A checklist is a good way to find the answer
Choosing cyber insurance starts with understanding what an incident could cost your company. A business that depends on online transactions faces different exposures from one that holds sensitive employee records or relies on a vendor to keep operations running.
The decision goes beyond the premium and the overall coverage limit. Two cyber policies with the same aggregate limit can provide different protection because of differences in covered events, sublimits, exclusions, and policy language. Companies should evaluate each proposal based on the needs of their business and with a trusted advisor who can make recommendations. In sum, leadership needs to understand which events the policy covers, how it responds and what the company must do when an incident occurs.
Start with how your business operates
Think through a few realistic scenarios. An employee follows fraudulent payment instructions. A ransomware attack shuts down critical systems. A payroll provider becomes unavailable. Customer or employee information is exposed.
For each scenario, ask: How would we continue operating? What expenses would we incur? Who would we need to hire? Could another party bring a claim against us?
Those answers provide a foundation for evaluating coverage. Cyber policies may address the company’s own recovery expenses and liability to others, but their terms and scope vary.
Here’s a cyber coverage checklist to get you and your colleagues started:
Use these questions to guide a conversation with your leadership team and insurance advisor.
Understand your exposure
☐ What sensitive information do we hold?
Identify customer, employee and other confidential information, where it resides and who can access it.
☐ Which systems are essential to revenue and operations?
Consider how an outage would affect sales, service, payments, payroll and your ability to fulfill commitments.
☐ Which vendors could interrupt our business?
Include cloud platforms, payroll providers, benefits administrators and other partners that hold data or support critical work.
☐ How could a fraudulent request move money out of the company?
Review payment approvals, vendor bank changes and payroll changes, including requests that appear to come from an executive.
☐ What could a serious incident cost?
Estimate lost income and recovery expenses, including outside specialists, additional labor and temporary workarounds.
Review your current Security Controls
☐ What Controls does our business have in place?
Review controls such as multifactor authentication, endpoint detection and response, privileged-access restrictions, tested backups and employee security training. Involve the people responsible for managing these systems when completing the application.
Examine the coverage
☐ Does the policy address our recovery costs and liability to others?
Review incident response, privacy liability, data restoration and business interruption against the scenarios you identified.
☐ How does coverage apply to fraudulent payments?
Ask specifically about social engineering and funds-transfer losses, and how cyber and crime policies work together.
☐ What happens if the incident occurs at a vendor?
Check whether coverage addresses an interruption involving a provider and which providers or events qualify.
☐ Are the limits appropriate for our potential loss?
Review the overall limit and any lower limits (sublimits) that apply to particular coverages. Consider how much loss the company can fund itself.
☐ What costs remain our responsibility?
Understand deductibles, retentions, waiting periods and exclusions.
Confirm how the policy responds
☐ Whom do we contact first?
Keep insurer, broker, bank and response contacts accessible even if company email is unavailable.
☐ What notice or approval does the insurer require?
Confirm reporting requirements and whether you need consent before hiring specialists or incurring expenses.
☐ Which response specialists are available?
Understand access to forensic investigators, breach counsel and other resources, including any restrictions on provider selection.
☐ Do our security practices match what we represented to the insurer?
Have technology leadership verify the application answers and required controls.
☐ Have we tested our incident response plan?
Run a scenario with leadership, finance, technology and HR. The Certified Information Systems Auditor (CISA) recommends maintaining and exercising an incident response plan and an associated communications plan. For more on CISA and recommendations around incident response plans, see the Sentinel Cyber Portal.
How can Sentinel help?
Sentinel helps translate business exposures into insurance decisions. We work with your team to understand how the company operates, what information it holds and where a cyber incident could create financial loss. That understanding informs our review of existing coverage and available options. We can help explain policy differences, evaluate limits and deductibles, identify potential gaps and examine how cyber coverage coordinates with crime and other insurance.
We also help clarify the insurance response process: whom to contact, what the policy requires and which resources may be available. Your technology team and legal counsel remain essential partners in security and incident planning.
As your business changes, your coverage should receive another look. New systems, acquisitions, vendor relationships or changes in the information you collect can affect your exposure. Before your next renewal, ask Sentinel to review your cyber coverage against the way your company operates today. An informed decision begins with knowing what could happen and how your insurance is designed to respond.
Author: JP Roque
