Does my general liability policy cover a cyberattack?

No. Standard commercial general liability (CGL) policies exclude electronic data and cyber events. The ISO CG 00 01 form has contained a data exclusion since 2014. Cyber coverage must be purchased separately, either as a standalone policy or as a carefully reviewed endorsement.

Is cyber insurance required by law for small businesses?

There is no universal federal mandate requiring small businesses to carry cyber insurance. However, contracts with larger clients, payment card processors (PCI DSS requirements), healthcare partners (HIPAA), or government entities increasingly require proof of cyber coverage.

How much does a standalone cyber policy cost for a small business?

A professional services firm with $1M–$5M in revenue and strong MFA controls might pay $1,500–$4,500 per year for a $1M limit policy. Retailers and healthcare businesses typically pay more due to PCI and HIPAA exposure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses, ransomware payments, business interruption, notification costs, and forensics. Third-party (liability) coverage pays for claims made against you by customers, business partners, or regulators alleging you failed to protect their data. A complete cyber policy includes both.

Will my insurer pay a ransomware demand?

Most standalone cyber policies include extortion coverage that reimburses verified ransom payments. However, insurers conduct an OFAC sanctions check before authorizing payment. If the attacker is on a U.S. sanctions list, payment may be prohibited. Do not pay a ransom without involving your insurer first.

Does cyber insurance cover an attack caused by an employee's mistake?

Yes, in most cases. Cyber policies cover losses from human error, accidental disclosure, and employee-caused breaches, not just external attacks.

What security controls do cyber insurers require in 2026?

Most carriers now require, at minimum: MFA on email and remote access; endpoint detection and response (EDR) tools on all devices; regular offsite/offline backups; and a documented incident response plan.

How does a cyber claims-made policy work?

Cyber policies are almost universally written on a claims-made basis, meaning the claim must be first made and reported to the insurer during the policy period, regardless of when the breach occurred, subject to the retroactive date.

(339) 209-0983 Get a quote

New Cyber Threats for Small Business

Author: Jordan Kessler, CPCU, CIC, Commercial Lines Specialist, Morrow (Afthonea Inc.) Published: June 2026 | Last Updated: June 2026