Compliance and cyber insurance basics

Insurance forms and regulations can make cybersecurity feel like paperwork. Underneath, they usually ask about the same practical habits that reduce risk for any business.

Knowing those habits ahead of time means you can walk into conversations with an insurer or advisor prepared. This page is general information, not legal or insurance advice. For decisions about your business, talk with your agent, attorney or compliance advisor.

What is cyber insurance and what does it cover?

Cyber insurance helps pay for the fallout from a cyber incident. The FTC's guidance on cyber insurance splits it into two kinds. First-party coverage pays your own costs, like legal counsel, data recovery, customer notification, lost income from business interruption, and forensic investigation. Third-party coverage protects you from claims others bring against you.

The FTC also suggests checking whether a policy covers ransomware and attacks on data held by your vendors, and whether the insurer offers a breach hotline. The National Association of Insurance Commissioners notes that most commercial property and general liability policies don't cover cyber risks, so ask your agent directly.

What do insurers usually ask small businesses?

Every insurer's application is different, but the questions tend to cluster around a few basics:

• Do you use two-step sign-in (MFA) for email, remote access and admin accounts?
• Do you keep regular backups, and are they separate from your main systems?
• Do you install software updates promptly?
• Do you train staff to recognize phishing?
• Do you have a written plan for what to do after an incident?

If you can't answer yes to one of these yet, that's a good place to start. Our small business cybersecurity checklist covers each one in plain English.

Which security rules might apply to my business?

Most small businesses aren't covered by a single cybersecurity law, but some are. Medical and dental practices handling electronic health records fall under the HIPAA Security Rule. Tax preparers, mortgage brokers and some other financial businesses may fall under the FTC's Safeguards Rule, which requires a written information security program. Lawyers have professional duties too, covered in our guide to cybersecurity for law firms.

These rules depend on what your business does and the data it holds. A qualified advisor can tell you which apply.

How can I get ready without a compliance team?

Start with a short written record of what you already do. List your key accounts, where important data lives, who has access, and how you back it up. A simple risk assessment makes this easier and gives you something concrete to show an insurer or advisor.

NIST's CSF 2.0 Small Business Quick-Start Guide is a free, short framework for organizing that work. Revisit it once a year, or whenever your business changes.

What can a free scan help with, and what can't it?

Our free website security scan checks the public parts of your setup: HTTPS, your certificate, security headers and email authentication. That can help you answer some insurer questions and spot gaps early. You can preview the format in our example report.

It can't tell you whether you meet any rule or policy requirement. It doesn't look inside your systems, test your backups or review your procedures. Use it as one input alongside advice from your insurer and advisors.