Does my general liability policy cover a cyberattack?

No. Standard commercial general liability (CGL) policies exclude electronic data and cyber events. The ISO CG 00 01 form has contained a data exclusion since 2014. Cyber coverage must be purchased separately — either as a standalone policy or as a carefully reviewed endorsement.

Is cyber insurance required by law for small businesses?

There is no universal federal mandate requiring small businesses to carry cyber insurance. However, contracts with larger clients, payment card processors (PCI DSS requirements), healthcare partners (HIPAA), or government entities increasingly require proof of cyber coverage.

How much does a standalone cyber policy cost for a small business?

A professional services firm with $1M–$5M in revenue and strong MFA controls might pay $1,500–$4,500 per year for a $1M limit policy. Retailers and healthcare businesses typically pay more due to PCI and HIPAA exposure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses — ransomware payments, business interruption, notification costs, and forensics. Third-party (liability) coverage pays for claims made against you by customers, business partners, or regulators alleging you failed to protect their data. A complete cyber policy includes both.

Will my insurer pay a ransomware demand?

Most standalone cyber policies include extortion coverage that reimburses verified ransom payments. However, insurers conduct an OFAC sanctions check before authorizing payment. If the attacker is on a U.S. sanctions list, payment may be prohibited. Do not pay a ransom without involving your insurer first.

Does cyber insurance cover an attack caused by an employee's mistake?

Yes, in most cases. Cyber policies cover losses from human error, accidental disclosure, and employee-caused breaches, not just external attacks.

What security controls do cyber insurers require in 2026?

Most carriers now require, at minimum: MFA on email and remote access; endpoint detection and response (EDR) tools on all devices; regular offsite/offline backups; and a documented incident response plan.

How does a cyber claims-made policy work?

Cyber policies are almost universally written on a claims-made basis, meaning the claim must be first made and reported to the insurer during the policy period, regardless of when the breach occurred, subject to the retroactive date.

What we offer How it works Why Morrow FAQ

Login Get a quote →

Morrow/Resources

New Cyber Threats for Small Business

Need advice? We're here to help.

Tell us about your business and a licensed Morrow advisor will get back to you, usually within the hour, with straight answers and real options, no obligation.

Contact us or call (339) 209-0983

Insurance for tomorrow's risks.

The tech-enabled commercial brokerage for small and medium businesses, backed by licensed advisors and access to 100+ carriers.

Get a quote →

Explore

How it works What we offer Why Morrow Coverage checkup Resources FAQ

Insurance library

Browse all guides Coverage Industries Glossary Cost Compare

Legal

Privacy Terms

© 2026 Morrow. Afthonea Inc. dba as Morrow Risk Advisory. CA broker license #6019801. Insurance is offered through licensed brokers; coverage is subject to underwriting and availability. This site is for general information only and is not an offer of insurance.