What cyber insurance is

Cyber insurance covers the financial consequences of information security incidents: hacking and virus attacks, ransomware encryption of data, leaks of personal and commercial data, failure of information systems due to an external cause, and fraud using social engineering. For a company such an incident means downtime, costs of investigation and restoring systems, and claims from clients and partners. The policy is needed by businesses that depend on IT systems and hold client data: retail and e-commerce, financial organisations, medical and educational institutions, logistics, manufacturing with automated lines, and IT and service companies.

In Kazakhstan cyber insurance is a relatively new line: the range of programs and the terms differ markedly between insurers, and the contract is often tailored individually, including with the involvement of reinsurers. The quality of the information prepared about the company therefore directly affects the outcome.

Main coverage blocks

The company's own costs

  • investigating the incident, incident response and computer forensics specialists;
  • restoring data, software and systems;
  • losses from business interruption due to unavailability of systems;
  • costs of notifying clients, legal advice and reputation management;
  • costs related to cyber extortion — where permitted by law and the terms of the contract.

Liability to third parties

  • claims by clients and partners in connection with a data leak or breach of confidentiality;
  • damage to third parties through transmission of malicious code from the company's systems;
  • defence costs in proceedings with government bodies — within the limits permitted by law.

What is usually not covered

  • incidents and vulnerabilities known to the company before the start of insurance;
  • intentional acts of management and owners;
  • failures due to equipment wear, planned works or update errors without external influence — depending on the program;
  • damage to physical equipment, failures of power grids and external communications infrastructure;
  • fines and sanctions, where their insurance is not permitted;
  • war and large-scale state-level attacks — according to the wording of the contract;
  • the value of the data and intellectual property itself, and lost profit from their loss.

What determines the price

The insurer assesses the maturity of information security: multi-factor authentication, backups stored outside the main network, segmentation, antivirus protection and monitoring, update policy, staff training, and an incident response plan. Taken into account are the industry, turnover, the volume and sensitivity of data processed, the business's dependence on online channels, the use of cloud services and contractors, the incident history, and the chosen limits and deductible. Weaknesses in protection can lead to refusal of cover or to conditions in the contract.

What to check in the contract

  • Limits — the aggregate and sublimits by section, especially for business interruption and extortion.
  • Waiting period — how much downtime must pass before cover of business interruption losses begins.
  • Deductible — monetary or time-based.
  • Policyholder's obligations — maintaining the declared protective measures, and the procedure and deadlines for notifying an incident.
  • Response services — whether there is a 24-hour line and approved contractors.
  • Retroactive date and the procedure for reporting third-party claims.

What to do in the event of an incident

  1. Isolate the affected systems without destroying traces and event logs.
  2. Immediately notify the insurer or the hotline stated in the contract.
  3. Engage investigation and recovery contractors in agreement with the insurer.
  4. Do not negotiate with extortionists and do not pay anything without approval.
  5. Fulfil the obligations to notify clients and government bodies, if the law so provides.
  6. Document the costs and the downtime.

How Polis Re helps

The broker helps prepare the questionnaire on systems and security measures, find out which programs are available from insurers in the domestic market and through reinsurance, and compare the scope of cover and the policyholder's obligations. Cyber risk is often linked with other types of protection — business liability and company property; terms are explained in the glossary. To discuss a program for your company, send a request to the broker.