New Owner Review: Cyber Insurance

Start by finding out whether the business has cyber insurance at all, because many owner-run companies never bought it. If there is a policy, check how it splits first-party coverage (your own costs after an attack) from third-party coverage (claims by others), the sublimits for social engineering and funds transfer fraud, how ransomware is handled, and whether the security controls promised on the application, such as multi-factor authentication (MFA) and tested backups, are actually in place. The weeks after closing are a risky window: new bank details, new email systems and a new owner nobody on staff knows well. This guide is for buyers who want to know whether the cyber coverage they inherited, or the lack of it, fits the business they now own.

Did the seller ever buy cyber insurance, and do you need it?

Many small businesses run for years without cyber insurance, and many sellers assume their other policies would respond. Often they would not: many general liability policies exclude or narrowly limit claims about data breaches, and property insurance is built for physical damage, not lost data or a locked network. Look for a standalone cyber policy, a cyber endorsement on another policy, or cyber coverage inside a technology professional liability form, and note the limits of each.

Whether you need it turns on a few questions. Does the business hold customer, patient or employee personal data? Does it take card payments or move money by wire or automated clearing house transfer? Would a week without its systems stop work or billing? Do customers or vendors connect to its systems? A yes to any of these is a reason to price coverage. Business email compromise, where a criminal poses as a supplier or executive to redirect a payment, was one of the costliest frauds reported to the Federal Bureau of Investigation (FBI) in 2024; funds transfer fraud and new owners explains how it works. See do I need cyber insurance for a small business.

What does a cyber policy pay for: your own costs or claims against you?

A cyber policy is a bundle of separate insuring agreements, each with its own limit or sublimit. Read the declarations page line by line:

Also check whether business interruption covers outages at the cloud and software vendors you rely on (sometimes called dependent business interruption), and whether the policy requires you to use the insurer's approved response firms. The liability parts of most cyber policies are claims-made, and first-party parts often require the incident to be discovered during the policy period. So after a sale, check the retroactive date and any change in control clause, which can switch a policy to run-off (covering only events before closing) when ownership changes, as with professional liability.

Is money an employee is tricked into wiring covered?

Funds transfer fraud, in its traditional wording, covers a fraudulent instruction to your bank that appears to come from you but was sent without your knowledge, such as a criminal who takes over your online banking. Social engineering is different: your own employee is tricked into sending the money, and many policies cover that only through a specific social engineering or fraudulent impersonation coverage, often with a lower sublimit and verification conditions.

If you have social engineering coverage on both the cyber and crime policies, ask your broker which pays first and whether the sublimits stack. If a fraudulent wire goes out, call your bank at once and file a complaint with the FBI's Internet Crime Complaint Center (IC3); fast reporting sometimes lets the money be recalled. The verification procedure and the claim steps are covered in funds transfer fraud and new owners; see also the commercial crime review.

What does the policy do if ransomware hits?

Ransomware usually touches several parts of a cyber policy at once: incident response to contain it, extortion coverage for the demand, data restoration and business interruption for the downtime. Read these points before you need them:

• Insurer consent. Policies usually require the insurer's prior consent before any ransom is paid, and some payments may be barred by law, such as payments to sanctioned parties; breach counsel can advise on this.
• Sublimits and coinsurance. Some policies cap ransomware losses below the main limit or make you share a percentage of them.
• Waiting period. Business interruption usually starts only after a set number of hours of outage.
• Upgrades. Many policies pay to restore systems to their prior state, not to improve them.
• Exclusions and gaps. Check war and state-backed attack exclusions, outages of power, internet or other infrastructure, whether business interruption covers system failures that are not attacks, and whether replacing damaged hardware is covered.
• Panel firms. You may need to call the insurer's hotline and use its approved forensic and legal firms for costs to be covered.

Write the insurer's claims hotline into your incident plan, and know who in the company can call it. Delays in notice can create coverage problems, depending on the policy's terms.

Which security controls will a carrier ask about?

Cyber underwriting is built around controls, and the application asks pointed questions. After an acquisition, the seller's answers on the last application may no longer be true, or may never have been, so review them line by line. Inaccurate answers can create coverage disputes after a loss.

