As more and more businesses rely on computers, electronic systems, and networks to conduct their operations, any disruption to those systems could mean an interruption in business. Businesses that fall victim to cyberattacks may be taken offline, unable to access key data, or locked out of their systems for hours, days, or even weeks. With business interruption coverage on a cyber policy, businesses can actively protect against this potential risk exposure.

How Cyberattacks Cause Business Interruptions

Cyberattacks can come in many forms, and some may render your business inoperable. If your business depends heavily on technology infrastructure, disruption of those systems could bring your business operations to a halt. Here are a few examples of how a cyberattack could cause a business interruption:

• You run an e-commerce business, and during a key holiday weekend, your business is targeted by a distributed denial of service (DDoS) attack. Your web servers are flooded with malicious traffic, causing your website to go down. Your business loses tens of thousands of dollars in lost revenue.
• Your dental practice falls victim to a ransomware attack, and the cybercriminal holds your entire computer system hostage. The system stores information on your customers, including phone numbers, health records, and credit card numbers, and it also houses your appointment reservation system. You are unable to conduct business until you can access your computer systems again.
• You own a popular restaurant that takes reservations and take-out orders online. An employee at your restaurant falls for a phishing scam and inadvertently grants access to your web servers to a hacker. The hacker then diverts all of your web traffic to a malicious website.
• You run a retail store, and you rely heavily on third-party point-of-sale software that allows you to process transactions and manage inventory. Because of a cyberattack on your software vendor, the entire POS system goes down, preventing you from making any sales.

For larger businesses with dedicated IT departments, recovering from these types of cyberattacks may be quick, and downtime can be kept to a minimum. For smaller businesses without the technical expertise, however, one cyberattack could mean a prolonged closure of your business, leading to significant financial losses.

Does cyber insurance cover business interruptions?

Many cyber insurance policies include business interruption coverage, providing funds to cover losses during an interruption directly caused by a cyber event. Cyber business interruption coverage typically covers:

• Lost income if your business is unable to operate due to a cyber event
• Profits that would have been earned based on historical financial records if the cyber event had not occurred
• Fixed operating expenses, including utilities, rent, and employee salaries
• Rented or leased equipment

Business interruption coverage does not always come with cyber insurance, however, so it is best to check with your broker or agent prior to purchase. If it’s not included by default, it may be available as an endorsement on your policy.

Does cyber insurance cover contingent business interruptions?

Contingent business interruptions can occur if a key partner, supplier, or other supporting business suffers an event that directly impacts your ability to earn revenue. Contingent business interruption coverage on a cyber policy can provide funds to cover losses during an interruption caused by a third party’s business interruption.

Example: 

• You run an online webstore that sells holiday decorations. During the Thanksgiving shopping weekend, your web host is hit by a cyberattack, causing their services to go down and taking your site down with it. Contingent business interruption coverage on a cyber policy can cover the losses you suffered during the outage.

Contingent business interruption coverage is not available on all cyber insurance policies. This coverage has only more recently been adopted by insurers, so you’ll need to check policy language carefully to understand whether you’d be covered in a contingent business interruption.

Cyber Business Interruption vs. Traditional Business Interruption

You may be familiar with traditional business interruption coverage, also called business income coverage, which often comes as an added endorsement to a commercial property policy. This type of coverage is intended for businesses with physical property (e.g., a retail store or office) and provides coverage for losses during an interruption of business caused by property damage. 

