Question 1

What's the difference between cyber liability insurance and tech E&O?

Accepted Answer

Cyber liability responds when your systems are breached and data is compromised. Tech E&O responds when your technology product or professional service fails to perform and causes a client financial loss. Many technology businesses need both, with limits set independently.

Question 2

Does general liability cover cyberattacks or data breaches?

Accepted Answer

No. Standard general liability forms contain explicit cyber exclusions. A data breach, ransomware attack, or network security failure is not a covered peril under GL.

Question 3

What is first-party vs third-party cyber coverage?

Accepted Answer

First-party coverage pays for your own costs after a cyber incident: forensics, notification, ransom, income loss, and PR. Third-party coverage pays for claims made against you by others: customer lawsuits, regulatory fines, and liability to clients whose data was compromised.

Question 4

Does cyber insurance cover ransomware payments?

Accepted Answer

Most cyber policies cover ransomware payments and the negotiation costs associated with them, subject to your policy terms and applicable law. Coverage also typically extends to data restoration costs if you choose not to pay, or if payment doesn't restore access.

Question 5

What security controls do I need to qualify for cyber insurance?

Accepted Answer

Multi-factor authentication (MFA) on email and remote access is now effectively a baseline requirement. Endpoint detection and response (EDR) tools, regular offline backups, employee security training, and a documented incident response plan are increasingly expected.

Question 6

Is cyber liability insurance required by law?

Accepted Answer

There is no universal federal mandate for cyber insurance. Regulatory frameworks like HIPAA, CCPA, and PCI-DSS impose data protection obligations and penalties, but stop short of requiring a policy. Some contracts do require proof of cyber coverage before work can begin.

Question 7

How is a cyber insurance claim handled after a breach?

Accepted Answer

Most policies require prompt notification, often within 72 hours of discovery. Your carrier activates a breach response team including forensic investigators, breach counsel, and a notification vendor. Your broker should be the first call, not the last.