That said, many insurers have taken steps to exclude cyber-related risks under traditional policies and are vigorously fighting cyber claims under these non-cyber forms. Although some businesses have successfully recovered for cyber claims under such policies, relying on them for comprehensive cyber coverage is risky.

It's important to note, however, that express cyber coverage may be included by endorsement to a traditional policy. Because redundancies in coverage can create coverage issues in the event of a claim, companies should take steps to identify any such coverages before buying a cyber policy and reconcile their existing coverage with the cyber form.

Step 3: Applying for cyber coverage

Although there is no standard application for cyber insurance, insurers usually ask for similar types of information from the prospective insured. Insurers will inquire as to the company's policies and practices around cybersecurity, data handling, usage, and storage, vendor management and privacy. Companies likely will have to involve a number of stakeholders, including outside service providers, when responding to application questions.

Related: Getting cyber insurance is a complex process, experts warn

Care should be taken to accurately complete the application, which will become part of the policy if one is issued. It's critically important to seek clarification before responding to any ambiguous or unclear questions.

Applications may require the signature of the company's president, CEO and/or CIO, who must attest to the accuracy of the company's responses. Inaccurate information provided in the application may jeopardize coverage if a claim is later tendered under the policy.

Step 4: Finding the right cover in today's dynamic cyber insurance market

Next, companies should find a policy that covers the risks identified in Step 1. But because there is no standard cyber insurance policy form — and all policies are not created equal — care must be taken to carefully review the terms of any prospective policy to make sure it's a good fit for the company's needs.

Additional factors to consider include the insurer's reputation for handling and paying claims and whether it provides free or discounted cyber risk mitigation services (such as risk assessments, training, and incident response training). Purchasing decisions made strictly on price may ultimately prove to be much more costly.

Although today's dynamic cyber insurance market creates challenges for insurance buyers, it also provides an opportunity to negotiate for better policy terms and coverage tailored to the company's unique cyber needs. Companies should exercise their leverage during the insurance buying process to get the best possible coverage.

Step 5: Post-coverage considerations

Once coverage is in place, the insured should take steps to understand and operationalize the various requirements and policy conditions with which it must comply. For example, the policy may require the insured to get the insurer's prior written consent before paying a ransomware demand or hiring a consultant after a data breach. The processes mandated by the policy in the event of a claim also must be understood.

In addition, it's a good practice to periodically monitor and evaluate coverage in light of evolving business needs, such as merger and acquisition activity. The insured also should keep an eye on the changing cyber threat landscape to ensure that its coverage remains adequate. New coverages offered by insurers also should be monitored.

Related: Navigating the cyber insurance maze: Inside the obligations and caveats

Judy Selby, JD, is a principal of Judy Selby Consulting LLC and a senior advisor at Hanover Stone Partners LLC. She can be reached at [email protected].