Itwerx has run IT and cybersecurity for Seattle-area businesses since 2005. This is about the gap between holding a cyber policy and being able to get back to work, and why the second does not follow from the first.
The comparison that does not hold
A major cyber security event, a data loss or a ransomware incident, is not like a fire or a car accident. When an office burns down or a vehicle is totaled, a business can rent replacement space or a replacement vehicle and keep operating while the claim is processed. There is no equivalent for a compromised company’s data and systems – there is nothing to rent that puts the business back where it was.
What a policy actually pays for
Assume the direct loss of revenue is covered, and assume the carrier does not find a reason in the fine print to avoid paying the claim. Even then, a policy is written against direct loss. It is not written against everything a breach actually costs.
What it does not pay for
Three kinds of damage fall outside a typical policy and outside most owners’ mental model of what “covered” means. Vendor relationships suffer when accounts are inaccessible and payments cannot go out. Cash flow suffers for the same reason in reverse – invoicing and collecting from customers gets difficult exactly when the business can least absorb it. And customer relationships suffer regardless of loyalty: a customer who loves the business will still be forced to use a competitor if the business cannot deliver during the outage, and some of that business does not come back.
The preparation that makes the policy work
The right posture is to assume a major event will happen and to have the technology and the response plan in place ahead of time, so the impact on operations is minimized regardless of how the incident unfolds. Prepared that way, a cyber insurance policy works as intended – it covers the direct loss while the business’s own preparation limits everything the policy was never going to cover. Without that preparation, the policy is worth little more than the paper it is printed on, because the damage that actually ends companies happens in the parts of the loss no policy insures.
Itwerx Corp is a service-disabled veteran-owned small business providing IT services across Seattle, Bellevue, Everett and Snohomish County. This is the kind of thing our cybersecurity work deals with – talk to us about yours.