Business interruption coverage on a cyber policy is different in many ways, given there is usually no tangible physical property that is damaged in a cyberattack. Below, we outline a few of the key differences:

• Waiting Period: With a traditional business interruption policy, there is typically a 72-hour waiting period before coverage kicks in. None of the losses during the waiting period are covered, and the waiting period begins at the time of the loss. With a cyber policy, however, the waiting period is usually much shorter, given the speed of cyberattacks and the short time it takes for a business to recover. Some insurers may offer waiting periods of just a few hours, while others may offer a 24-hour period.
• Period of Restoration: The period of restoration is generally defined as starting when the loss occurs and ending when the damaged property is repaired or replaced—this is the period of time that an insurer would cover losses. In a traditional business interruption policy, it’s usually clear when the period of restoration is as you can see when a physical property is damaged and when it is repaired. For cyber events, though, it may be more difficult to determine exactly when a loss begins and ends, and insurers may define this period differently.
• Reputational Loss: Even after recovering from a cyberattack, a business may suffer long-term losses from damage to their reputation. With physical property damage like a fire, once your property is repaired, customers will generally come back. With a cyber event like a data breach, however, customers may lose trust with your business and go elsewhere. Some cyber business interruption policies may come with coverage for these extended financial losses.

Protecting Your Business Against Cyberattacks

The best way to prevent a cyber-related business interruption is to implement robust cybersecurity protocols. Here are a few simple actions you can take:

• Practice good login/password techniques. It’s not surprising that many successful cyberattacks stem from exploiting common or easily-guessed passwords. A little bit of password rigor can go a long way. Make sure you’re not using the same login and password across multiple accounts, create strong passwords (and require your employees to do the same), and consider using a password manager, like 1Password, which can automatically create strong passwords for you. For even higher levels of protection, use two-factor authentication, which forces you to confirm your identity with extra information, like a phone number or unique security code.
• Train your employees. You know what they say about the weakest link—all it takes is one employee to fall for a scam or get hacked for your entire business to be vulnerable. Make sure you are educating your employees on basic cybersecurity, like recognizing common phishing attacks, avoiding opening attachments or clicking on links from unverified sources, and implementing strong passwords.
• Keep your systems up to date. Many of the most famous cyberattacks took advantage of out-of-date software and known vulnerabilities. Make sure that your computers and network systems are always updated to the latest versions. Many of these updates are specifically to plug security holes, so it’s important to ensure you and your employees take the time to update all devices.
• Backup your data. If your data is ever held hostage, deleted, or lost, you’ll be thankful you had a backup in place. While you can subscribe to cloud backup services like Backblaze, it’s also wise to keep a physical backup of your data.
• Use security software. Many operating systems already come built-in with security and antivirus software, so you’re more than likely already decently protected from known viruses and attacks (just make sure your software is updated and activated). However, if you are on an older operating system, you may want to consider purchasing an off-the-shelf security product, e.g. Norton 360.
• Restrict access to sensitive data. By limiting the people at your company who have access to certain files, you’ll be lowering the risk of those files being hacked or that data being breached. Make sure you’re implementing varying levels of security access, with the most confidential data being shared with only those who absolutely need access.

Compare Cyber Insurance Quotes

There are a variety of insurers and brokers in the market, and it may be difficult sorting through all of the options. AdvisorSmith analyzed a variety of cyber policies and determined the best cyber insurance companies for small businesses. To determine the best cyber insurers, AdvisorSmith considered a number of factors, including financial strength ratings from AM Best and Standard & Poor’s, customer satisfaction data from several J.D. Power studies, complaint ratings from the National Association of Insurance Commissioners, available features and options, and availability of information and ease of use of the insurers’ websites.

» Read our full review of the best cyber insurance companies.

Rank	Company	AdvisorSmith Rating
1	Hiscox	4.9 / 5.0
2	Chubb	4.8 / 5.0
3	The Hartford	4.7 / 5.0
4	AIG	4.7 / 5.0
5	CNA	4.6 / 5.0
6	Arch	4.5 / 5.0
7	Hanover	4.5 / 5.0
8	Intact	4.4 / 5.0
9	Beazley	4.3 / 5.0
10	Axis	4.3 / 5.0

Final Word

As cyber and ransomware attacks are hitting businesses with more frequency, it’s important to understand just how impacted your business could be if your website, computer systems, or data were made unavailable. If your business must shut down or halt operations in the wake of a cyberattack, having business interruption coverage on a cyber policy can help to recover some of your losses.