3-minute read
In today’s interconnected world, cybercrimes have been rising rapidly, posing significant challenges to businesses, governments, and individuals alike. No wonder cyber insurance has become increasingly essential for businesses of all sizes. In fact, we’d say it’s as critical as having a property or general liability policy for your business.
But not all cyber policies are created equal. More to the point, we’ve seen insurers include a number of cyber insurance policy exclusions recently, underscoring the folly of a one-size-fits-all approach.
Prior Knowledge Exclusion
One of the most common exclusions in cyber insurance policies is the prior knowledge exclusion. This provision typically states that coverage will not apply to incidents that were known or reasonably foreseeable by the insured prior to the policy's inception.
In other words, if your business was aware of a vulnerability or ongoing cyberattack before purchasing a policy, any claims arising from that issue may not be covered.
The only clear-cut way to avoid this exclusion is to disclose any known risks or incidents to your insurer before obtaining coverage.
Wear and Tear Exclusion
Wear and tear exclusions typically apply to physical components of a computer system, such as hardware or storage devices, which may fail over time.
Although these exclusions may not seem directly related to cyber incidents, a hardware failure could lead to data breaches or other cyber-related losses. Be sure to review your policy’s wear and tear exclusion to understand the limitations of your coverage and whether it’s necessary to obtain additional protection for your business’s physical assets.
Unencrypted Data Exclusion
Cyber insurers nowadays require businesses to implement reasonable security measures, including data encryption, to qualify for coverage. If your business experiences a data breach involving unencrypted data, your insurer may deny the claim based on this exclusion.
To minimize the risk of having your claim denied, ensure your business follows industry best practices for data encryption and other security measures.
War and Terrorism Exclusion
Cyber insurance policies typically exclude coverage for losses resulting from acts of war, terrorism, or other hostile actions.
While this exclusion may seem irrelevant to most businesses, it's important to remember that cyberattacks can be perpetrated by nation-states or terrorist organizations. So, if your business operates in a high-risk industry or region, consider discussing additional coverage options with your insurance broker to address these potential threats.
Contractual Liability Exclusion
Contractual liability exclusions may limit or exclude coverage for losses arising from your business's contractual obligations, such as indemnity clauses in contracts with vendors or clients.
As a result, if your business experiences a cyber incident that impacts a third party with whom you have a contractual relationship, you may not be covered for the resulting damages.
Again, review your policy’s contractual liability exclusion carefully and consider negotiating more favorable terms with your insurer or obtaining additional coverage to address this risk.
Understanding cyber insurance policy exclusions is crucial for businesses seeking to protect themselves from potential cyber threats. By being aware of these exclusions, you can work with your insurance broker to tailor a policy that meets your unique needs and provides comprehensive coverage. Remember to regularly review and update your cyber insurance policy to ensure it remains current with evolving risks and industry best practices.
The Mahoney Group, based in Mesa, Ariz., is one of the largest independent insurance and employee benefits brokerages in the U.S. An employee-owned organization, we’ve been providing our clients with the confidence to face whatever lies ahead for more than 100 years. For more information, contact us online or call 877-440-3304.
This article is not intended to be exhaustive, nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel or an insurance professional for appropriate advice.