Cyber insurance comes in two broad parts. First-party coverage pays your own costs after an incident. Third-party coverage protects you when others make claims against you. Before buying, check what each covers, whether the insurer must defend you, and whether a breach hotline is available around the clock.
First-party coverage
According to the FTC's small business guidance, first-party coverage can pay for things like:
- Legal help in working out notification and regulatory duties
- Restoring or replacing lost or stolen data
- Notifying people and running call center support
- Income lost while operations are disrupted
- Managing public fallout
- Responding to cyber extortion and fraud
- Investigating how the breach happened
- Fees, fines and penalties tied to the incident
Third-party coverage
Third-party coverage addresses liability when outside parties bring claims. The FTC lists compensation for affected consumers, settling disputes or lawsuits, defending against litigation and regulatory inquiries, and other settlements and judgments.
Questions to put to an agent
The FTC suggests checking:
- Does the policy cover data breaches, attacks on data held by vendors, network intrusions and attacks outside the US?
- Does the insurer have a "duty to defend" you in lawsuits or investigations?
- Does it pay above other insurance you carry?
- Does the insurer run a breach hotline open at all hours?
Add questions of your own. Does the policy depend on security measures you must have in place, such as multi-factor authentication or backups? If you claim and a required control was missing, what happens? Ask for the answer in writing.
Why a small organization should still care
A single ransomware event can close a school office or a food bank for weeks. Recovery, legal advice and notification bills arrive together. Insurance does not fix the damage, but it can pay for the experts you will need.
Insurance does not replace controls
Insurers commonly ask about MFA, backups and incident plans. Doing those things helps you qualify and may keep the policy usable. See the 90 day plan.
Talk to the right people
Your board, your funder and your existing insurance broker may already have views. Some grants and school districts require certain coverage. Ask. This post is general information, not insurance or legal advice.
Quick check
What does "duty to defend" mean?
It means the insurer must pay to defend you in covered lawsuits or investigations. The FTC says to look for that wording in a policy.
Sources
Last reviewed: 19 October 2026.
