Does my general liability policy cover a cyberattack?

No. Standard commercial general liability (CGL) policies exclude electronic data and cyber events. The ISO CG 00 01 form has contained a data exclusion since 2014. Cyber coverage must be purchased separately — either as a standalone policy or as a carefully reviewed endorsement.

Is cyber insurance required by law for small businesses?

There is no universal federal mandate requiring small businesses to carry cyber insurance. However, contracts with larger clients, payment card processors (PCI DSS requirements), healthcare partners (HIPAA), or government entities increasingly require proof of cyber coverage.

How much does a standalone cyber policy cost for a small business?

A professional services firm with $1M–$5M in revenue and strong MFA controls might pay $1,500–$4,500 per year for a $1M limit policy. Retailers and healthcare businesses typically pay more due to PCI and HIPAA exposure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses — ransomware payments, business interruption, notification costs, and forensics. Third-party (liability) coverage pays for claims made against you by customers, business partners, or regulators alleging you failed to protect their data. A complete cyber policy includes both.

Will my insurer pay a ransomware demand?

Most standalone cyber policies include extortion coverage that reimburses verified ransom payments. However, insurers conduct an OFAC sanctions check before authorizing payment. If the attacker is on a U.S. sanctions list, payment may be prohibited. Do not pay a ransom without involving your insurer first.

Does cyber insurance cover an attack caused by an employee's mistake?

Yes, in most cases. Cyber policies cover losses from human error, accidental disclosure, and employee-caused breaches, not just external attacks.

What security controls do cyber insurers require in 2026?

Most carriers now require, at minimum: MFA on email and remote access; endpoint detection and response (EDR) tools on all devices; regular offsite/offline backups; and a documented incident response plan.

How does a cyber claims-made policy work?

Cyber policies are almost universally written on a claims-made basis, meaning the claim must be first made and reported to the insurer during the policy period, regardless of when the breach occurred, subject to the retroactive date.

What we offer How it works Who we cover Why Morrow FAQ

(339) 209-0983 Get a quote

Morrow/Resources

New Cyber Threats for Small Business

Talk to a licensed Morrow advisor

Tell us about your business and we'll come back with options from carriers writing your class. Most businesses are quoted within the hour.

Get a quote

Commercial insurance, simplified. Coverage you can count on, people you can reach.

Explore

How it works What we offer Who we cover Why Morrow Resources FAQ

Insurance library

Browse all guides Coverage Industries Glossary Cost Compare

Legal

Privacy Terms

© 2026 Morrow. Afthonea Inc. dba as Morrow Risk Advisory. Insurance is offered through licensed brokers; coverage is subject to underwriting and availability. This site is for general information only and is not an offer of insurance.