A Raleigh accounting office opens its laptops on a Monday and finds every file locked with a ransom note. A Cary contractor's bookkeeper gets an email that looks like it's from a regular supplier, with new bank details, and pays the invoice. A Durham medical billing company learns that a former employee's password was used to download client records. None of these businesses is a big target in the headlines sense, and that's the point: small businesses rely on email, cloud software and customer data just as much as large ones, often with fewer defenses.
This guide explains what cyber liability insurance is, what North Carolina's breach notice law asks of businesses, where traditional policies leave gaps, and how to get ready for a quote. It's general information, not legal advice, a quote or a description of any specific policy.
What cyber liability insurance is
Cyber insurance is a policy built for incidents involving your computer systems and the data you hold. Most policies are split into two broad parts.
First-party coverage pays your own costs after an incident, which may include:
- Forensic investigators to figure out what happened and how far it spread
- Restoring or recreating data and software
- Legal advice on your notification obligations, often called breach counsel
- Notifying affected customers and offering credit monitoring or identity restoration
- Ransomware response, including negotiation and, where lawful and covered, the payment itself
- Lost income and extra expenses while your systems are down
- Public relations help to manage the fallout with customers
Third-party coverage responds when others make claims against you, such as:
- Customers or clients whose personal information was exposed
- Business partners who say a virus or breach spread from your systems to theirs
- Regulatory investigations, and fines or penalties where the law allows them to be insured
- Claims tied to the content of your website or social media, on some policies
Every insurance company builds its form differently. Two policies with the same overall limit can have very different sublimits for ransomware, business interruption or fraud, so the details matter more than the headline number.
North Carolina's data breach notice law
North Carolina's Identity Theft Protection Act includes a breach notice requirement in G.S. 75-65. In plain terms:
- A business that owns or licenses personal information of North Carolina residents must notify affected people after discovering a security breach, without unreasonable delay. The law applies to information in any form, including paper records.
- If you notify residents, you must also notify the Consumer Protection Division of the North Carolina Attorney General's Office, including the nature of the breach and how many people were affected.
- If you notify more than 1,000 people at one time, you must also notify the nationwide consumer reporting agencies.
- A business that holds data it doesn't own, such as a vendor or service provider, must notify the owner of that data immediately after discovering a breach.
"Personal information" is defined in G.S. 75-61 and generally means a person's name combined with identifiers like a Social Security number, driver's license number, or financial account or card numbers. If your customers live in other states, their states' laws may apply too.
Notification takes time, legal guidance and money, and it usually has to happen while you're also trying to get back to work. That's a big part of why breach response coverage exists.
Why your other policies may not respond
Many Raleigh business owners assume their existing coverage handles cyber problems. Often it doesn't:
- General liability is designed for bodily injury and property damage. Many forms exclude or limit claims arising from the access or disclosure of personal information and from electronic data.
- A business owner's policy may offer a small cyber or data breach endorsement. It can be a useful start, but the limit is often modest compared with a full incident.
- Commercial property generally covers physical things. Corrupted data and a network outage without physical damage typically fall outside it.
- Crime insurance may cover employee theft or certain fraudulent transfers, but each policy treats tricked-employee scams differently.
- Errors and omissions covers mistakes in your professional services. Some tech E&O policies include cyber, but many professional liability policies don't.
The way to know for sure is to read the exclusions and endorsements, or have an agent compare them side by side.
Wire fraud and fake invoices
Payment scams deserve their own mention because they hit small businesses so often. A criminal gets into an email account, or spoofs one, and asks for a wire or ACH payment to a new account. Real estate closings, contractor draws and vendor invoices are common targets.
Coverage for this is usually called social engineering, funds transfer fraud or invoice manipulation coverage. It may come as part of a cyber policy, as an add-on, or under a crime policy, often with a smaller sublimit than the rest of the policy. Many policies also expect you to verify payment changes through a known phone number before sending money. Build that habit whether or not you buy the coverage.
Who should consider cyber coverage
You don't need to be a tech company. Consider cyber coverage seriously if your business:
- Stores customer or patient records with Social Security, driver's license or account numbers
- Takes card payments or keeps client financial information
- Moves money by email instruction, such as title, real estate, construction and property management firms
- Depends on scheduling, billing or practice management software to operate
- Has contracts that require you to carry cyber coverage, which is increasingly common with larger clients and government work around the Triangle
Medical and dental offices, accountants, law firms, insurance and financial firms, retailers, gyms with membership billing, and contractors handling large payments all fit at least one of these.
What insurance companies look at
Cyber underwriting has become more detailed over the past several years. Expect questions such as:
- Do you require multi-factor authentication for email, remote access and admin accounts?
- Do you back up important data regularly, and are backups kept separate or offline so ransomware can't reach them?
- Do you use endpoint detection or antivirus on every device, and keep software patched?
- Do employees get phishing and payment-verification training?
- Do you have an incident response plan, even a simple one?
- How many personal records do you hold, and what kind?
- Have you had any incidents or claims?
Good answers can affect whether coverage is offered and on what terms. Free resources like the CISA guidance for small businesses are a practical place to start if you're tightening things up.
What to have ready for a cyber quote
- Business name, industry, annual revenue and number of employees
- A rough count of customer, patient or employee records you store, and what's in them
- How you take payments and who handles wires or ACH changes
- Your IT setup: email provider, key software, backups and who manages security
- Any current cyber endorsements on your BOP or other policies
- Contract requirements from clients, landlords or lenders
- Any past incidents, even ones that didn't lead to a claim
Talk with a Raleigh independent agency
Shadow Lake Insurance is an independent agency, so we can compare cyber coverage from the insurance companies we represent and walk you through the sublimits, exclusions and conditions that make one policy different from another. We can also look at how cyber fits with your general liability, crime and property coverage so there are fewer gaps. If you're building out a full program, start with our guide to essential business insurance for Raleigh companies. We work with businesses in Raleigh, Cary, Durham, Morrisville and across the Triangle.
Shadow Lake Insurance 8398 Six Forks Road, Suite 202, Raleigh, NC 27615 (276) 597-9844
Ready to compare? Start a cyber liability quote or request a quote, or call or text our office.
Sources
- North Carolina General Statutes, G.S. 75-65, protection from security breaches
- North Carolina General Statutes, G.S. 75-61, definitions under the Identity Theft Protection Act
- North Carolina Department of Justice, security breach information
- Cybersecurity and Infrastructure Security Agency, cyber guidance for small businesses
Coverage subject to policy terms, conditions, and underwriting. This article is general information, not a description of any specific policy or a promise of coverage. Review your policy or talk with us about your situation.