When it comes to cybersecurity, our collective frame of reference usually involves the businesses in the news whose data is being held for ransom. The common response is to think, “It will never happen to me.” The unfortunate reality is that businesses need to be protected from ransomware and cyber attacks, just as your house needs to be protected from flood or fire.
Cyber liability insurance can protect your business against the expenses associated with a data breach — and covers some risks you might not have even thought of. But in order to obtain cyber liability coverage, insurance companies will require your business to be set up with certain cybersecurity measures first. These security measures are put into place because the insurance companies know how effective they are at preventing, detecting, and/or responding to cyber attacks.
Ransomware Coverage Checklist
Ransomware is defined as a type of cyberattack that blocks access to a victim’s data, website, client services systems, or other critical resources until payment is made in return. Ransomware Coverage can include the money to pay ransom demands, the cost of hiring experts to negotiate with the hackers, and the cost of computer forensics experts who can determine how the hackers gained access.
[See also: The Hidden Costs of Ransomware: 4 Ways It Can Cost Your Business]
In order to obtain Ransomware Coverage, most insurance companies will evaluate your business to ensure you have the following cybersecurity measures in place:
- Multi-Factor Authentication (MFA) for remote access
- Anti-malware software
- Patch management process
- Mandatory information security and privacy training of employees and contractors (for social engineering and phishing campaigns) at least once a year
- Weekly backups of critical information
- Subject to MFA, segmentation, and encryption
- Recovery time under 8 hours (objective for critical systems, applications, and processes)
- Business continuity plan (detailing how the business will continue operating during an unplanned disruption in service)
- Disaster recovery plan (detailing how to respond to unplanned incidents such as natural disasters, power outages, cyber attacks, and any other disruptive events)
- Incident response plan (detailing how to return affected systems and data back to an operational state as quickly as possible)
[See also: 4 Tips for Planning a Backup & Recovery Strategy]
Technology Fraud Coverage Checklist
Another common type of Cyber Liability Insurance covers technology fraud. Technology fraud coverage responds to a situation in which an unauthorized party gains access to a business’s computer system and enters or alters data. The coverage will then typically pay for direct financial loss.
In order to obtain Technology Fraud Coverage, most insurance companies will evaluate your business to ensure you have the following cybersecurity measures in place:
- Technology fraud/social engineering or security training (e.g. social engineering, phishing, spear phishing, baiting, etc.)
- Procedures to verify the authenticity of any payment or funds transfer
- Strong passwords required with a mix of uppercase, lowercase, numbers, and symbols
- SPAM mail filters
- Regular or automated software patching schedule
- Procedures and tools to backup and restore sensitive data and critical systems
- Multi-Factor Authentication (MFA) on email access
- Secure Email Gateway (e.g. Proofpoint, Barracuda, Mimecast)
Although this may seem like a long list of requirements, it is worth it to secure the future of your business. Think about the financial loss, recovery costs, lost productivity, business interruption, reputational harm, and legal repercussions if your business encounters a cyber attack.
Cybercrime is run by highly organized groups. Thinking “it won’t happen to me” has changed to “it’s only a matter of time.” These attackers know how to identify vulnerabilities and take advantage of the lack of cybersecurity measures put into place.
Engaging local professionals, like Imagineering IT, can help put these checklist items into action, secure your business, and help you plan strategically for the long term.
