Cyber liability covers the costs that follow a data breach or a system compromise.
Why a small service business is exposed
It holds customer names, addresses, payment details and sometimes card data, and it defends them with less than a large business does. That combination is the reason small businesses are targeted rather than overlooked.
What it covers
Notification and response — the legal obligation to inform affected people, and the specialists engaged to establish what happened.
Recovery — restoring systems and data.
Liability — claims by people whose information was exposed.
Extortion — ransom demands and the response to them, where the policy permits.
Lost income while systems are unavailable, which the property-based business interruption policy generally will not pay, because no physical damage occurred.
What general liability does not do
General liability covers physical injury and property damage. A data breach is neither, so it falls outside the policy entirely.
Conditions
Insurers increasingly require specific controls as a condition of cover: multi-factor authentication, tested backups, staff training. A claim can be declined where a warranted control was not in place, so the application is a statement of fact rather than an aspiration.
Alongside prevention
The controls are worth having on their own merits — see fraud prevention. Insurance covers what prevention did not stop; it is not an alternative to it.