Cyber insurance.

A contractor would carry cyber insurance for the same reason an office would: the money and the customer list both live in the inbox. A plumbing shop pays suppliers by wire, runs dispatch and invoicing in the cloud, and keeps customer names, addresses, and card details in a phone app. A spoofed supplier email that changes the bank details on one invoice can cost more than a van. Ransomware on the scheduling system stops the routes on a Monday. What changes the answer is how much money moves through email and how many customers are in the system, so we ask about both before sizing the policy.

A fake invoice you paid can be covered, under the part of the policy called funds transfer fraud or social engineering. It responds when someone impersonates a supplier or a manager and your own staff sends the money in good faith. A bookkeeper who pays a spoofed invoice with new bank details is the textbook case. This coverage almost always carries a sublimit lower than the rest of the policy, and some carriers leave it off unless asked. What changes the answer is that sublimit and whether the policy includes it at all, which is why we ask for the number before you bind rather than after the wire.

Ransomware is covered by most cyber policies, and it is the loss carriers think about most. The policy pays for the response team, the forensics, the recovery of systems and data, and the days the business could not operate while the scheduling and invoicing were locked. Where the law allows and the carrier agrees, it can also cover a negotiated payment. What changes the answer is your backups and whether multi-factor authentication is on email and remote access, since carriers price on both and some will not quote without them. A tested offline backup turns a bad month into a bad day.

What carriers require before they quote a cyber policy is a short list of controls, and most will not move without them. Multi-factor authentication on email and any remote access is first. Backups that are kept offline or tested come next. Many also ask about endpoint protection, how you verify a change to a vendor’s bank details, and whether anyone has had an incident before. A shop that turns on MFA the week before applying usually qualifies. What changes the answer is the carrier and the size of the business, so we check the controls with you before the application goes in, not after a decline.

Your general liability policy generally covers none of this. GL responds to bodily injury and property damage to other people, and most forms now exclude data breaches, electronic data, and loss of money outright. A customer whose card details leaked from your app is not injured in the way GL means, and a wire you sent to a thief is not property damage. Some business owner’s policies add a small cyber endorsement, usually with a modest limit. What changes the answer is that endorsement, because a shop that relies on it should read the limit, and a firm that handles real money is better served by a standalone cyber policy.

The day something goes wrong, you call one number and the carrier’s response team takes over. The policy includes a breach coach, a lawyer who runs the response, plus forensics to find out what happened and how far it went. If money moved, the bank is notified the same day. If customer data is out, the team handles the notifications and credit monitoring the state rules require. Your broker is on the same call and stays on it. What changes the answer is how fast you call, because the notification clock starts at discovery and the recovery is cheaper the earlier the team is engaged.