Does a Small Business Need Cyber Insurance?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Cyber insurance helps pay the costs of a data breach or cyberattack, like investigating what happened, notifying customers, restoring data, and defending claims. The Federal Trade Commission (FTC) says to talk with your agent about whether you need first-party coverage, third-party coverage, or both. General liability policies often don’t cover these losses, so ask.

What this means

The FTC splits cyber coverage into two parts.

First-party coverage protects your own business. The FTC lists things like:

Legal advice on notice and regulatory duties
Recovering or replacing lost or stolen data
Customer notification and call center services
Lost income while your business is interrupted
Crisis management and public relations
Cyber extortion and fraud
Forensic investigation of the breach

Third-party coverage protects you when others make claims against you. The FTC lists payments to affected consumers, settlement costs, litigation and regulatory costs, and some defamation or copyright and trademark claims.

Made-up example: Summit Family Dental’s front desk computer gets ransomware. Patient files are locked, and the office can’t see appointments for three days. A cyber policy may help pay for the forensic team, data restoration, legal advice on notice rules, and lost income. Every policy is different, so check yours.

Why it matters

Size doesn’t protect you. Small businesses get attacked too.
Breach costs add up fast. Investigation, legal advice, and notices cost money even when no one sues.
Notice rules vary by state. States have their own breach notification laws, and some industries have federal rules too (see 11.6.6 Breach Notification).
Downtime costs sales. A locked-up booking system or hacked website means lost customers.
Your search presence can take a hit. A hacked site can carry a warning in Google Search until it’s fixed.

Who this applies to

Any business that keeps customer names, emails, phone numbers, payment details, health records, or account logins, or that depends on its website and email to get work. That’s most businesses. A business with very little data and no online sales has less exposure, but should still weigh what a hacked email or website would cost.

How to do it

Map the data you hold and where it lives (see 11.5 Data Map).
Put basic protections in place first. Turn on multi-factor authentication, keep software updated, and back up data (see 11.7.3 Multi-Factor Authentication and 11.8 Business Backups). Insurers often ask about these on the application.
Ask a licensed agent about first-party coverage, third-party coverage, or both.
Check the coverage list the FTC suggests. It says a policy should cover data breaches, attacks on data held by vendors, network breaches, attacks anywhere in the world, and terrorist acts.
Ask about “duty to defend.” The FTC suggests checking for this wording, which deals with defending you in lawsuits or investigations.
Ask if there’s a breach hotline that’s available every day of the year. The FTC suggests asking.
Answer the application truthfully. If you say you use multi-factor authentication and you don’t, a claim may be denied.
Save the insurer’s claim and hotline numbers in your emergency contacts (see 11.9.4 Data Breach Response).
Put the renewal date on your calendar (see 10.9.1 Financial Calendar).

What proof to keep

The policy, declarations page, and application you signed
Proof of the security steps you claimed on the application
The insurer’s breach hotline and claim instructions
Your data map and backup test records
Any incident reports and notices sent

Common mistakes

Assuming general liability covers a breach. It often doesn’t.
Overstating your security on the application. That can void coverage.
Calling your own computer person before the insurer. Many policies want you to use their approved response team. Call the hotline first if you can.
Ignoring vendor risk. Ask if attacks on your vendors’ systems are covered.
Paying a ransom without talking to the insurer and law enforcement.
No plan for who to call. Write the plan before you need it.

When to get help from a pro

A licensed agent or broker for the policy. An attorney for breach notice duties, which vary by state and industry. A computer security professional to set up protections. Questions to ask:

Does this policy include first-party and third-party coverage?
Must I use the insurer’s response team, and how do I reach them?
What security steps does the policy require, and what happens if I miss one?

Bill’s note

[Bill: add a short note. For example, a client whose website or Google account was hacked, how long it took to recover, and what it did to their calls and reviews.]

If you’d rather have this done for you, SiteSmarty handles website setup and Google Business Profile management.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: whether I bought cyber coverage for SiteSmarty and which parts]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the coverage summary and the saved hotline contact]
[Result so far:]

Questions people ask

What does cyber insurance cover? It depends on the policy. The FTC lists costs like breach investigation, customer notices, data recovery, lost income, extortion, and claims from people affected.

What’s the difference between first-party and third-party coverage? First-party pays your own costs. Third-party pays claims others make against you.

Does it cover a hacked website? Many policies cover recovery after a cyberattack, which can include a hacked website. Ask your agent to confirm.

Do I need it if I don’t take payments online? Maybe. Customer contact lists, email accounts, and your website can still be attacked.

Audit check

Question: Has the business decided, in writing, whether to carry cyber coverage based on the data it holds, and does any policy match what’s on the application?
Pass looks like: A written decision. If insured, a current policy with first-party and third-party terms understood, a saved hotline number, and security controls that match the application.
Fail looks like: No decision. A policy whose application claims controls that aren’t in place. No one knows who to call after an attack.
Evidence to collect: Policy and application, data map, proof of multi-factor authentication and backups, and the emergency contact list.

Where this fits

Do this first: 10.8.5 Property Insurance, 11.7.3 Multi-Factor Authentication

Do this next: 10.8.7 Tools and Equipment Insurance

Sources

Federal Trade Commission, "Cyber Insurance" (checked October 17, 2026)
Federal Trade Commission, "Data Breach Response: A Guide for Business" (checked October 17, 2026)
Google Search Help, "This site may be hacked message" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.