The First Call Is Not to Your IT Company
Almost every guide to this subject is written by a security vendor and ends with a product. For a small business, the decision that most often determines the size of the loss is made in the first hour and has nothing to do with technology.
If you hold a cyber policy, it almost certainly contains a panel provision and a consent requirement. The insurer keeps an approved list of breach counsel, forensic investigators and negotiators, and will not reimburse costs you incur before notifying it and getting approval. Calling your usual IT provider, letting them spend three days investigating, then submitting the invoice is a reliable way to have a legitimate claim cut or refused.
The order is: notify the carrier's breach hotline, engage whoever it directs, then investigate. The hotline is staffed around the clock because incidents do not happen on Tuesday mornings.
No policy? Read this in reverse. The four clauses below are what you will be underwritten against when you apply, and the controls insurers demand reduce the loss whether or not you ever file.
The First 24 Hours, in Order
- Contain without destroying evidence. Disconnect affected machines by unplugging the cable or disabling wireless. Do not power them down and do not wipe them: shutting a machine off erases the volatile memory where encryption keys, attacker tooling and the timeline often live, and that evidence is what substantiates your claim.
- Notify your insurer. Cyber policies are typically written on a claims-made basis with a duty to report as soon as practicable. Late notice is a standard coverage defense.
- Move the conversation off the compromised system. If email or your chat platform may be in the attacker's hands, discussing your response there tells them what you are about to do. Agree in advance on a separate channel and a phone tree.
- Engage the breach counsel the carrier names. Beyond coverage, counsel involvement is what allows much of the forensic work to proceed under privilege.
- Preserve, then remediate. Forensic images first, rebuilds after. Restoring over the evidence answers the ""what was taken"" question with a shrug, and that question drives both your notification obligations and your claim.
- Start the log. Times, decisions, who was told what, every hour of staff time diverted. This is the substance of a business interruption claim and cannot be reconstructed later — see claim documentation protocols.
What a Cyber Policy Pays, and the Sublimits That Decide It
A headline limit of $1 million rarely means $1 million is available for what actually happened to you. Coverage splits into sections, and the sections small businesses need most are usually capped well below the policy limit — the same trap as any other limit-and-deductible structure that looks larger than it pays.
| Coverage section | What it pays for | What to check |
|---|---|---|
| Incident response | Forensics, breach counsel, notification letters, credit monitoring for affected people | Whether these erode the policy limit or sit outside it |
| Cyber extortion | Ransom payment, negotiator fees | Almost always sublimited, and often subject to a coinsurance share |
| Business interruption | Lost income during the outage | The waiting period, and whether it covers dependent outages at your vendors |
| Data restoration | Rebuilding corrupted or encrypted data | Whether it covers hardware replacement, which is usually excluded |
| Liability | Claims by customers and regulatory defense | Whether regulatory fines are covered where insurable by law |
| Social engineering / funds transfer fraud | Money wired to a fraudster on a convincing instruction | Frequently an endorsement rather than base coverage, and heavily sublimited |
That last row matters out of proportion to its size. Being tricked into wiring money is far more common for a small business than being ransomed, and it is the coverage most likely to be missing, capped at a fraction of the limit, or conditioned on a callback procedure you must prove you followed.
Four Clauses That Decide Whether You Get Paid
The controls you attested to
Underwriting changed sharply after the ransomware wave of the early 2020s. Applications now ask specifics: is multi-factor authentication enforced on remote access, email and privileged accounts; are backups offline or immutable; is endpoint detection deployed; how fast are critical patches applied.
Answer inaccurately and the insurer may seek to rescind the policy after a loss for misrepresentation. Insurers have litigated exactly this, most visibly over MFA attestations. Have the person who actually administers your systems confirm each answer before you sign, and keep the evidence. ""We have MFA"" and ""MFA is enforced on every remote access path"" are different statements, and only one survives a claim investigation.
The waiting period
Business interruption does not start when the outage starts. It starts after a waiting period, commonly eight to twelve hours, and pays only beyond it. Some policies deduct the waiting period even on long outages.
The consequence is rarely stated: a large share of small business incidents resolve inside the waiting period, so that section pays nothing at all. If business interruption is your main reason for buying, negotiate the period down or accept that what you are really buying is the incident response section. It is a time-based deductible and it bites small losses the same way.
