Practical buying guidanceTest recovery assumptions before choosing a limit
Map the systems needed to invoice, manufacture, serve customers and pay staff. Explain which systems are hosted elsewhere and which backups can be restored without relying on the affected network. A backup that exists but has not been tested does not establish a realistic recovery time.
Separate IT recovery, business interruption, data liability and payment fraud. Each can have different triggers, sub-limits and conditions. In particular, a business voluntarily authorising a fraudulent payment may be treated differently from theft through a compromised system.
Describe existing controls honestly and ask how the policy expects incidents to be reported. Keep the response number and policy details available offline. Cover is subject to the wording, exclusions, conditions and insurer acceptance.
Compare the wording, not just the premium
Check waiting periods, outsourced-system cover, response-provider arrangements, crime exclusions and security conditions alongside the headline limit.
A practical risk example
A compromised mailbox redirects a supplier payment while the firm's invoicing system is unavailable. Payment fraud and cyber interruption can have different triggers and conditions. Discuss verification controls, restoration tests and the insurer's incident-response procedure.
This is an illustrative scenario, not confirmation of cover. Insurer underwriting, terms, conditions, limits and exclusions determine the response.
For more detail, read Cyber insurance for growing businesses: what the policy is really there to do, Machinery breakdown and business interruption: mapping a manufacturer's recovery and Tanning salon liability: staff, products and customer procedures to discuss.
