Cyber liability insurance: what it covers and who carries it

First party costs and third party liability

The first-party side pays for the incident response: forensic investigation, restoring or rebuilding data, notifying affected people, and the income lost while systems are down.

The third-party side pays for liability to others whose information was exposed, and for the cost of dealing with a regulator. The two are often written as separate sections with separate limits.

• Forensic investigation and incident response
• Restoring data and rebuilding systems
• Notifying affected individuals where the law requires it
• Income lost while the business cannot trade
• Liability to third parties whose data was exposed

The obligation that exists with or without insurance

Australia has a notifiable data breach regime, and the duty to assess and notify an eligible breach belongs to the organisation, not to its insurer. Holding cover changes who pays for the response; it does not change whether the response is required.

That is worth knowing before an incident, because the assessment clock is short and it starts running when the business becomes aware.

What people get wrong about it

The first error is believing a small business is not a target. Most incidents are opportunistic and automated, and they select for weak controls rather than for size.

The second is assuming a cyber policy pays a ransom on demand. Wordings vary considerably, and paying may itself raise legal questions that need advice rather than a claim form.

The third is confusing cyber cover with the IT provider’s responsibility. A managed service provider’s own professional indemnity answers for its failures, not for the client’s losses in general.

Questions

We are a small business. Is cyber cover relevant?

The exposure follows the data held and the systems the business depends on rather than headcount. A business that stores customer records, takes payments online, or cannot invoice when its systems are down has the exposure the cover is written for.

Does cyber insurance cover a ransom payment?

Some wordings contemplate extortion costs and some exclude them, and there are legal questions around making such a payment in Australia that sit outside the policy. This is a situation for licensed advice rather than assumption.

Occupations that commonly carry it

Ordered by how central this cover is to each occupation in the graph. A pattern in the data, not a statement that any business is required to hold it.

• IT consultants — Advice, implementation and managed support for business technology.
• Software developers — Custom software and application development delivered under contract.
• Web designers — Design and build of websites and online stores, often holding client data and hosting.
• Online retailers — Sale of goods online, carrying product and data exposures without a shopfront.
• Conveyancers — Licensed transfer of property title and the trust accounting that goes with it.
• Travel agents — Booking and packaging of travel, holding client money ahead of departure.
• Mortgage brokers — Credit assistance and loan placement under a credit licence or as a representative.
• Financial planners — Personal financial advice provided under an Australian financial services licence.
• Virtual assistants — Remote administrative and support services delivered under contract.
• Building inspectors — Pre-purchase, stage and defect inspections, reporting on the condition of a building.
• Surveyors — Cadastral and construction setting-out surveys, and the plans that depend on them.
• Accountants — Preparation of accounts, tax returns and advice for businesses and individuals.
• Bookkeepers — Day-to-day transaction processing, payroll and activity statement preparation.
• Business consultants — Advice to owners on operations, growth and process, priced on the advice itself.
• Management consultants — Strategy, organisational and change advice to larger clients under formal engagements.
• Architects — Registered architectural design, documentation and contract administration.
• Consulting engineers — Structural, civil and services engineering design and certification.
• Draftspersons — Technical drawing and documentation for building and manufacturing work.
• Quantity surveyors — Cost planning, measurement and progress certification on construction projects.
• Project managers — Client-side management of projects, programmes and delivery teams.
• Town planners — Planning advice, applications and submissions to consent authorities.
• Building designers — Residential and light commercial design outside the registered architect pathway.
• Lawyers — Legal advice and representation delivered by an admitted practitioner.
• HR consultants — Employment advice, policy and investigations for employer clients.
• Translators and interpreters — Translation and interpreting services where an error changes the meaning of a document.
• Psychologists — Registered psychological assessment and therapy.
• Real estate agents — Licensed sale and leasing of property on behalf of owners.
• Property managers — Management of rental property, tenancies and trust money on behalf of landlords.
• Counsellors — Talking therapies and support delivered outside the registered psychology pathway.
• Graphic designers — Brand, print and digital design work delivered as artwork and files.
• Marketing consultants — Campaign strategy, media buying and content services for client brands.
• Copywriters — Written content and advertising copy produced to a client brief.
• Interior designers — Interior specification, documentation and procurement for homes and workplaces.
• Strata managers — Administration of owners corporations, including insurance placement and levies.
• Photographers — Commissioned photography on location and in studio, carrying valuable equipment.
• Videographers — Video production and filming, on client sites and in public places.
• Physiotherapists — Registered physiotherapy assessment and treatment in clinic, home and hospital settings.
• Chiropractors — Registered chiropractic assessment and manual treatment.
• Osteopaths — Registered osteopathic assessment and manual treatment.
• Massage therapists — Remedial and relaxation massage, in clinics and mobile.
• Occupational therapists — Registered functional assessment, equipment prescription and home modification advice.
• Speech pathologists — Assessment and therapy for communication and swallowing.
• Podiatrists — Registered foot and lower-limb assessment and treatment, including minor procedures.
• Dietitians — Nutrition assessment and dietary advice for clinical and general clients.
• Disability support workers — Personal and community support delivered in the participant’s home and community.
• Support coordinators — Coordination of NDIS plan supports and connection to providers.
• Aged care providers — Approved home and residential care for older people.
• Nursing agencies — Supply of registered and enrolled nurses to facilities and homes.
• Dentists — Registered dental practice, including surgery and prosthetics.
• Veterinarians — Registered veterinary treatment of animals in clinic and on farm.
• Naturopaths — Natural therapies and nutritional advice outside the registered health professions.
• Acupuncturists — Registered acupuncture and Chinese medicine practice.
• Training providers — Delivery of accredited and non-accredited training to workers and businesses.
• Tutors — Private and small-group tuition delivered in homes, centres or online.

Sources

• Moneysmart (ASIC) — General guidance on business insurance from the regulator’s consumer site. A starting point, not a definition of this cover.
• General Insurance Code of Practice — Insurance Council of Australia — The industry code subscribing insurers commit to, covering claim handling timeframes and complaints.