Consent and panel provisions
Worth repeating, because it is the most common self-inflicted wound: costs incurred without the carrier's consent, or with vendors outside its panel, may not be reimbursed. If you have a security provider you trust, ask at renewal whether they can be added to the panel. Insurers often agree in advance and almost never mid-incident. If a claim is cut on this basis, the escalation route is the same as any other — see your rights during a major insurance emergency.
War and state-backed attack exclusions
This changed recently and most guidance has not caught up. After a destructive malware event was attributed to a nation state, insurers and policyholders spent years litigating whether war exclusions reached cyber losses. The market rewrote the wording rather than keep arguing: from 2023 the Lloyd's market required standalone cyber policies to carry explicit state-backed attack exclusions, and similar language has spread beyond it.
The wording is what matters, because these exclusions differ in how attribution is decided and how they treat businesses caught as collateral damage. Ask directly: who determines attribution under this policy, and does the exclusion apply if I was not the target?
Paying a Ransom Is a Legal Question Before a Financial One
Federal law enforcement discourages paying, for practical reasons as much as principled ones: payment does not guarantee a working key, restored data is often corrupt, and it marks the business as one that pays.
The harder constraint is sanctions. A payment to a sanctioned person or entity can violate US sanctions law regardless of the circumstances, and Treasury has issued specific guidance on ransomware payments and on the exposure taken on by those who facilitate them. This is one reason the carrier's negotiator exists: screening the recipient is part of the job, and a payment made without it may be both unlawful and unreimbursed.
Before any of that, identify the strain. Free decryptors exist for a fair number of older ransomware families, published through a repository maintained by European law enforcement and security organizations. Checking costs nothing.
There Is No Single Notification Deadline
The old advice to ""report the breach within the mandatory window"" implies one clock. There are several, they run simultaneously, and they are triggered by different things.
- State breach notification laws. All fifty states have them, and they apply based on where your affected customers live, not where you are. Deadlines run from a fixed number of days to a general standard of expedience without unreasonable delay, so one incident can put you under a dozen statutes at once.
- Sector rules. Health information carries its own federal regime and deadline; financial services, education and government contracting each add their own.
- Contractual obligations. Customer agreements often impose shorter deadlines than any statute, and these are the ones businesses miss.
- Foreign regimes, which can apply based on whose data you hold rather than where you operate, and some are measured in hours.
One common error: California's privacy statute is often cited as setting a breach reporting deadline. It creates a private right of action for certain breaches, which is a different and arguably worse problem, but the notification duty sits in a separate state law with a different standard. Mapping these is the work breach counsel does, and it is why the legal call comes before the technical one.
Numbers You Will See Quoted, and What They Measure
Two statistics dominate this topic and both are routinely misused.
| The claim | What the source actually measures | Why it misleads a small business |
|---|---|---|
| ""The average data breach costs several million dollars"" | An annual global average across surveyed organizations, published by a large technology vendor and weighted toward enterprises holding big customer datasets | Dragged upward by a handful of very large incidents. A ten-person firm's exposure looks nothing like it |
| ""Attackers stay undetected for six months"" | Two metrics merged. Incident response firms report median dwell time, intrusion to detection, which has fallen sharply and is now measured in days to weeks. The multi-hundred-day figures come from surveys measuring mean time to identify and contain — a different span, and a mean rather than a median | A mean from one methodology under the label of another describes nothing. Ransomware is often detected within hours, because the attacker wants you to notice |
The useful version is not an average at all. Work out what a week without your primary system costs in lost revenue and staff time, add the cost of notifying every customer whose data you hold, and you have a figure that is actually about your business.
What Actually Reduces the Bill
Conveniently, the controls that reduce losses are the same ones that get you insurable and lower the premium.
- Enforced multi-factor authentication on email, remote access and administrative accounts — hardware keys or app approval, not text messages, which fall to phone number takeover.
- Backups the attacker cannot reach. Offline or write-protected, and tested by actually restoring. A backup nobody has restored this quarter is a hypothesis.
- A written callback rule for payments. Any change to bank details gets verified by phone on a number already on file, never one supplied in the email requesting the change. This single procedure prevents the most common loss and is often a condition of funds transfer coverage.
- Patching on a defined cadence, internet-facing systems first. Most intrusions still use known vulnerabilities with available fixes.
