Cyber Insurance for Small Businesses: What It Covers and What Insurers Require

It’s still worth your time. The National Association of Insurance Commissioners (NAIC), the group that coordinates state insurance regulators, says in its 2026 report on the cybersecurity insurance market that many small and medium-sized businesses still have no coverage. Meanwhile, the FBI’s 2025 Internet Crime Complaint Center (IC3) report says losses reported to IC3 passed $20 billion in 2025, and that IC3 received more than 3,600 ransomware complaints.

This guide explains cyber insurance for US small businesses in plain English. I’ve stuck to official sources: the FTC, NAIC, CISA and the FBI. Where something varies by insurer, or where I simply couldn’t confirm it, I’ll tell you so.

Quick answer: Cyber insurance helps pay for the fallout from a hack, data breach or online fraud. First-party coverage pays your own costs, such as recovering data, income lost while you’re down and cyber extortion, while third-party coverage protects you when customers or others bring claims against you. Policies differ a lot in what they exclude and which security controls they expect, so read the wording and ask your broker exactly what’s covered, at what limit, and what you need to have in place.

What Cyber Liability Insurance Actually Is

Cyber insurance (you’ll also see it called cyber liability insurance) is a policy built for losses tied to computers, networks and data. Picture ransomware locking every file on your office PCs. Or a breach that exposes customer records. Or a fake invoice email that tricks your bookkeeper into wiring money to a criminal.

Your other business policies may or may not respond to events like these, and that’s exactly the problem. NAIC tells businesses to ask how a cyber policy works with crime, property, liability and other coverage. The lines between policies can blur, and you really don’t want to discover the gap after an incident.

One thing cyber insurance isn’t: identity theft insurance. NAIC treats identity theft insurance as a consumer product and says it’s different from cybersecurity insurance, which is what businesses usually hold.

First-Party vs Third-Party Coverage

The FTC tells small businesses to talk with their insurance agent about which policy fits, including whether they need first-party coverage, third-party coverage or both. If you only remember one idea from this article, make it this split. It makes every quote easier to read.

First-party: your own costs

According to the FTC, first-party coverage protects your data, including employee and customer information. Put simply, it pays your bills when something happens to you.

The FTC’s cyber insurance fact sheet, which it developed with NAIC, lists first-party costs including:

• recovering or replacing lost or stolen data
• lost income from business interruption
• cyber extortion and fraud
• fees, fines and penalties related to the cyber incident

You’ll often hear breach response costs talked about here too. That means forensic investigators who work out what happened, notifying the people whose data was exposed, and lawyers who advise on what you’re legally required to do. I couldn’t confirm the FTC’s complete list of first-party items, so treat these as things to look for by name in your quote, not as a given.

Third-party: when someone else comes after you

Third-party coverage “generally protects you from liability if a third party brings claims against you,” the FTC says. That third party might be customers whose data leaked or a business partner who lost money because of your incident. Depending on the wording, it can also include defense costs if a regulator starts asking questions.

Most small businesses I can think of hold someone else’s information. Client files, customer emails, order histories. If yours does, third-party coverage deserves a serious look.

Coverage at a glance

The Coverage Pieces Worth Asking About by Name

Breach response and notification

The first hours after a breach are chaotic. The FTC suggests asking whether the insurer offers a breach hotline that’s open every day of the year, at all times. I’d put that near the top of my list. A number you can call at 2 a.m. on a holiday weekend is worth a lot when your stomach is in knots.

It also helps to know the basic playbook before you need it. Our guide on what to do after a data breach walks through the first steps.

Business interruption

The FTC says first-party coverage typically covers lost income from business interruption. For a small shop that can’t take orders or a clinic that can’t open patient records, this might be the biggest cost of all. Ask how the insurer measures the loss and whether there’s a waiting period before the cover starts.

Ransomware and extortion

The FTC fact sheet lists cyber extortion as a first-party cost. There’s a wrinkle, though. The US Treasury’s Office of Foreign Assets Control (OFAC) issued an updated advisory on September 21, 2021 about the sanctions risks of facilitating ransomware payments. As I understand it, the advisory discourages paying and warns that making a payment, or helping someone else make one (insurers included), can violate sanctions. I wasn’t able to check the advisory text itself, so look it up on Treasury’s OFAC website before you rely on the details.

Funds transfer fraud and social engineering

Business email compromise, or BEC, is when a criminal poses as your boss, a supplier or a client by email and talks someone into sending money. It’s a social engineering scam, meaning it tricks a person rather than breaking into a system.

The FTC lists fraud among first-party costs, but how a given policy handles BEC varies. NAIC’s advice to ask whether separate limits apply to specific losses matters most here. A policy can look generous overall and still pay a much smaller amount for this exact scenario. Ask, and get the answer in writing.

Regulatory defense, fines and penalties

The FTC says first-party coverage typically covers “fees, fines, and penalties related to the cyber incident.” Some policies also pay legal defense costs when a regulator investigates. Whether that’s in your policy, and at what limit, is a question for your broker.

Common Exclusions to Look For

I couldn’t confirm a standard list of exclusions from an official source, and exclusions vary from one policy to the next. So treat these as areas to check in the wording, not things every policy says:

• War and state-backed attacks. Lloyd’s of London reportedly told its market in a 2022 bulletin (Y5381) that standalone cyber policies from March 31, 2023 must exclude losses from state-backed cyberattacks unless Lloyd’s agrees otherwise. I couldn’t view the bulletin itself, and it applies to Lloyd’s syndicates, not every US insurer.
• Prior known incidents. Look for wording about problems you knew about, or should have known about, before the policy started.
• Unpatched systems. Check whether anything limits cover when a loss traces back to software you didn’t update.
• Bodily injury and property damage. Physical harm may be handled by other policies, so check how your cyber policy treats it.

