Guides
Does a small business need cyber insurance?
No law requires it, but most small businesses that hold customer data, take payments or wire money should carry it. How to judge your exposure and what to buy.
Most small businesses that store customer information, accept card payments, send wire transfers or depend on computers to earn revenue should carry cyber insurance. No federal law requires a private company to buy it, and a business with almost no data and no digital dependence can reasonably go without. But the policies that most owners already hold, a general liability policy or a property policy, mostly exclude these losses, so without a cyber policy the cost lands on the owner.
Is it required?
No federal statute requires private businesses to carry cyber insurance. The pressure comes from contracts. A larger customer's vendor agreement, a lender, a payment processor or a franchisor may require a stated limit of cyber or privacy liability coverage, often alongside the usual general liability and professional liability requirements. how to review the insurance requirements in a contract explains how to read those clauses, and the contract insurance requirements checker tool helps compare them to your policies.
Regulated businesses face a different pressure. Health practices, financial firms and anyone holding personal data must follow breach notification rules even when they have no insurance; every state, the District of Columbia and three territories have a notification law, according to the National Conference of State Legislatures. Insurance does not satisfy those laws, but it pays for the response. See data breach notification laws and what they cost and HIPAA breaches and cyber insurance for healthcare providers.
Small businesses are in the target zone
Attackers do not pick victims by size. They pick by access, and small companies often have valuable access with thin defenses.
- The FBI's Internet Crime Complaint Center (IC3) reported in its 2025 annual report that it received 24,768 business email compromise complaints with reported losses of about $3.05 billion, and more than 3,600 ransomware complaints. Among ransomware complaints from organizations outside the critical infrastructure sectors, the most reported industries were legal services (18%), contracting services such as electricians and general contractors (17%), engineering and architecture (10%) and consulting (7%).
- NetDiligence's 2025 Cyber Claims Study, which draws on 10,402 insurer-reported claims from 2020 to 2024, found that 98% came from companies it classes as small and medium (under $2 billion in revenue) and that ransomware (26%) and business email compromise (19%) were the leading causes of loss. Its "SME" definition is broad, since the average SME in the data had $108 million in revenue, so read it as a signal about claim types, not about the smallest shops.
- Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 through October 2025, said ransomware was involved in 48% of breaches.
If you are a law firm, an accounting practice or a contractor that moves money to vendors and holds client files, you match the profile those numbers describe.
What a bad week costs: a hypothetical
The figures below are invented to show the arithmetic. They are not typical costs.
Say a 15-person design-build firm loses access to its project management and accounting systems to ransomware for 10 working days. Net income lost plus continuing expenses, such as payroll and rent, runs $8,000 a day, or $80,000. Forensics, breach counsel and notification and rebuilding total $55,000. That is $135,000 before anyone sues, for a company that may net a few hundred thousand dollars in a good year. A cyber policy with a $10,000 retention and a business interruption waiting period of a day or two would absorb most of it. Use the business income (interruption) limit calculator to estimate your own daily figure, because the policy's business interruption limit should be sized to it.
Who needs it most
| Your situation | Why it raises exposure |
|---|---|
| You hold personal data (clients' Social Security numbers, health records, tax returns) | Notification costs and third-party suits follow a breach; you owe duties to people who never chose you |
| You accept cards online or in store | Card-brand assessments and processor contract duties (payment card fines and assessments: does cyber insurance pay?) |
| You pay vendors or move client funds by wire or ACH | Fraudulent payment instructions are among the most common losses (business email compromise and funds transfer fraud coverage) |
| Your revenue stops when systems stop | Business interruption is often the biggest part of a ransomware claim |
| You depend on a few cloud vendors | A vendor's outage or breach can hit you (cyber business interruption and dependent system failure) |
| A contract or regulator requires it | You may be unable to bid without it |
If none of the rows describes you, a sole proprietor with a laptop, no client data and no payments is a candidate for a modest endorsement or no coverage at all.
Endorsement or standalone policy
Many small businesses first meet cyber coverage as an endorsement on a business owner's policy. That can be a reasonable start, but the limits are usually modest and the sublimits for ransomware and funds transfer fraud can be small. A standalone policy offers higher limits and broader grants, and underwriters ask more questions. cyber insurance: what it covers for a business compares the structures, and What is a business owner's policy (BOP)? covers the underlying package.
Insurance is not a substitute for controls. Underwriters now ask about multi-factor authentication, backups and endpoint protection, and a business without them may be declined or priced steeply (MFA, EDR and backups: the controls cyber insurers now require). Working on the controls and the policy together is the sensible order.
How to decide
- List the data you hold and where it sits: client files, payroll records, card data, health information.
- Estimate your daily cost of downtime using net income plus continuing expenses.
- Check every customer, lender and landlord contract for cyber or privacy insurance requirements.
- Ask your broker whether your current package already includes a cyber endorsement, and read its limits and sublimits.
- Gather the answers underwriters will ask on the application (the cyber insurance application: what underwriters ask and how to answer); the cyber insurance readiness checklist is a starting point.
- Get quotes at two or three limit levels and compare breach response, business interruption, extortion and funds transfer fraud lines, not just the premium. Price depends on revenue, industry, controls and claims history (what drives the cost of cyber insurance).
Key takeaways
- Cyber insurance is rarely legally required, but contracts and regulators often make it a condition of doing business.
- Business email compromise and ransomware are the leading causes of small business cyber losses in FBI and claims-study data.
- Your general liability and property policies mostly exclude data and system losses, so the gap is yours unless you buy cover.
- Size the limit to your downtime cost and the data you hold, and compare sublimits for ransomware and funds transfer fraud.
- Do the controls work at the same time. Underwriters will check them, and they also reduce the odds you ever file a claim.