Technology risk begins with what the customer expects
A software vendor, managed-service provider and hardware developer can all face allegations that their work failed, caused delay or exposed information. The insurance review should match the product, customer promises and delivery model—not simply the label “technology company.”
Document what the business builds or manages, who relies on it, where data is stored, maximum contract size and the financial harm a failure could create.
Separate professional failure from a cyber incident
Technology errors and omissions insurance may respond to covered allegations that a product or service failed to perform. Cyber insurance can address specified privacy, security and incident-response events. Some insurers combine these protections; others do not. Review how the wordings interact when one event could trigger both.
Other components can include:
- Commercial general liability and office property
- Media or intellectual-property liability where available
- Crime and social-engineering coverage
- Directors and officers insurance for leadership decisions and financing activity
- Business interruption coverage for insured dependencies and outages
Contracts define much of the exposure
Service-level agreements, performance warranties, uncapped indemnities and broad intellectual-property obligations can exceed what insurance was designed to cover. Confirm whether customers require specific limits, additional insured status or a particular jurisdiction. Legal counsel should review contract language; a certificate of insurance does not change the policy.
Claims-made policies also require attention to retroactive dates, timely notice and continuous coverage when switching insurers.
Controls support both resilience and insurability
The Canadian Centre for Cyber Security recommends measures including incident-response planning, patching, strong authentication, backups and staff training. The Office of the Privacy Commissioner explains that organizations subject to PIPEDA have breach record-keeping and reporting duties in specified circumstances. Establish responsibilities before an event, including who contacts counsel, affected clients, regulators and the insurer.
Prepare an accurate submission
Gather revenue by product and geography, customer industries, largest contracts, standard agreements, data types, hosting providers, security controls, claims and known circumstances. Contact Westoak to review technology coverage before signing a large contract, launching a materially different product or entering a new market.