Cyber Risk During IT Migration After an Acquisition

The weeks after closing, when you move email, domains, accounts and IT vendors, are a high-risk period for a small company: passwords are shared, old administrator accounts linger, domain settings change and staff do not yet know what normal looks like. Lock down who controls the accounts before you migrate anything, verify every payment change by phone, and confirm that any cyber policy is issued to the right company with security controls that match what the application promised. This guide is for new owners planning an IT or email migration who want to know what can go wrong and how insurance fits in.

The short answer

Take control first, migrate second. Inventory the domain, email system, administrator accounts and every vendor with remote access before you change anything.
The seller, former employees and the old IT provider often keep access long after closing. Remove what they do not need and limit what they do.
Turn on multi-factor authentication (MFA) for email, remote access and every administrator account before migration starts.
A cyber policy can pay for incident response, downtime, data restoration and some fraud losses, but only if it is in force for your company and its conditions are met, including any security controls your application promised.
Property insurance is built for physical damage. The standard business income form caps income lost from damaged electronic data at $2,500 a year unless a higher limit is shown.

Why is the IT migration window so dangerous?

In an owner-run business, IT is often informal. The seller may have registered the domain in their own name, used a personal email as the recovery address, shared one administrator password with the office manager and paid an outside technician who still has remote access. None of that is unusual, and it may have worked for years. During a migration, every one of those shortcuts becomes a door.

Where migrations go wrong and what to do about it
Risk	What can go wrong	Control
Shared passwords	A password spreadsheet or one shared login is stolen or reused	Move to a company password manager and individual logins
Old administrator accounts	The seller, ex-employees or a former contractor keep full control	List every administrator, remove the unneeded ones, reset the rest
Domain and email settings	The domain sits in someone's personal account; a criminal or careless change reroutes your email	Move the domain registrar account into the company's name and lock it
Lookalike domains	Criminals register a domain one letter off and email your staff and customers	Warn staff, watch for lookalikes, and verify requests by phone
Vendor remote access	The old IT provider's remote tools stay installed with saved passwords	Remove old tools; give the new provider named accounts with MFA
Data moves	Mailbox exports and file copies sit on laptops or personal drives	Use company storage, delete temporary copies, record what moved where
Rushed new accounts	New users and mailboxes are created without MFA to save time	Make MFA a condition of every new account from day one
New bank details	Fraudsters time fake payment changes to the confusion	Call back on a known number before changing any payment details

The last row is its own topic. See funds transfer fraud and new owners.

What should you lock down before and right after closing?

Work through the steps in order. Taking control of the accounts comes before moving data.

Migration security checklist by phase
Phase	Steps
Before closing	List the domain registrar, email system, administrator accounts, backups, remote access tools, payment systems and every vendor with access. Get the seller's last cyber application and any incident history. Agree in the purchase documents how credentials and domain ownership will be handed over.
Day one	Move the domain registrar account to a company login. Reset administrator passwords and change recovery emails and phone numbers. Turn on MFA for email and remote access. Freeze changes to vendor and payroll bank details unless verified by phone.
First 30 days	Remove or narrow access for the seller, former staff and the old IT provider. Install endpoint detection and response (EDR) software on laptops and servers. Test a restore from backups kept separate from the network. Ask your IT provider to set up email authentication records for your domain so criminals find it harder to send email in your name.
First 90 days	Finish the migration and shut down old systems. Train staff to spot phishing and payment fraud. Write a short incident plan with your insurer's claims hotline and who can call it.

If the seller stays on to help with IT under a transition services agreement (TSA), give them a named account with only the access the agreement needs, and an end date. See transition services agreements and insurance. The federal Cybersecurity and Infrastructure Security Agency (CISA) publishes free guidance on MFA and ransomware that works well as a plain-English checklist for small teams.

How does cyber insurance respond to a migration incident?

A cyber policy is a bundle of coverages, each with its own limit or sublimit. Here is how common migration incidents line up, and what can get in the way of payment.

Migration incidents and the cyber coverage that may respond (terms vary by policy)
Incident	Coverage that may respond	What can get in the way
Ransomware through an old remote access tool	Incident response, extortion, data restoration, business interruption	Controls promised on the application not in place; insurer consent needed before any payment, and sanctions checks can block a ransom payment
Email account takeover during the cutover	Incident response, privacy liability if customer data is exposed	Late notice; hiring your own forensics or legal firm instead of the insurer's approved vendors (its panel) without consent
Customer data exposed in a mailbox export	Breach response, notification costs, regulatory and liability coverage	Retroactive date or change in control wording if the exposure began before closing
Fake payment change sent during the confusion	Social engineering or fraudulent instruction coverage, if included	Often a lower sublimit, verification conditions, or excluded altogether
Outage caused by the new IT provider's mistake	Business interruption, sometimes only for security failures	Many policies treat a non-malicious system failure differently; check the wording
Cost to upgrade systems after an attack	Usually not covered	Many policies pay to restore systems to their prior state, not to improve them

Paying a ransom can also raise federal sanctions questions, which the Treasury Department's Office of Foreign Assets Control (OFAC) has warned about, so let the insurer's breach team and counsel lead any decision.

