According to CNAs Robert Allen, chief security officer, and David Hallstrom, underwriting director for risk information, the top loss driver across their customer segment is device loss including laptops, cell phones and other mobile devices. While this not only implies a physical loss of property, even more importantly, it also creates a threat for sensitive data loss, Allen says. Read more: CNA, XL Tap IT Expertise for Cyberinsurance
Rebuilding Data Center
If a companys operations are breached due a cyber-attack, insurance will cover the lost income and other fines and costs, including forensic investigations into the breach, data recovery and data reconstruction, and replacing and repairing equipment or networks.
Media Response/Customer Notification
Many cyber insurances will cover the cost of reaching out to customers about recent attacks. This includes snail mail, which is rather important considering the postage alone can be quite costly when updating tens of thousands of customers.
Education
In addition to device security and encryption, cyber insurers will help their customers understand the risks in their industry and the individual businesss liabilities. Cyber insurers will also work to uncover the depths of a businesss network security risks, and the risks posed by employees. Using this information, insurers can develop and tailor their products and help customers apply best practices in their own businesses.
Legal Aid
Data breaches may result in legal action. Insurance plans help clients find the best lawyers for the case, as well as cover legal fees and fines. Some cyber insurances also offer the services of a data breach coach that will coordinate with legal counsel and ensure restorations are done in accordance with the law.
Credit Monitoring
A best practice in responding to a breach is to offer credit monitoring programs and identity theft protection to affected customers. Cyber insurance will often provide the coverage for associated expenses for one year.
Cyberterrorism
The interconnectivity of devices means even a hack outside the organization can upend businesses and governments. So if a cyber-event has been classified as terrorism, check and see if your policy covers it because some do.