The integration period makes several of these harder: shared passwords, old administrator accounts, domain changes and vendors with lingering access. See cyber risk during IT and email migration and cyber controls that lower your cyber premium. The federal Cybersecurity and Infrastructure Security Agency (CISA) publishes free guidance on multi-factor authentication and ransomware.

Why do lenders, customers and investors ask about cyber coverage?

Customer contracts, especially from larger companies, health systems and public entities, increasingly name a cyber or technology liability limit and sometimes ask to be notified of changes. Vendor portals may check for it before paying you. Your lender may ask for cyber coverage in the loan agreement; the Small Business Administration (SBA) operating procedures do not require it, so any requirement comes from the lender. Investors and boards ask because a serious incident can hit cash flow, customer retention and the debt covenants all at once. Check your contracts before renewal, and see how to report on insurance to your investors and board.

What belongs on your cyber checklist?

A hypothetical example. A buyer acquires a regional home services company with 60 employees and inherits a cyber policy with a $1,000,000 overall limit. Reading it line by line, the buyer finds a $100,000 sublimit for business interruption, a 24-hour waiting period, 50% coinsurance on ransomware losses and a $25,000 social engineering sublimit. The seller's last application said backups were kept offline and tested; in fact they sit on the same network and have never been restored. If ransomware locked the scheduling and billing systems for two weeks, lost income could run well past $100,000, and an inaccurate application answer could put even that at risk. Before renewal, the buyer moves backups offline, runs a test restore and corrects the application, then asks the broker to quote higher business interruption limits and terms without ransomware coinsurance. The carrier improves some terms and not others, and the buyer decides with the numbers in front of them.

If you want help, Morrow can review what you inherited, including whether there is any cyber coverage at all, and request quotes where it makes sense; terms depend on carrier underwriting and on the controls you have in place.

Keep reading

• Cyber Risk During IT and Email Migration After You Buy a Business
• Funds Transfer Fraud: Why New Owners Are a Favorite Target
• Cyber Controls That Can Lower Your Cyber Insurance Premium
• New Owner Review: Commercial Crime and Employee Theft
• New Owner Review: Professional Liability (Errors and Omissions)
• All guides for new business owners

Frequently asked questions

Does general liability cover a data breach at my business?

Usually not in any meaningful way. Many general liability policies exclude or narrowly limit claims about the release of confidential or personal information, and they do not pay your own response costs. A cyber policy is built for those losses. Check your general liability forms schedule for data-related exclusions.

Will my cyber policy cover a breach that started before I bought the business?

Often not. The liability parts of most cyber policies are claims-made with a retroactive date, first-party parts often require the incident to be discovered during the policy period, and a breach anyone knew about before the policy started is usually excluded. Check the seller's policy, its change in control terms and the purchase agreement's indemnity, and ask your deal counsel.

What controls do cyber insurers require before they will quote?

Requirements vary by carrier, but applications commonly ask about multi-factor authentication for email, remote access and administrator accounts, separate and tested backups, endpoint protection, patching, staff training and payment verification. Your answers must be accurate for the business as it runs today.

The seller never had cyber insurance. Is that a red flag?

It is common in owner-run businesses and is not, on its own, a sign that anything was mishandled. It does mean the business has no history with a cyber carrier, and you should check the current state of security controls before applying, since they drive both eligibility and price.

Is cyber insurance required by my SBA lender?

The SBA's operating procedures do not require cyber insurance. Your lender may still require it in the loan agreement, and customers may require it in contracts, so read both.

References

• Federal Bureau of Investigation: Internet Crime Complaint Center 2024 Internet Crime Report
• Cybersecurity and Infrastructure Security Agency: Multifactor Authentication
• Cybersecurity and Infrastructure Security Agency: StopRansomware
• The D&O Diary: Voluntary Parting Exclusion Precludes Coverage for Social Engineering Fraud Loss (2020)
• IRMI: Crime: Getting More Out of the Policy
• U.S. Small Business Administration: SOP 50 10 Lender and Development Company Loan Programs
• U.S. Department of the Treasury, Office of Foreign Assets Control: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (2021)

This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.