Do not count on other policies. Many general liability forms exclude or narrowly limit data breach claims, and the standard Insurance Services Office (ISO) business income form limits coverage for interruption caused by damaged electronic data to $2,500 a year unless a higher limit is shown. Business owner's policies and carrier forms set their own limits, so check yours. For the full line review, see the cyber insurance review for new owners.

Is the cyber policy in force for your company during the migration?

Before the migration starts, confirm four things about the policy itself:

Named insured. In an asset purchase, the seller's cyber policy usually stays with the seller's entity. Your new company needs its own policy from closing. See wrong named insured after an acquisition.
Change in control. In a stock purchase, the target's policy stays with the company you bought, but a change in control clause may limit it to events that began before the sale (run-off) or, in some wordings, end it. Cyber policies are not standardized, so read yours, meet any notice deadline and tell the carrier about the sale.
Retroactive date. Most cyber policies are claims-made (they respond to claims first made during the policy period), and many exclude incidents that began before a retroactive date (the earliest date of events the policy covers). A breach that started under the seller and is discovered after closing may fall between policies if the dates do not line up. See prior acts and tail coverage.
Application answers. If the application says every administrator account has MFA and that backups are kept offline, make it true before you bind and keep it true during the migration. Inaccurate answers can lead to coverage disputes after a loss.

A quote or an application is not coverage. If you are buying a new policy, make sure it is bound before the cutover weekend, not after.

What should you require from your IT provider?

Many new owners switch IT providers, or hire a managed IT services provider (MSP) for the first time, as part of the migration. The contract matters as much as the technology:

Named accounts with MFA for every technician, and a log of who accessed what
A written migration plan, including how and when old access is removed
Backup and restore duties, with a tested restore before old systems are turned off
Prompt notice to you of any security incident, so you can meet your policy's notice conditions
Proof of the provider's own technology errors and omissions and cyber coverage, with limits that fit your exposure
A liability cap and indemnity terms you have actually read. A very low cap or a broad waiver can limit what you and your insurer can recover if the provider causes a loss.

The provider's insurance protects the provider. It may help if they cause a loss, but it does not replace your own policy. See professional liability vs cyber liability for how those coverages differ.

What does a migration incident look like?

A hypothetical example. A buyer acquires a 40-person engineering firm and binds a cyber policy at closing. The application says MFA is on for email and remote access. Email moves to a new system in week three, with MFA on before and after the move. But the former IT technician's remote access tool is still installed on the file server, with a saved password and no MFA. In week five, criminals use it to get in and encrypt the server. The backups were on the same network and are encrypted too. The firm is down for six days, and incident response, restoration and lost income come to about $150,000.

The policy has the right coverages, but the carrier asks whether the remote access answer on the application was accurate. Whether and how much it pays now depends on the policy wording and the facts, and the owner spends the next month on that question instead of on customers. Removing the old tool on day one, and keeping one backup offline, would have closed both doors. Cyber controls that can lower your cyber insurance premium covers the controls carriers ask about most. Morrow can review a cyber policy you inherited or are buying against your migration plan, and request quotes where you have no coverage.

Keep reading

Frequently asked questions

Should I wait to move email until after closing?

Plan it before closing, then do the move after. Inventory the domain, email system and administrator accounts during diligence, agree how they will be handed over, and take control of the accounts on day one before moving any data.

Does the seller's cyber policy cover me during the transition?

In an asset purchase, usually not, because the policy insures the seller's company. In a stock purchase it may continue, subject to its change in control wording and any notice requirement. Check the policy and tell the carrier about the sale.

Can I give the seller access to email after closing?

You can, but give them a named account with only the access they need, MFA turned on and an end date. Avoid sharing your own credentials or leaving them as an administrator.

Will cyber insurance pay if my IT provider caused the breach?

It may, depending on your policy's terms. Your insurer may then seek to recover from the provider. Check whether your contract caps the provider's liability or waives your insurer's right to recover, and require technology errors and omissions and cyber coverage in the contract.

What happens if we promised MFA on the application but had not finished turning it on?

That can lead to a coverage dispute after a loss, depending on the policy wording and what the application asked. Make the answers true before you bind, and tell your broker right away if a control is not yet in place.

References

Just bought a business? Get your insurance reviewed.

Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.

Request a review Check a contract

Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114

This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.

Cyber Risk During IT and Email Migration After You Buy a Business