To navigate the murky cyber market, it is important to assemble a knowledgeable team. Companies should assess whether their current insurance broker has the capability to address and insure cyber risks. It may be necessary to engage a broker who specializes in the placement of cyber insurance policies. Those brokers are in constant contact with the underwriters who are drafting the policies, therefore, they will have up to the minute intelligence on what is negotiable. Companies also should consider engaging coverage counsel to assist with the negotiation of the policy wording and understanding how this complex coverage works. While the market remains in flux, there are opportunities to improve on the “base” policy forms but to secure those improvements companies must know what to ask for.

3.     Prepare The CIO and Tech Team

A critical step in securing cyber insurance is the completion of an application, which will seek detailed information about the company's security policies, management of company records/data, and disaster planning. Once the application has been submitted, the underwriters may want direct access to the CIO or others responsible for protection of company information. Companies must understand that those individuals will play a key role in whether the insurer will agree to quote and/or how much will be charged to insure the risks. However, most CIOs and other “techies” are not familiar with the insurance procurement process and may not understand how information should be communicated to the insurer. In order to avoid missteps, companies should have a detailed planning meeting with those representatives and the insurance broker before information is relayed to the underwriter.

4.     Pay Careful Attention To Definitions

One of the reasons that cyber insurance is the most complex product available on the insurance market today is that coverage can be granted or lost through the policy's definitions. Further complicating matters, the definitions section of the cyber policy may include 40 or more defined terms. While tedious, and often headache inducing, it is critically important to read and understand all of the defined terms. It is equally important to think about where company information is stored, who has access to that information, and who is intended to be covered by the policy before the company starts the process of reviewing the definitions so that there is proper alignment with the risks presented and insured.

5.     Understand Sub-Limits

Insurers continue to grapple with which cyber risks they are willing to insure and, if so, to what level. For certain risks, the insurer may agree to provide coverage but only up to a sub-limit. By way of example, a policy may offer a $10 million limit for privacy breaches but it may cap the amount of coverage for regulatory fines/penalties flowing from such a breach at $500,000. This means the most the insurer will have to pay for the regulatory fines/penalties is $500,000 even if the company's loss for the breach far exceeds that amount but is less than the $10 million overall policy limit. Sub-limits included in the initial policy quote may be subject to negotiation. In some instances, an increased sub-limit may come with a higher premium quotation but the additional premium spend may be worth it in the long run.