Cyber insurance in Canada

Types of optional coverage for cyber insurance policies

Not every type of cyber security risk is covered automatically in a standard cyber insurance policy, which means you may need additional coverage to address specific types of incidents that fall outside the base wording. Depending on how your business operates, you may want to add optional coverage for cyber risks such as:

• Social engineering fraud

• Funds transfer fraud

• Non-malicious system failures

• Bricking

• Reputational harm

Whether these coverages are available and how they apply, will depend on the insurer and the terms of the policy. A local BrokerLink advisor can help you review what options may be relevant for your business.

How does cyber insurance respond after an incident?

If a cyber incident affects your business, here’s how cyber insurance can help:

1. Contacting your insurance provider

Once immediate steps are taken to limit further impact (if possible), you should notify your insurer as soon as possible, either directly or through your insurance broker. Cyber insurance policies often include access to incident-response and forensic support, so early notification can help ensure the response is handled properly.

2. Confirming your coverage

After the insurer is notified, they will review the circumstances of the incident to help determine which parts of your cyber policy may apply. This will help guide how the response moves forward and which specialists may be involved.

3. Investigating the incident

Once coverage is confirmed, the incident is reviewed to determine how access occurred and what systems or data were affected. In many cases, specialists are involved to help confirm the scope of the incident and identify the source.

4. Coordinating the response

As the investigation continues, response efforts are coordinated. This may involve legal guidance, technical support or communications planning, depending on the nature of the incident and whether others are affected.

5. Reviewing how systems were impacted

Once the incident is contained, attention turns to understanding how systems were disrupted. This may include reviewing access permissions and controls that were in place at the time of the event.

6. Assessing the financial impact

As more information becomes available, you can begin to assess how the incident affected your business operations. This may involve reviewing any downtime, lost income or added expenses resulting from system disruption.

7. Recovery and restoration

As systems are repaired and data is restored, operations gradually return to normal. How long this process takes will depend on the extent of the incident and how quickly systems can be safely brought back online.

8. Covered costs are addressed

As the incident response and recovery are completed, covered costs are reviewed under the policy. Depending on the type of expense and the terms of your cyber insurance policy, some expenses may have been handled directly through the insurer’s response process, while others may be reimbursed once the loss is assessed.

How does a cyber insurance settlement actually work?

Cyber insurance does not operate on a single reimbursement model. Instead, it usually works in two parallel ways, depending on the cost:

Direct costs

Often, the insurance provider gets involved early with a cyber insurance claim and helps to coordinate the response. The insurer may appoint approved specialists and manage those costs directly for certain covered services, such as:

• Forensic work

• Breach support

• Legal guidance

• Crisis communications

This means that the business is generally not paying those vendors up front and then waiting to be reimbursed later.

Reimbursement costs

Financial losses or expenses tied to the disruption of your business are often incurred by the business first, such as:

• Lost income

• Extra operating expenses

• Certain restoration costs

Those amounts are typically reviewed later, once the loss can be better assessed under your policy.

How to protect your business from cyber attacks

Here are some safety measures that businesses commonly put in place to help prevent cyber threats:

• Multi-factor authentication (MFA)

• Unique passwords with a password manager

• Restricted access to administrative or critical systems

• A cybersecurity plan

• Regular updates to operating systems and software

• Firewalls and anti-malware tools to monitor PoS systems and network activity

• Regular backups that can be restored if data or systems are disrupted

• Cybersecurity training and awareness programs for all employees

• Personalized cyber insurance coverage