Cyber Insurance INSURANCE

A policy that covers costs after a cyber incident (incident response, data recovery, business interruption, third-party claims, legal defense). It is a way to transfer residual risk, not a substitute for controls.

When you need it

• A few days of downtime would threaten the company's cash flow
• Large customers require cyber insurance in their contracts
• You process a lot of personal data (post-breach notification and lawsuit costs)

When you do not need it

• Without basic controls (MFA, EDR, backups), your application will either be rejected or come back very expensive and full of exclusions; put the controls in place first.

The application form is really a security audit: questions on MFA, EDR, backups and training directly affect the premium. Know the policy's incident response team list in advance.