Imagine arriving at work to discover you can’t access your emails, customer records or business systems. You don’t know how long they’ll be unavailable, what information might have been compromised or how much it will cost to put things right.
For a small or medium sized business, even a short disruption can have serious consequences.
Cyber attacks aren’t just an IT problem. They can affect your income, customers and ability to keep your business running. And while good cyber security can help reduce the risk of an attack, it can’t eliminate it entirely.
That’s why cyber insurance is an important part of protecting your business. Alongside good cyber security, it provides financial protection against insured cyber risks and access to specialist support, depending on your policy.
Most businesses rely on technology in some way, whether that’s taking payments, sending invoices, storing customer information or communicating with suppliers.
If those systems become unavailable or someone gains access to sensitive information, the consequences can extend well beyond the cost of repairing the problem.
You might lose income while your business is unable to operate normally, need specialist help to investigate an incident or face costs associated with recovering data and informing affected customers.
Larger organisations may have dedicated IT security teams and greater resources to manage these situations. For SMEs, arranging specialist support at short notice can be particularly challenging.
Cyber insurance provides financial protection against insured cyber incidents, helping you manage the costs of recovery, lost income and potential liabilities. Many policies also provide access to specialists who can investigate an attack and support your business through the recovery process.
You don’t need to hold thousands of customer records or operate a large online business to experience a cyber attack.
Some of the most common cyber threats you need to be aware of include:
For example, imagine someone gains access to your business email account and sends a supplier what appears to be a genuine request to change your payment details.
You might not realise anything is wrong until a payment goes missing.
Alternatively, a ransomware attack could leave your business unable to access important files or systems for several days, affecting your ability to serve customers and generate income.
The risks will vary depending on your industry, the information you hold and how your business operates.
Cyber insurance policies can provide protection against a range of cyber risks, from ransomware attacks and data breaches to business interruption and certain types of online fraud.
The protection available varies between insurers, but may include:
Although these are recognised areas of cyber insurance, they won’t necessarily be included in every policy. Insurers may offer different limits, conditions and exclusions, and some types of protection may only be available as optional extensions.
For example, if a criminal tricks an employee into transferring money to a fraudulent account, some cyber insurance policies may cover the resulting loss, while others may exclude it or require additional cybercrime protection.
It’s important to understand what your policy includes, particularly when it comes to the risks your business is most likely to face. Working with an insurance broker can help you find cover that reflects those risks, reducing the chance of discovering gaps in your protection when you need to make a claim.
Having cyber insurance doesn’t prevent an attack, just as having good cyber security doesn’t guarantee your business will never experience one.
Both have a role in managing cyber risks.
Cyber security helps protect your business against attacks by reducing vulnerabilities and improving how you identify and respond to threats. Cyber insurance provides financial protection when an insured incident occurs, helping your business manage the costs and disruption that follow.
There are several practical steps you can take to improve your cyber security:
Employee training is particularly important because a convincing phishing email can be difficult to recognise, especially when it appears to come from someone you know.
Regular training and simulated phishing exercises can help your staff identify suspicious messages and understand how to respond. Cyber security specialists such as Synstar provide cyber security testing and training to help businesses improve employee awareness.
When arranging your cyber insurance, insurers may ask what security measures you already have in place. Requirements vary, so it’s important to understand what your insurer expects and make sure the information you provide is accurate.
If you’d like to explore this further, we’ve covered some of the most common cyber security mistakes and how to avoid them in another article.
Cyber insurance isn’t generally a legal requirement for UK businesses, but at Robison & Co, we recommend that all businesses have it in place. Whether you’re a sole trader or employ hundreds of people, a cyber incident can affect your finances, customers and ability to operate.
If your business handles personal information, you also have legal responsibilities to protect it. The UK GDPR and Data Protection Act 2018 set out requirements for handling personal data, including taking appropriate measures to keep it secure. Having appropriate cyber security measures in place can help you meet these responsibilities and reduce the risk of a data breach. Cyber insurance doesn’t replace these measures or your legal obligations, but it can help with certain costs and liabilities if an insured incident occurs.
In some circumstances, cyber insurance may also be a contractual requirement. For example, organisations bidding for particular contracts or working with certain clients may be asked to hold specific cyber insurance as part of their supplier requirements.
Although we recommend cyber insurance for every business, the protection you need will depend on how your business operates and the risks you face.
To understand the potential impact of a cyber incident, consider what would happen if:
For example, a retailer that relies on online payments may have different concerns from a professional services firm holding confidential client information.
It’s also worth reviewing any cyber protection you already have. Some business insurance policies include limited cyber related benefits, but these may not provide the same protection as a dedicated cyber policy.
A broker can help you understand what’s included in your existing insurance, identify potential gaps and find cover that reflects the risks your business faces.
If you suspect your business has experienced a cyber incident, acting quickly can help limit the disruption.
Contact your IT or cyber security provider so they can assess the situation and advise on securing affected systems and accounts. Follow your incident response plan, if you have one, and keep a record of what has happened.
If you have cyber insurance, contact your broker or insurer as soon as possible. Some policies provide access to incident response specialists, and your insurer may have requirements about appointing external providers or agreeing to certain costs.
Where personal information has been compromised, you may also need to assess whether the incident must be reported to the Information Commissioner’s Office and whether affected individuals need to be notified.
Knowing who to contact and what your insurance requires before an incident happens can make those first decisions easier. Having a business continuity plan can also help you prepare for disruption and understand how your business will continue operating while systems are restored.
A cyber incident can happen to any business, and having the right insurance in place can make a significant difference to how you manage the financial impact and recovery.
If you already have cyber insurance, it’s worth reviewing whether your policy still reflects how your business operates and the risks you face. And if you haven’t arranged cover before, understanding what’s available is a good place to start.
At Robison & Co, we’ll help you understand your options, find cyber insurance that suits your business and make sure you know what your policy includes. You’ll have a dedicated broker who gets to know your business and is there to offer advice, answer questions and support you if you need to make a claim.
To discuss your cyber insurance or review your existing cover, call us on 01730 265500 or email hello@robison.co.uk.
