A cyber event can create several losses at once
Ransomware, account takeover, misdirected data and vendor compromise can interrupt operations while creating forensic, legal, notification and reputational work. Traditional property and liability policies may provide little or no cyber protection. A dedicated cyber policy can combine first-party response costs with third-party liability, subject to its terms.
Coverage varies significantly. Review the insuring agreements, sublimits, exclusions and required consent before relying on a headline policy limit.
First-party and third-party coverage
Available policies may address:
- Incident-response, forensic, privacy counsel and notification expenses
- Restoration of electronic data and systems
- Cyber business interruption and extra expense after a covered event
- Cyber extortion response and payment, where lawful and insured
- Privacy and network-security liability claims
- Regulatory investigations or penalties where insurable by law
- Payment-card assessments, media liability or reputational support
Social engineering, invoice manipulation and fraudulent transfer are not always included in the core cyber form. Confirm whether they require a separate crime endorsement, what verification controls apply and whether limits are shared.
Privacy duties depend on the organization and information
Organizations subject to PIPEDA must keep records of all breaches of security safeguards and report qualifying breaches that create a real risk of significant harm. Ontario health information custodians have separate PHIPA duties. Other provincial, contractual and sector rules may apply. Coverage does not determine whether a breach is legally reportable; qualified privacy counsel should make that assessment.
Maintain an incident plan with insurer contact instructions. Using an unapproved vendor or incurring costs before consent may affect reimbursement under some policies.
Security controls support resilience and insurability
The Canadian Centre for Cyber Security recommends controls such as an incident-response plan, timely patching, strong authentication, staff training, backups, encryption and access control. Insurers commonly ask detailed questions about these safeguards.
Answer applications accurately and tell the advisor when controls change. Test backups, require multi-factor authentication for critical accounts, verify payment changes through a second channel and document vendor access. Insurance complements these controls; it does not replace them.
Map the technology before comparing quotes
Prepare an inventory of systems, sensitive records, cloud providers, payment processes, remote access, backups and critical vendors. Then contact Westoak to compare available cyber coverage, response services and control requirements with your business interruption and crime protection.