It’s also worth checking what’s included rather than excluded. The FTC says to make sure a policy covers data breaches, attacks on your network, attacks on your data held by vendors and other third parties, and attacks anywhere in the world. That vendor point gets missed a lot. Companies you rely on can have incidents too, as our coverage of the DigiCert breach involving customer data shows.

What Insurers Usually Ask About on the Application

Here’s where I have to be upfront. I couldn’t find an official source spelling out what insurers require. NAIC simply tells businesses to ask “what security practices are required,” and the answer depends on the insurer. That said, these are the controls application forms commonly ask about:

• Multifactor authentication (MFA), the second step like a code or app prompt after your password, especially for email and remote access
• Endpoint detection and response (EDR), security software on each computer that watches for suspicious behavior and helps you respond to it
• Offline or separate backups that ransomware can’t reach and encrypt
• Patching, meaning you install software updates promptly
• Employee phishing training so staff can spot fake emails
• An incident response plan that says who does what when something goes wrong

If backups are your weak spot, our comparison of cloud backup options for business data is a good place to start. And answer every application question carefully and honestly. Those answers describe the business the insurer believes it’s covering.

How Premiums Are Set

There’s no official formula I could confirm, and every insurer rates risk its own way. Factors that typically come into play include your revenue and industry, how much sensitive data you hold, which security controls you have, your claims history, and the limits and deductible you choose.

I’m not quoting any prices. I couldn’t find official published pricing, and cyber insurers generally quote case by case. The one official data point: NAIC’s 2026 report says cyber insurance prices continued to decline in 2025. Your own quote could still go either way.

The Cyber Insurance Market in Numbers

NAIC’s 2026 report gives a useful snapshot. US cyber direct written premium (roughly, the total premium insurers wrote) was about $9.46 billion in 2025, up 3.5% from 2024. Domestic insurers reported 5.84 million policies in force, a 33% increase.

The industry-wide loss ratio, which compares losses with premiums, rose to 53 from 48.7 even as prices fell. NAIC also says only about 1% of global economic cyber losses are insured. That’s a lot of uninsured damage out there.

Questions to Ask Your Broker

NAIC and the FTC between them give you a solid checklist. I’ve combined their points below and added a couple of my own at the end:

• Which events are covered, and which are excluded?
• How much will the policy pay, and do separate limits apply to specific losses?
• What security practices are required?
• How quickly must an incident be reported?
• How does this cyber policy work with my crime, property, liability and other coverage?
• Does it cover attacks on my data held by vendors, and attacks anywhere in the world?
• Does it pay in excess of insurance I already have?
• Is there a breach hotline open every day of the year, at all times?
• Is social engineering fraud covered, and at what limit? (mine)
• Can I pick my own lawyers and IT responders, or must I use the insurer’s? (mine)

How Cyber Insurance Fits With Security Basics

Insurance pays for damage. It doesn’t stop the attack. I’d think of it as the safety net under the basics, not a replacement for them.

If you’re not sure where to start, CISA’s Cyber Essentials guide was written for leaders of small businesses and small local government agencies. CISA released it on November 6, 2019 and revised it on January 21, 2021. It has two parts: guiding principles for leaders, and specific actions for leaders and IT staff.

CISA’s basic cyber hygiene steps are simple on paper. Turn on multifactor authentication, keep software updated, think before clicking links, and use strong passwords. The FTC’s cybersecurity for small business pages cover similar ground, including its cyber insurance fact sheet.

Here’s the nice part. The same habits that cut your risk are often the ones insurers ask about, so work on one and you’re usually helping the other.

So, Should Your Small Business Buy Cyber Insurance?

If you hold customer data, take payments, or would lose real money from a week offline, I think it’s worth getting a quote. Just don’t buy on headline limits alone. The sublimits, exclusions and reporting deadlines are where policies really differ.

Get your security basics in order first, answer the application honestly, and go to your broker with the questions above. You’ll get a clearer quote, and probably a better policy.

Frequently Asked Questions

What’s the difference between first-party and third-party cyber insurance?

First-party coverage pays your own costs after an incident. The FTC lists items like recovering lost or stolen data, lost income from business interruption, cyber extortion and fraud, and related fees, fines and penalties. Third-party coverage generally protects you when someone else, such as a customer or partner, brings claims against you.

Does my general liability policy cover cyberattacks?

It may not, and you shouldn’t assume it does. NAIC advises businesses to ask how a cyber policy works with crime, property, liability and other coverage. Ask your broker to explain where each type of cyber loss would be covered, if at all.

Will cyber insurance pay a ransomware demand?

The FTC lists cyber extortion as a first-party cost, but what a specific policy pays depends on its wording. The US Treasury’s OFAC has also warned, in a 2021 advisory, that making or facilitating ransomware payments can carry sanctions risks, including for insurers.

How much does cyber insurance cost for a small business?

There’s no standard price. Insurers generally quote case by case based on factors like your industry, revenue, data and security controls. NAIC’s 2026 report says cyber insurance prices continued to decline in 2025, but your own quote can vary.

Do I need MFA to get cyber insurance?

Many insurers ask about multifactor authentication on their applications, but requirements vary by insurer. CISA recommends MFA as a basic security step anyway, so it’s worth turning on regardless.