The level of cyber cover to consider may depend on your contracts, data, revenue, downtime exposure and the cost of recovering from a serious event. No single cyber limit suits every business. A business can start with any minimum its contracts set, then estimate what one serious incident could cost it.
Cyber insurance is designed to cover costs after a data breach or cyber attack. First-party costs may include incident response, forensics, notifying affected people and data recovery.
Third party cover may respond to claims from customers or regulators. Cyber cover is subject to the policy terms, conditions and exclusions.
A cyber insurance limit, also called the specified limit, is shown on your policy schedule. upcover's glossary defines a policy limit as "the maximum amount payable under a policy for a covered loss". A sub-limit is "a maximum amount the insurance company will pay for a specific type of loss, which is within the overall policy limit".
Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.
Key takeaways
- A contract minimum may set the starting point, and a business's own exposure may sit above it.
- Records, downtime, scam payments and client claims are exposures a business can estimate one at a time.
- Each section of a cyber policy may carry its own sub-limit, set out in the policy wording.
How can a business calculate a cyber insurance limit?
A business can work out a cyber limit by estimating each exposure in turn, from contract minimums to records, downtime, scam payments and client claims.
| Question |
What to calculate or check |
| Does a contract, tender or platform agreement set a minimum? |
The highest contractual minimum, overall and for any section the contract names |
| How many customer and employee records do you hold? |
Data breach response costs, such as forensics, legal advice and notification |
| How long could you trade without your systems, email or website? |
Lost revenue and fixed costs, and any waiting period before the
business interruption
section of a cyber insurance policy may respond
|
| Could a scam email redirect a payment? |
Funds transfer fraud, social engineering and business email compromise (BEC) exposure, such as the size of payments you approve |
| Do you hold data or run systems for clients or customers? |
Claims clients or customers may bring if an incident affects their data, systems or operations |
| Which sections of the cyber policy carry their own sub-limit? |
Any sub-limit for ransomware and cyber extortion, funds transfer fraud, business interruption or claims from regulators |
| Do you have overseas clients, staff or data? |
The territory and jurisdiction terms in the policy wording |
Swipe left or right to see the full table.
If your contracts set no minimum, those answers become the starting point. An upcover team member or an insurance broker can talk through how they compare with available limits. upcover's cyber cost guide lists the specified limit among the factors that may affect the cost.
How much cyber insurance do I need if a contract sets a minimum?
The highest contractual requirement is usually the minimum your policy may need to satisfy. Your actual exposure may still be higher.
Clients, suppliers or contracts may "ask for proof of cyber cover before you start or renew work", according to upcover.
A contract may also set a minimum for one section, which a sub-limit in the policy wording may or may not meet. upcover's enterprise requirements guide explains what enterprise customers may ask vendors to hold.
How do cyber insurance sub-limits work?
Cyber insurance sub-limits sit inside the overall policy limit. Each one is the most the insurer may pay for one type of loss, subject to the policy terms.
upcover's business email compromise guide explains how some policies treat scam payments, including lower sub-limits or payment verification conditions.
How sub-limits apply varies between policy wordings, so always check with your insurance broker or the team at upcover.
What does cyber insurance commonly exclude at any limit?
Cyber policies commonly exclude some losses whatever limit you choose, as set out in the policy wording.
Exclusions commonly include, but are not limited to:
- outages at third party utilities or telecoms providers, unless the provider's own security failure directly caused them
- dishonest or fraudulent acts by, or known by, a senior executive
- incidents a senior executive knew about, or could reasonably foresee, before cover started
Important: This list is not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you, and if you have questions you should speak to your insurance broker or the upcover team.
upcover's small business cyber guide explains what a cyber policy may cover and commonly excludes.
When should a cyber limit change as a business grows?
A business may review its cyber limit when its revenue, records, customers or contracts change, and before each renewal.
Questions to ask when reviewing a cyber limit include:
- When was the last time I reviewed my insurance?
- Has my business or activities changed including revenue, employees, activities or customers?
- Have my requirements for licensing or contractual requirements increased or been reduced?
If you take on a contract with a higher minimum, the limit shown on your schedule may no longer meet it. upcover's cyber requirements guide explains the security controls insurers may ask about before offering or renewing cover.
How upcover can help
upcover arranges cyber insurance for Australian businesses. upcover works with 80+ insurance partners and can arrange quotes from a range of insurers.
- 70,000+ businesses covered across Australia
- 4.9/5 customer rating
- 80+ insurance partners
Get a cyber insurance quote.
Frequently asked questions
How much cyber insurance do I need as a small business?
How much cyber cover a small business considers may turn on factors including contract minimums, records held and how long it could trade offline. An upcover team member or an insurance broker can talk through those factors with you.
Is $1 million of cyber insurance enough?
Whether any cyber limit is enough depends on factors including contract minimums, the sub-limits inside it and what one serious incident could cost the business. An upcover team member or an insurance broker can help you weigh those factors.
Does a cyber insurance limit apply per claim or in the aggregate?
A cyber policy's limit may apply per claim, in the aggregate or both, depending on the policy wording. upcover's glossary defines an aggregate limit as "the total ceiling on what the insurer will pay across multiple claims in a policy period".
Does a cyber policy's limit apply to overseas clients?
Territory and jurisdiction terms in a cyber policy wording may affect claims involving overseas clients. upcover's US customers guide explains territorial and jurisdictional limits.
How does business interruption affect a cyber limit?
The business interruption section of a cyber insurance policy may have its own sub-limit inside the overall policy limit, depending on the policy wording.
Written by upcover's editorial team.
This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice: get legal advice about the insurance terms in your contracts, tenders and platform agreements. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.
.svg){kind=logo}
.svg)
.svg)
.svg)
%201.svg){kind=icon}
.svg)
.svg)
