In short: cyber insurance can pay for the investigation, lawyers and court, notifying the people affected, recovery and lost income after a data breach, ransomware or a systems outage, and for claims from clients and others affected by it. The price and the cover depend on your business, not only on how many clients you have. Get your estimate from a licensed insurance broker or agent, and answer their questions accurately.
On this page

Why it matters: the car and home comparison

Most owners would never drive without car insurance or leave a home uninsured, even though they hope never to make a claim. Cyber risk works the same way. A single incident, such as a staff member opening a malicious attachment or a supplier's mailbox being taken over, can stop work for days and expose the personal information you hold about clients, staff and subscribers.

When that happens, the costs arrive quickly: specialists to investigate and restore systems, legal advice, notifying the people affected, and lost revenue while you recover. If a client or a group of affected people decides to sue, a business without the right cover pays its legal defence and any settlement from its own pocket. For a small business, that can be the difference between a hard month and closing the doors.

Insurance does not prevent an incident, and it does not replace good security. It transfers part of the financial risk, so that one bad day does not decide the future of the business.

What cyber insurance usually covers

According to the Insurance Bureau of Canada, cyber insurance helps businesses cover losses from three main types of events: breaches of confidential data, cyber extortion such as ransomware, and technology disruptions such as system failures. Covered costs can include legal representation, notifying affected parties, forensic investigation and restoring damaged data. Most Canadian cyber policies are stand-alone policies.

Insurers and brokers commonly describe two parts of a policy. Depending on the policy you choose, the cover can include:

Your own costs (first-party cover)

  • Investigation: forensic specialists who find out what happened, how the attacker got in and what was taken.
  • Legal advice from the first hour: a breach lawyer (often called a breach coach) who guides the response and your reporting duties.
  • Notifying the people affected: preparing and sending notices, and in many policies a call centre to answer their questions.
  • Credit and identity monitoring for the people whose information was exposed.
  • Data and system recovery: restoring data, rebuilding computers and getting systems running again.
  • Business interruption: lost income and extra costs while your systems are down.
  • Cyber extortion: experts to handle a ransomware demand and, where the law allows, related costs.
  • Public relations and crisis communication to protect your reputation with clients and the public.
  • Fraudulent payment instructions: some policies cover money lost to fake invoices or social engineering, usually with a lower limit.

Claims against you (third-party cover)

  • Lawyers and court: defence costs when clients, subscribers or other affected people make a claim or sue you, including court proceedings.
  • Settlements and judgments you are required to pay, up to your policy limit.
  • Privacy regulator investigations: legal costs to respond to a privacy commissioner or other regulator, and fines or penalties where they are insurable by law.
  • Payment card costs: assessments from card brands or banks after a card data breach, in some policies.
  • Media liability: claims about content on your website, email or social media, in some policies.
  • Network security liability: claims that an attack on your systems spread to, or harmed, a client's systems.

Every policy is different. Limits, deductibles, sub-limits for specific events such as fraudulent payment instructions, and exclusions vary by insurer, so read the wording or ask your broker to explain it. A general liability policy is not the same as cyber insurance; ask your broker whether your existing policies include any cyber cover at all.

Who can give you a proper estimate

In British Columbia, a person or company must be licensed by the Insurance Council of British Columbia to sell insurance. A licensed broker or agent who handles commercial and cyber insurance is the right person to compare insurers, explain the wording and give you a proper estimate. You can confirm a licence in the Council's public Licensee Directory.

Hexafusion does not sell insurance. What we do is help you put in place, and document, the security controls insurers ask about, such as a second step at sign-in, monitored security software on every computer, and tested backups. Accurate answers on the application matter: an inaccurate answer can affect how a claim is handled.

What affects the price and the cover

Insurers do not publish one formula, and each one weighs things differently. Canadian brokers and insurer programs consistently point to the same main factors:

Revenue and industryLarger revenue and higher-risk industries, such as healthcare, finance and professional services, usually mean a higher premium.
Personal information you holdHow many records you hold and how sensitive they are. Names and email addresses count, and so do health, financial and identity details.
Your clients and contractsWho relies on you, how large they are, and what your contracts promise them, including any minimum insurance they require.
Security controlsMany insurers ask for multi-factor sign-in, especially for email and remote access, monitored security software, off-site backups and staff training before they offer cover.
Claims historyPast cyber incidents and claims are reviewed; some programs only accept businesses with no claims in recent years.
Limits and deductibleHigher limits cost more; a higher deductible usually lowers the premium. The right limit depends on what a serious incident would cost you.

Two examples: client count is not the whole story

Owners often estimate their risk by counting clients. Insurers look at exposure, which can be very different.

A few clients, but a large newsletter list

A business with only a handful of paying clients may still hold thousands of names and email addresses from people who subscribed to its monthly newsletter. That list is personal information. If it is stolen, the business may have to assess the breach, notify the people affected and answer their questions, and the cost grows with the number of people on the list. Tell your broker how many people's information you hold in total, including subscribers, past clients and contacts, not only active clients. One insurer program for Canadian businesses, for example, only qualifies businesses that hold fewer than one million records of personal information.

A few clients, but large ones with many users

A business with three clients is not necessarily a small risk. If those clients are large organizations with many users, if your staff or systems connect to their networks, or if your service stops their work when it goes down, an incident at your business can cause them serious losses. Their contracts may also require you to carry a minimum amount of cyber or liability insurance. That exposure belongs in the conversation with your broker, together with copies of the relevant contract clauses.

Be complete on the application. Describe your subscriber lists, the size of your clients, any access you have to their systems, and the type of information you hold. A policy priced on an incomplete picture may not respond the way you expect when you need it.

Privacy law and breach reporting

Under the federal privacy law that applies to commercial activity in much of Canada (PIPEDA), an organization must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada and notify affected individuals when it is reasonable to believe the breach creates a real risk of significant harm. It must also keep a record of every breach, whether or not it is reportable. In British Columbia, many private businesses are governed by the provincial Personal Information Protection Act instead, and which law applies depends on your activities. Ask a privacy lawyer which rules apply to your business; this article is not legal advice.

Whichever law applies, an incident creates real costs: working out what happened, deciding who must be told, and responding to the people affected. Those are the costs a cyber policy is designed to help with.

How to prepare before you ask for a quote

  1. List the personal information you hold and roughly how many people it covers: clients, subscribers, staff and past contacts.
  2. List your largest clients, how many users they have, and whether you connect to their systems. Gather any contract clauses about insurance or liability.
  3. Confirm your security controls: a second step at sign-in for email and remote access, security software that watches how each computer behaves, backups kept off-site and tested, and staff training.
  4. Note any past incidents and claims.
  5. Contact a licensed broker or agent and ask for cyber cover that includes both your own costs and claims against you, with limits that match what a serious incident would cost you.

Not sure what an outage would cost? Our free Downtime and Incident Cost Calculator gives a quick estimate you can bring to your broker, and the IT Security Checklist covers the controls insurers ask about.

Get your security ready for the insurance application

We help BC businesses put the controls insurers ask about in place and document them, so the application is accurate and the cover fits.

Talk to us

Sources: Insurance Bureau of Canada, Does your small business need cyber insurance? (Get Cyber Safe, Government of Canada); Insurance Council of British Columbia, consumer information; Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards; Insurance Business Canada, five factors impacting cyber insurance costs in Canada; an insurer program's published eligibility rules for Canadian businesses. This article is general information, not insurance, legal or financial advice. Every policy and insurer is different.