Guide to business cyber insurance for CFOs

If you're a chief financial officer, or CFO, your responsibilities continue to expand. Once centered on financial planning and risk management, your role now often includes cybersecurity, with 43% of CFOs ranking it as a new and significant responsibility.

While this shift may seem surprising, cyber risk increasingly carries direct financial consequences—from revenue loss and operational disruption to regulatory and reputational exposure. Until companies are large enough to hire a dedicated chief information security officer, cybersecurity often stays with the CFO—typically with support from a managed service provider.

Why it's a C-suite priority

As cyber threats become more sophisticated, understanding the nuances of business cyber insurance is a critical component of a sound financial strategy. This guide provides a comprehensive overview to help you protect your company's assets, manage liability and make informed decisions about your coverage needs in the year ahead.

Cyberattacks aren't just an IT problem—they're a significant financial risk. A single incident can lead to devastating consequences, including lost revenue, regulatory fines and reputational damage. IBM's latest Cost of a Data Breach report calculated the average loss from a security incident at $4.44 million. For CFOs, this translates to a direct impact on the balance sheet.

The rising frequency and severity of attacks, particularly ransomware, have driven more organizations to seek business cyber insurance as a risk transfer strategy. However, this increased demand has also led to a more challenging insurance market. Carriers are implementing stricter underwriting requirements, and premiums are on the rise. This makes it more important than ever for you to proactively manage your company's cyber risk profile.

What should a CFO look for in a cyber liability insurance policy?

Not all cyber insurance policies are created equal. As the financial steward of your organization, you need to ensure your coverage is comprehensive and tailored to your specific risks. A robust cyber liability insurance policy typically includes two main types of coverage—first-party and third-party.

First-party coverage

This protects your business from direct financial losses resulting from a cyber incident. Key components to look for include:

• Incident response: Cost for forensic services to investigate a breach, legal counsel to determine regulatory obligations and crisis management
• Business interruption: Cost of coverage for lost income resulting from network downtime or digital theft
• Data recovery: Costs associated with restoring or replacing lost or stolen data
• Cyber extortion: Cost of payments made in response to ransomware or other extortion threats

Third-party coverage

This protects you from liability if a third party brings a claim against you following a security breach. Essential elements include:

• Liability and defense: Costs of legal defense, settlements and judgments if your business is accused of causing damages from a network breach
• Regulatory fines and penalties: Costs of fines related to the cyber incident, such as those for noncompliance with data protection laws
• Customer notification: Costs for notifying affected customers and providing services like credit monitoring

Language matters when reviewing cyber liability insurance policy options. Pay close attention to the definitions, exclusions and sublimits. For example, ensure that the definition of a computer system extends to your cloud providers and other third-party vendors where you store data.

What are the cyber security insurance requirements?

Securing the right cyber risk insurance coverage requires preparation. Insurers want to see that you have a strong security program in place. The application process can be lengthy, with questionnaires ranging from a few pages to more than 70 questions. It's a good idea to begin this process at least 4 to 6 months before you need the coverage.

Here are seven key requirements insurers look for.

• Multi-factor authentication, or MFA: MFA for remote access, email and privileged user accounts is implemented—a baseline requirement for most carriers.
• Endpoint detection and response, or EDR: EDR solutions are in place to monitor endpoints for malicious activity.
• Regular backups: Encrypted backups of critical data are maintained and regularly tested offline.
• Employee training: Ongoing security awareness training is regularly conducted to cultivate a cyber-aware culture.
• Incident response plan: A well-defined and tested plan outlines procedures for detecting, containing and resolving security incidents.
• Vulnerability management: Proactive scans are conducted to identify system weaknesses, and patches are applied promptly.
• Privileged access management: Access to your company's most critical infrastructure is controlled and monitored.

Failing to meet these requirements can lead to denied claims. According to one report, nearly 40% of cyber insurance claims are denied (PDF) because businesses didn't have the security controls they attested to in their application.

How can CFOs and CISOs manage cyber risk insurance coverage?

An effective cyber insurance strategy depends on a strong partnership between you and your chief information security officer, or CISO. This collaboration brings together the CISO's technical expertise with your focus on financial impact.

Your CISO can translate technical risks into potential financial losses, helping you model different scenarios and quantify your organization's cyber risk. This data-driven approach is crucial for determining the appropriate level of coverage. Instead of guessing, you can use analytics, historical claims examples and industry reports to make an informed decision.

Regular meetings through a risk steering committee can keep you informed about the company's security posture and upcoming needs. This ensures that the first time you, the CISO and general counsel meet isn't an hour before the insurance broker arrives. This ongoing dialogue helps you understand what security improvements are needed to secure better coverage and pricing, and it allows you to budget for these initiatives accordingly.

The bottom line

The world of business cyber insurance is complex, but you don't have to navigate it alone. As financial threats evolve, having the right partners is essential to protect your treasury operations and overall financial health.

Through our collaboration with Coalition and many other leading carriers that offer active cyber insurance solutions, we can help you stay ahead of digital risks. This partnership combines proactive cyber risk prevention with robust fraud protection, providing a comprehensive strategy to safeguard your company's assets and reputation.

To learn more about how cybersecurity might benefit your business, connect with a First Citizens Insurance Services commercial risk advisor today.