that the control is in place.

## Your next step

Start with the list of what could be affected: your data, the systems and vendors you depend on, and how money moves through the business. Then pull your current policies to see what they exclude, and take that list and the questions above to a licensed agent or broker.

### Key terms

Tap a term to see what it means.

**First-party coverage.** Coverage for the business's own costs after a cyber incident, such as forensics, notification, restoration and lost income.

## More articles

- [Do I Need Workers' Comp for One Employee: State Rules, Exemptions, and Covering Yourself](https://riskado.com/do-i-need-workers-comp-for-one-employee/): Whether one employee needs workers' comp depends on your state, industry, worker status and business setup. See first-hire rules, owner choices and penalties.

- [Umbrella vs Excess Liability Insurance: How They Differ, What Each Sits On Top Of, and Which Contracts Ask for Which](https://riskado.com/umbrella-vs-excess-liability-insurance/): Umbrella and excess liability both add limits above your other policies, but excess follows one policy while an umbrella can sit over several. See what to ask.

- [Georgia Small Business Insurance: Workers' Compensation Requirements, Commercial Auto, What It Costs and What to Ask Your Agent](https://riskado.com/georgia-small-business-insurance/): Georgia businesses with three or more regular employees need workers' comp, and registered vehicles need liability cover. See BOP basics, costs and agent tips.

- [Florida Small Business Insurance: Workers' Compensation Rules by Industry, Construction Rules, Commercial Auto and What to Ask Your Agent](https://riskado.com/florida-small-business-insurance/): Florida requires workers' comp at four employees, or one in construction, and commercial auto for business vehicles. See penalties, BOP basics and what to ask.

## Newest guides

1.  [1Additional Insured: What It Means, How It Differs From a Certificate, and What It Costs](https://riskado.com/additional-insured/)
2.  [2Alabama Insurance Underwriting Association (the Beach Pool): Who Qualifies on the Coast, Wind and Hail Only Policies and How to Pair Them With Homeowners Coverage](https://riskado.com/alabama-beach-pool/)
3.  [3Alabama Boat Insurance: Whether It Is Required, Marina and Lender Requirements, What a Policy Covers, Registration and Marine Patrol Rules](https://riskado.com/alabama-boat-insurance/)
4.  [4Alabama Car Insurance Requirements: The 25/50/25 Minimums, Proof of Insurance, the Uninsured Motorist Offer and How Alabama Fault Rules Affect a Claim](https://riskado.com/alabama-car-insurance-requirements/)
5.  [5Alabama Driving Without Insurance: The Ticket and Fine, Whether Jail Is Possible, License and Registration Suspension and What to Do After a Stop](https://riskado.com/alabama-driving-without-insurance/)

## More in Business

1.  [1Additional Insured: What It Means, How It Differs From a Certificate, and What It Costs](https://riskado.com/additional-insured/)
2.  [2Alabama Small Business Insurance: Workers' Compensation Rules, Commercial Auto, What Landlords and Clients Require and What to Ask Your Agent](https://riskado.com/alabama-small-business-insurance/)
3.  [3Certificate of Insurance for a Small Business: What a COI Is, How to Get One, and What It Does Not Do](https://riskado.com/certificate-of-insurance-for-small-business/)
4.  [4Employment Practices Liability Insurance (EPLI): What It Covers, What It Does Not, and When a Small Employer Looks at It](https://riskado.com/employment-practices-liability-insurance-for-small-business/)
5.  [5Florida Small Business Insurance: Workers' Compensation Rules by Industry, Construction Rules, Commercial Auto and What to Ask Your Agent](https://riskado.com/florida-small-business-insurance/)