Cyber insurance keeps turning up as a requirement: in grant agreements, in contracts, sometimes in the fine print of a lease. Plenty of nonprofits buy it, file the policy, and never look at it again.
There’s one part of that paperwork worth pulling back out.
What the application asks
When you applied, the insurer asked what security controls you have in place. The questions usually cover things like:
- Multifactor authentication, and which accounts it’s on
- Backups, and whether you test them
- What happens to accounts when people leave
- Security training for staff
- Whether you have an incident response plan
Those questions aren’t a formality. Your answers are the basis the insurer used to price and issue the policy.
Why the answers matter so much
If the answers turn out to be inaccurate, a carrier can seek to void the policy from the start. Not deny a single claim, but treat the whole policy as though it had never been issued.
That’s a contract argument rather than a claims argument, and it doesn’t necessarily depend on whether the inaccurate answer had anything to do with the loss. An application that said “MFA on all accounts” when it was really on most of them can become a problem after an incident unrelated to MFA.
A free gap assessment
Which means you have a free gap assessment sitting in a filing cabinet. Pull out the application you signed, read it line by line, and check whether every answer is still true today.
Each one that isn’t is something to fix or discuss with your broker. Either way, you would much rather find it now than after an incident.
Two more things worth checking
Your D&O policy almost certainly doesn’t cover this. Directors and officers insurance and cyber insurance are different products. Many boards assume one covers the other.
Payment fraud is often a separate rider. Social engineering and funds transfer fraud, including the redirected-payment scenario from earlier this month, are often excluded from a base cyber policy and sold as an add-on. If that’s the risk that worries you most, confirm you actually bought that coverage.
Questions to ask your broker
- What does our policy require us to have in place, and are we meeting it?
- Does it cover social engineering and funds transfer fraud, and up to what limit?
- What do we need to do, and how quickly, if we have an incident?
- Does the policy include incident response help, such as a hotline or approved vendors?
Asking costs nothing, and a good broker will be glad you did.
The governance piece
The board should review the cyber coverage, limits, and exclusions once a year. This is organizational risk, not an IT line item, and it belongs on the same agenda as the rest of the organization’s insurance.
None of this is insurance or legal advice. Your broker can tell you what your policy actually requires.
This week’s action
Find the application you signed, and check that every answer is still true.
That closes the series. Tomorrow: the whole month in one place.