A cyber liability policy can provide a much-needed tactical and financial support defense for companies confronted with a cyber incident. But in order to even begin the process of exploring your insurance options you will need to have a fairly robust cybersecurity program in place. 

Most carriers will ask you the following questions about your program. We recommend using this as a guide to create a new – or optimize an existing – cybersecurity program:

• A written, attorney-approved and updated policies and procedures document about the handling of information within your company

• A general description and hierarchy of the volume and types of data (i.e., credit card data, banking records, protected health information) handled or maintained by your company

• If you are compliant with security standards and regulations, you should be able to address how often the frequency of assessments are performed and what the past results have been

• The existing network security programs, including the use of firewalls, antivirus software, and network intrusion testing

• Professional background and qualifications of your chief information officer or chief technology officer

• History of security incidents and breaches, including how long it took to detect any prior breach

• Prior threats to disable the company’s network or website, and how they were handled

• Awareness of facts or circumstances that reasonably could give rise to a claim under a prospective cyber policy

• The company’s security budget (is it part of the IT budget and, if so, what percentage?)

• Practices concerning data encryption, passwords, patching and system access control

• Employee hiring and training practices, and procedures around termination

• Information regarding physical security controls (e.g., access cards) that are in place

• Audits of third-party service providers

• Info regarding your vendor management program

• Policies governing mobile devices and social media

• Data backup procedures and frequency of how often they are performed

While there is not fool proof method to be 100% safeguarded from a network breach, taking steps to set-up the items above, and ultimately be able to answer the questions, will go a long way in protecting your company’s exposure in the event of a cybersecurity-related event.