First-party vs. third-party cyber insurance

A data breach occurs when an unauthorized party gains access to digital assets on a business’s network, hardware, software, or mobile devices. A data breach puts you at risk for insider trading, fraud, cyberextortion, and other criminal activities.

You may have more digital assets than you realize. A company’s digital assets can include but are not limited to:

• Intellectual property
• Employee records
• Customer data, such as credit card information or Social Security numbers
• Financial statements
• Media files

Typical causes of a data breach include:

• Phishing scams
• Malware attacks
• Improper IT security practices
• Hardware or software malfunctions
• Cyberattacks from inside an organization

Any business that stores information can fall victim to a data breach. Companies that store sensitive data such as credit card information are more likely to be targeted by cybercriminals and also have more to lose.

A first-party cyber liability insurance policy covers:

• Notifying customers that their personal information was exposed
• Purchasing credit monitoring services for affected customers
• Investigating the source of the data breach
• Launching a public relations campaign to help restore a company’s reputation after a data breach
• Reimbursing a company for business interruption and revenue lost while handling the data breach
• Paying ransom to a cyberextortionist who is holding data hostage

Third-party cyber liability insurance protects your business when a data breach occurs on a third party's network or systems.

When major companies file data breach lawsuits, they typically name every party that worked on the compromised system, including independent contractors and freelancers. Even if you touched just a small part of a project and never had direct contact with the company, you could still face a lawsuit.

If a client sues you over such an incident, third-party insurance will help cover attorney's fees, court costs, and damages.

Examples of events that might prompt a lawsuit include:

• Allowing an email virus to infiltrate a client’s network via a security hole
• Failing to patch a server vulnerability that allows hackers to access a client’s confidential information
• Using weak passwords on a client's system that made it easier for cybercriminals to access company data
• Recommending an insecure service to a client

Most insurance providers include both first-party and third-party cyber liability insurance in errors and omissions insurance (E&O) policies for tech businesses.

This kind of E&O insurance – called tech E&O insurance – will protect your technology business from lawsuits over data breaches, professional mistakes, incomplete work, and missed deadlines.

Employing vigilant cybersecurity practices and protecting yourself with insurance are the two best data breach risk management strategies.

You can also include clauses in contracts to help minimize your liability. An attorney can help you draft separate contracts for specific projects.

Examples of ways you might protect yourself include:

• Limiting product or service warranty times
• Limiting the types of damages for which you are liable
• Limiting the amount of money for which you are liable
• Holding the original software or hardware manufacturer liable for product defects

However, if you're working with a large client that has more leverage than your small business, your proposed liability limitations might not make the final draft.

TechInsurance helps tech and other small business owners compare business insurance quotes with one easy online application. Start an application today to find the right policy at the most affordable price for your business.