Cyber Insurance Needs

As a small company accountant, you likely have been given some responsibility for the company’s insurance coverage.  If yes, think about whether the cyber (Internet and computer-related) insurance coverage the company has is adequate.

Many small companies now depend extensively on their computers and Internet connections for on-going business operations.  Even small companies can maintain large amounts of electronic data on customers, vendors, and employees.  Small companies often use the Internet extensively for sales, marketing, transferring data between the company and other businesses, such as banks and vendors, and other uses.  Interruptions of these processes can cause the company great loss.

The federal government’s Internet Crime Complaint Center reported that in 2010 about 122,000 complaints that the Center had received were referred to law enforcement officials.  Complaints included the following company-related events:  non-delivery of merchandise; online auction fraud; credit card fraud; and advance fee fraud.

In 2011, according to the Identity Theft Resource Center, 340 organizations publicly disclosed that customer data on their computer systems had been breached.  In each case, the customers had to be notified of this breach, which is very expensive.

As the company’s accountant, you would be wise to think about what cyber insurance coverage is adequate for your company.

Information at an Insurance Information Institute web page (click here) provides good advice and recommendations about insurance coverage for companies with heavy Internet usage.

Adding to the complexity of evaluating adequate cyber-related insurance coverage is the practice of keeping customer and other data at 3^rd party providers (cloud computing).  Discussions at GIGAOM (click here) and Business Insurance (click here) deal with cyber insurance coverage and cloud computing.  Insurance policies that deal with the risk of keeping data at 3^rd party cloud providers are evolving.

Recognizing the threat is important.  Although such recognition can insure adequate insurance coverage, much more important is that such recognition should lead to adequate physical and procedural protections at the company to minimize the risks.