- An incident plan naming people, not roles, with personal numbers, the insurer's hotline and the policy number, stored where a locked-out laptop cannot hide it. Keep it with your emergency contacts and critical documents.
- Cash reachable within a day. Insurance reimburses, it does not advance, and payroll during an outage comes out of your own liquidity — the argument in emergency funds versus insurance and the first 24 hours after a financial emergency.
A note on sequencing. If you run a very small business and have to choose, enforced MFA and tested offline backups do more for your actual risk than a policy does — and you need both to get the policy anyway. Buying coverage while attesting to controls you do not have is worse than having none, because you pay premiums for something an insurer can rescind.
Two Situations Worth Walking Through
The invoice that was not from the supplier
A small firm gets an email from a long-standing supplier saying their bank details have changed. The address is a near-perfect imitation. Payment goes out on the next run and is gone within hours.
Nothing was hacked. No system was breached and no data taken, so much of the base cyber policy does not respond. Recovery depends entirely on whether a social engineering or funds transfer endorsement was bought, what it is sublimited to, and whether the callback verification condition was met. A crime policy may also respond, which is why the two must be read together.
The outage that ended too soon
A professional services firm is hit with ransomware on a Friday evening. Backups are clean, the team restores over the weekend, and the business opens Monday having lost about a day and a half of productivity.
The incident response section covers the forensics and the legal review. Business interruption pays nothing: the outage barely exceeded the waiting period and the recoverable portion is trivial. A good operational outcome and a disappointing claim, which is why the waiting period deserves attention at purchase rather than at renewal.
Both are composite illustrations of common patterns, not accounts of specific businesses.
Frequently Asked Questions
Does my business insurance already cover this?
Usually not meaningfully. General liability and property policies were not designed for data loss, and many carry explicit electronic data exclusions. Personal policies do not cover business activity at all, though some homeowners policies offer limited personal cyber endorsements — see whether home insurance covers identity theft and cyber attacks.
Will the insurer pay a ransom?
Where extortion coverage exists, yes, subject to its sublimit, its coinsurance share, the carrier's consent, and sanctions screening. Paying first and asking later usually forfeits it.
What if the breach happened at a vendor rather than at us?
Your notification obligations to your own customers generally survive, because the duty follows the data rather than the systems. Whether your policy responds depends on whether it includes dependent business interruption and contingent coverage, which are often optional.
Can I use my own forensics firm?
Ask before you need to. Many carriers will add a named vendor to the panel at underwriting. Almost none will agree during an incident, and costs incurred outside the panel without consent are frequently excluded.
The Short Version
Call the insurer before the IT firm. Panel and consent clauses mean costs you incur on your own initiative may never be reimbursed, and that is the most expensive avoidable mistake of the first hour.
Read four things before you need them: what you attested to on the application, the business interruption waiting period, the panel and consent requirements, and the state-backed attack exclusion. Those four decide almost every disputed cyber claim.
Check whether you have social engineering coverage and what it is capped at, because being tricked into sending money is the loss a small business is most likely to suffer and least likely to have covered. And ignore the headline statistics — work out what a week of downtime costs you instead. That number you can act on.
Sources and Editorial Note
Containment guidance and the recommendation to preserve rather than power down reflect published guidance from the Cybersecurity and Infrastructure Security Agency; reporting channels and law enforcement's position on ransom payment come from the FBI Internet Crime Complaint Center. Sanctions exposure from ransomware payments is addressed in advisories from the Office of Foreign Assets Control. State-backed attack exclusions reflect requirements introduced across the Lloyd's market from 2023 and wording that has spread since; terms differ materially between carriers.
The frequently quoted multi-million-dollar average cost of a data breach is drawn from an annual vendor-sponsored survey of predominantly large organizations and is not a useful estimate for a small business. The figures given for how long attackers remain undetected come from two separate methodologies — median dwell time reported by incident response firms, and mean time to identify and contain reported in survey research — which are not interchangeable and should not be quoted as one number.
Cyber wordings are not standardized: sublimits, waiting periods, panel provisions, extortion coinsurance and social engineering terms vary substantially between carriers and change at renewal. Breach notification duties vary by state, sector and contract. This article is general information, not legal advice and not advice on your specific policy. Review the wording with your broker, confirm application answers with whoever administers your systems, and consult counsel licensed in your state on notification obligations. For complaints about an insurer, contact your state insurance department.
