Checklist Before Buying Cyber Insurance for Companies

Key Takeaways

• Cyber Insurance premiums depend on your cyber risk profile, not just your turnover.
• Businesses should determine an appropriate limit based on revenue, data exposure, contractual obligations, and ransomware risk.
• Insurers generally ask about security controls, cloud infrastructure, employee count, prior cyber incidents, and the type of data you store.
• Understanding exclusions, deductibles, and policy extensions before purchasing helps avoid coverage gaps later.
• Preparing a complete quote checklist can reduce delays during underwriting and improve the quality of coverage offered.

Why Preparation Matters Before Buying Cyber Insurance

Unlike property or motor insurance, Cyber Insurance is largely based on risk assessment.

Two businesses with identical turnover may receive completely different quotations because one has stronger cybersecurity controls than the other.

Insurers evaluate how likely your business is to experience a cyber incident and how severe the financial impact could be if one occurs.

The more complete your information is, the easier it becomes to obtain a quotation that accurately reflects your risk profile.

Step 1: Understand What Your Business Needs to Protect

Before approaching insurers, identify your primary digital assets.

This includes:

• Customer databases
• Employee records
• Financial information
• Intellectual property
• Business applications
• Cloud infrastructure
• Email systems
• ERP platforms
• Payment systems
• Websites and customer portals

The nature of these assets often influences both coverage recommendations and premium calculations.

Step 2: Decide the Appropriate Sum Insured

One of the first decisions is choosing an appropriate limit of indemnity.

There is no universal amount suitable for every company.

Instead, insurers typically consider several factors.

Annual Revenue

Higher turnover generally increases financial exposure during a cyber incident.

Volume of Sensitive Data

Companies handling customer information, payment data, or medical records often require higher limits than businesses with limited personal data.

Business Dependency on Technology

If your operations stop when IT systems go offline, business interruption losses can become significant.

Contractual Requirements

Clients, multinational companies, or government contracts sometimes specify minimum Cyber Insurance limits.

Industry Risk

Some sectors face higher cyber exposure than others.

Examples include:

• Healthcare
• Financial services
• IT and SaaS
• E-commerce
• Logistics
• Manufacturing
• Education
• Professional services

Example Sum Insured Approach

The appropriate limit ultimately depends on your business's risk profile rather than revenue alone.

Step 3: Identify the Coverage Extensions You May Need

A standard Cyber Insurance policy may not address every cyber-related expense.

Depending on your operations, consider discussing the following extensions with your insurer.

Cyber Extortion and Ransomware

Provides support for costs associated with ransomware incidents, subject to policy terms.

Business Interruption Loss

Helps cover loss of income and increased operating expenses when operations are disrupted following an insured cyber event.

Data Restoration Costs

Covers expenses involved in recovering or recreating lost or corrupted digital data.

Incident Response Services

May include access to:

• Digital forensic experts
• Legal advisors
• Crisis communication specialists
• Breach response consultants

Regulatory Investigation Costs

Useful for businesses handling regulated personal or financial information.

Privacy Liability

Provides protection against claims arising from data breaches or privacy-related incidents.

Multimedia Liability

Particularly relevant for companies publishing online content or managing digital platforms.

Social Engineering Fraud

Some insurers offer optional cover for losses arising from fraudulent payment instructions or impersonation attacks.

Third-Party Liability

Protects against claims made by customers, vendors, or other third parties alleging financial loss due to a covered cyber incident.

Step 4: Understand Common Deductibles

Cyber Insurance policies usually include a deductible or excess.

This is the amount your business agrees to bear before the insurer pays an eligible claim.

Deductibles Usually Depend On

• Company size
• Industry
• Selected coverage
• Claims history
• Security maturity

Choosing a higher deductible may reduce premium costs but increase your financial responsibility during a claim.

Step 5: Review Major Policy Exclusions

Understanding what the policy does not cover is just as important as understanding what it covers.

Common Exclusions Include

• Known incidents before policy inception
• Intentional or fraudulent acts by senior management
• Failure to maintain minimum security standards
• Contractual liabilities beyond policy wording
• War or cyber warfare events
• Infrastructure failures outside insured conditions
• Unapproved software or unsupported systems
• Criminal activities by the insured

Policy wording differs between insurers, so exclusions should always be reviewed carefully.

Step 6: Prepare the Information Insurers Usually Request

Before issuing a quotation, insurers commonly ask businesses to complete a cyber proposal form.

Company Details

• Business name
• Industry
• Registered location
• Years in operation
• Annual revenue
• Number of employees
• Geographic operations

Data Profile

Insurers may ask:

• What customer information do you collect?
• Do you store payment information?
• Do you process health records?
• Do you store financial information?
• Approximately how many customer records are maintained?

Technology Environment

Prepare details of:

• Cloud service providers
• Internal servers
• Third-party hosting providers
• Remote work arrangements
• Critical software applications

Cybersecurity Controls

Insurers generally ask whether your business has:

• Multi-Factor Authentication (MFA)
• Endpoint Detection & Response (EDR)
• Centrally managed antivirus
• Encrypted backups
• Vulnerability assessments
• Patch management
• Employee awareness training
• Email security
• Privileged account monitoring

Third-Party Vendors

Prepare information about:

• Cloud providers
• Managed Service Providers
• Payment gateways
• Software vendors
• Data processors
• IT outsourcing partners

Previous Cyber Incidents

Disclose any:

• Ransomware attacks
• Data breaches
• Phishing incidents
• Business email compromise
• Regulatory investigations
• Previous Cyber Insurance claims

Desired Insurance Limits

Keep ready:

• Required sum insured
• Preferred deductible
• Required add-ons
• Territorial coverage
• Retroactive cover (if applicable)

Questions to Ask Before Accepting a Quote

• Does the policy include ransomware response?
• Are forensic investigation costs covered?
• Is business interruption included?
• What waiting period applies?
• Does the policy cover cloud-based incidents?
• Are regulatory defence costs covered?
• Does the insurer provide incident response services?
• What are the claim notification timelines?
• Are subsidiaries covered?
• Are third-party claims included?

Cyber Insurance Quote Preparation Checklist

Conclusion

Cyber Insurance has become an important component of business risk management as organisations increasingly rely on digital systems and cloud-based operations. Preparing a complete quote checklist before approaching insurers not only speeds up underwriting but also helps ensure that the policy reflects your business's actual cyber exposure.

By understanding appropriate coverage limits, evaluating useful add-ons, reviewing deductibles and exclusions, and gathering information such as revenue, employee count, data types, security controls, cloud vendors, and previous incidents, businesses can make more informed decisions and obtain Cyber Insurance that supports their operational and financial resilience.