2. Determine the financial resources available for an effective breach response. The Ponemon Institute recently reported in 2011 that cyber crimes cost organizations between $1.5 million and $36.5 million per data breach. Before investing in cyber insurance, organizations should determine if they have the finances to cover network downtime, legal fees, forensics investigation, breach notification services, identity monitoring and recovery services, regulatory fines and penalties and expenses stemming from a class-action lawsuit.

3. Understand a company's current insurance coverage. Most organizations hold general liability insurance that provides coverage for tangible property only, such as replacing stolen laptops. However, the liability policy may not cover the cost of a hacker intrusion that results in the breach of customer data. Traditional policies also do not explicitly cover first-party breach notification costs. These gaps could leave an organization responsible for the full cost of a data breach response. Cyber insurance can be used to help cover those costs.

4. Evaluate policy options carefully. Cyber insurance typically provides coverage for liability for data breaches, remediation costs to respond to the breach, and regulatory and legal fines and penalties. However the limitations on the coverage can vary widely based on the carrier, the type of industry and a company's risk profile. The terms of a cyber insurance policy may restrict the way an organization responds to a data breach. For instance, it may cover credit monitoring services for a breach of protected health information (PHI), which is not useful to monitor a patient's medical identity. Common coverage limitations include:

• Third-party/contractor breaches
• Offline or non-technical breaches, or so-called “paper” breaches
• Breaches from lost devices, including laptops, flash drives, tablets, and mobile phones
• Choice of vendors to respond to a breach, including legal counsel and data breach service providers
• Types of monitoring services for the breached population, such as credit monitoring vs. medical identity monitoring

5. Perform a risk assessment. Performing a comprehensive privacy and security risk assessment can help an organization identify, evaluate and mitigate gaps in its security and privacy program. Lessening those gaps can reduce breach risks and lower exposure if a breach does occur. Having a third party-documented risk assessment on file can help speed up the underwriting process and may even lower insurance premiums.

6. Find a knowledgeable broker. A broker who understands cyber insurance can break down and compare the offerings from different insurance providers. They often offer value-added services that can help identify and mitigate breach risks, as well as validate the need for a policy.

7. Take advantage of value-added services offered. Some insurance brokers and carriers offer complimentary value-added services to help reduce breach-related risks: free consulting or legal advice from industry experts, access to a proprietary portal with privacy and security resources, educational webinars, and policy templates. When weighing policy choices, organizations should evaluate these services as part of the overall offering. As a plus, these offerings may help improve a company's risk profile and and lower its insurance premium.

8. Get preferred vendors approved before the policy is finalized. Cyber insurance policies may require companies to use pre-approved vendors instead of their own service providers, such as legal counsel, when responding to a data breach. Such limitations can impact the quality of a response, for instance, the use of an out-of-the-country call center to manage the breach of sensitive medical data. We recommend companies negotiate the right to use favored vendors or select their own vendors before the contract is finalized.

9. Understand how to integrate insurance claims process with internal breach response. A cyber insurance policy could change the way an organization internally manages data breach incidents. Post binding the policy, companies should understand how and when to involve their carrier if a data breach occurs. This may include updating any documented procedures, such as an incident response plan (IRP) with new roles and responsibilities, revised timeline and current contact information.

10. Avoid common pitfalls with an insurance carrier. This most often happens when the insured does not fully understand the policy, causing a dispute on coverage. For example, the carrier may mandate the use of its pre-approved vendors, while an organization may prefer to use its internal resources or favored vendors. It's best to resolve these conflicts before binding the policy.

Evaluating the need for cyber coverage is not a one-person job. Companies should discuss their data breach risks and risk management options cross-functionally, involving leaders from IT, risk management, privacy, compliance and legal departments. Working together, executives can more accurately quantify risks, evaluate options and develop a cost-benefit analysis to determine if cyber insurance is the right investment for their needs.

Read related: “What's Driving the Rise in Data Breaches?”

Read related: “Healthcare Data Breaches: Handle With Care.”