Companies looking to mitigate their risk through cyberinsurance be forewarned—selecting and purchasing a policy may be the easy part. Like many insurance policies, however, cyberinsurance can come with many caveats, and the devil is in the details.

For Judy Selby, consulting managing director at BDO and moderator of the upcoming "You Finally Bought the Cyberinsurance Policy, Now What?" panel at CyberSecure, there is a pressing need for greater awareness of what cyber coverage really entails.

Selby noted that her panel will be focused on how companies can ensure the coverage they have will actually help when a security incident occurs. "We want to increase awareness of some of the obligations that are placed on the policyholder in connection with many cyberinsurance policies that are on the market."

In the current market, there's no standardization to cyberinsurance policies, Selby said, but underlying them are some common themes. With this in mind, policyholders can take certain steps to maximize coverage in the event of a breach.

The worst position a company can be in, she added, "is if they actually go through the process of obtaining cyber coverage, and they are not aware of certain obligations in the policy, and they don't fulfill those obligations. And then coverage is jeopardized because of that."

But what do some of these obligations entail?

For one, a company has to make sure it is completely upfront and honest with a cyberinsurance provider about how they manage and secure their data in-house.

"If during the application process [companies] make certain representations about how they treat their data and if those representations are in fact not true and an incident arises because of that, the insurance companies can then look back at the representations and question whether the coverage should be impacted," Selby cautioned.

But she also noted that some insurance providers limit their exposure to such an event by requiring an insured company to employ "reasonable [cybersecurity] measures." At times, however, these specific measures can be negotiated.

Obtaining cyberinsurance also adds the obligation of immediately informing insurers when a breach occurs—an easily overlooked responsibility that could prove costly to forget.

Selby explained that "like other insurance policies, cyberinsurance policies contain provisions that address how you provide notice of a claim or potential claim. … Many insurance policies will say that you can't incur any costs before you provide notice to us, so any costs you incur have to be with the insurance companies' consent."

However, "in breach situation where everybody's hair is on fire, if they don't have a practiced incidents response plan it may not be top of mind to place a call to put the insurance company on notice," she said.

And far from just being one step in an incident response plan, cyberinsurance policies will likely also govern who else is contacted in the post-breach response. Many policies, Selby said, "have identified certain firms that [insured companies] are required to deal in the event of a breach. For example they have a plan set up for a certain number of law firms, a certain number of forensic firms, etc."

Despite cyberinsurance's broad influence over a company's cybersecurity plans, however, coverage can lapse, should a company go through a restructure, such as those brought on by mergers or acquisitions.

How cyberinsurance is affected by such restructures may depend on a multitude of factors, such as "the size of the target company, as compared with the acquiring company," Selby said. "There's a lot of hoops companies need to jump through in connection with merger and acquisition situations in order to extend coverage."

The complexities managing a cyberinsurance policy are unlikely to end with just those few obligations. Selby noted that, as cyberinsurance usage grows over the next few years, she expects cyber-insurers to be "very innovative in trying to come up with new products to address an emerging risk and to provide coverage for different types of injuries that can arise from breach situations."

"It will be interesting to watch how it all develops," she said.

Instant Insights /

Navigating the cyberinsurance maze: Inside the obligations and caveats

More From HR Executive

Related Stories

Recommended For You