Pagoda Blog

A data breach or malware attack can result in huge financial losses, damage to your brand’s reputation, and legal repercussions if you deal with personally identifiable information protected by HIPAA. While prevention through a multi-layered cybersecurity strategy should be your top priority, cyber liability insurance can protect your business against some of these costs. 

 

Both small businesses with fewer than 100 employees and large corporations can benefit from cyber liability insurance. You can select a plan based on your size, the type of data you work with, and your company’s risk level. It’s important to note, however, that although most businesses could greatly benefit from cyber liability insurance, not everyone is eligible. 

 

Before you can invest in cyber liability insurance, your company will undergo a cyber insurance risk assessment. As a small business, you may be able to conduct a self-assessment whereas larger companies require an audit by a third-party. As with any insurance, the provider will only take on clients with an acceptable level of risk. This means your company must meet some basic IT security standards to even qualify. 

 

It’s important to note that in the event of a data breach or malware attack, your cyber liability insurance provider may conduct another audit to determine if your business is still meeting all required cybersecurity standards. Bottom line is that it’s critical for your business to always adhere to these requirements, both to prevent a breach and minimize the damage should a breach occur. 

 

Below are nine common cybersecurity standards your business needs to meet in order to qualify for cyber liability insurance coverage. 

 

1. All employees receive cybersecurity training 

Employees across departments should be receiving regular cybersecurity training. Any individual within your company should know how to recognize common types of cyberattacks, especially phishing attacks, and know how to respond to mitigate the risk. They should be aware of safe internet practices and company cybersecurity policies, such as MFA requirements, password best practices, and your BYOD policy.  

 

2. Company devices have up-to-date antivirus software 

All company devices, from desktops to smartphones, should have up-to-date antivirus software installed. Should a cybercriminal attempt to download a virus onto a company device, the software should detect, flag, and block the attempt. 

 

3. Regular software updates and security patches 

Regular software updates and security patches ensure that your devices are protected from any vulnerabilities identified by the developer. Without these in place, your devices are at a higher level of risk and could put any other devices on the network at risk. 

 

4. Company network is protected with a firewall 

A firewall provides a layer of defense between your internal network and incoming traffic from the internet and other external sources. Its primary purpose is to prevent cybercriminals and viruses from gaining access to your network.   

 

5. Regular backups with external media or a cloud service 

Regular backups are essential in the event of a data breach. They allow you to quickly regain access to any compromised data, minimizing your downtime, and giving you leverage should you be the victim of a ransomware attack. It’s always best to have an offsite backup in place that is isolated from your computer network. That way, should a cybercriminal access your network, your backup is safe. Learn more about four primary ways to backup your data here. 

 

6. Vulnerability scanning or assessments 

Your business should be conducting regular vulnerability scans or assessments to identify any weaknesses in your system. A scan takes inventory of all systems connected to your company network and logs whether the operating system is up to date, what user accounts are connected, open ports, and any other detected vulnerabilities.  

 

7. Strong access controls 

Most businesses have multiple accounts to manage and dozens of employees may have access to each account. It’s critical that each account has strong access controls enabled, limiting the amount of access each user has based on their role and responsibilities. A password management system like N-Able Passportal can help your business automate these controls, maximizing security, and ensuring when an employee leaves that their access is rescinded. 

 

8. Business accounts are secured with MFA 

Your accounts should never rely on a password alone for protection. Passwords are too often weak and reused across multiple accounts to be reliably secure. Instead, implement MFA across accounts to ensure that there’s a backup form of required identification in place. We recommend using a combination of something you are (biometrics) and something you have (preferably a form of authentication hardware).

 

9. Incident response plan 

An incident response plan documents your company's procedures should you experience a data breach or another cybersecurity threat. This plan should include who is notified and how in the case of a cybersecurity incident, what information to gather, and next steps. 

 

Cyber liability insurance can act as a highly effective shield against the short and long-term damage of a data breach. It can significantly reduce financial losses, damage to your reputation, and disruption to operations. Regardless of size, your business could benefit from this type of coverage if you handle any personally identifiable information. Just make sure you meet the requirements for coverage — remember, these requirements will not only ensure you qualify for insurance but they will reduce the risk of a data breach in the first place.      

 

Feature Photo by Sebastian Herrmann on Unsplash

 

Related reading: 

How a Cybercriminal Identifies Their Next Target

The Right Way to Notify Your Customers of a Data Breach

How to Set Up Passportal for Your Entire Team — And Secure Your Account Credentials 

 

Want to get more posts like these in your inbox? Sign up for the Pagoda newsletter and we’ll send you the occasional email with content that will sharpen your technical skills, from cybersecurity to digital marketing. 

 

Did you know we also have a weekly LinkedIn newsletter?

Make sure to subscribe for weekly actionable IT advice and tech tips to set your business up for success.

 

-------------------

 

About Pagoda Technologies IT services

Based in Santa Cruz, California, Pagoda Technologies provides trusted IT support to businesses and IT departments throughout Silicon Valley, the San Francisco Bay Area and across the globe. To learn how Pagoda Technologies can help your business, email us at support@pagoda-tech.com to schedule a complimentary IT consultation.