Does your cyber insurance cover contingent business interruption?

With the interdependent nature of modern commerce, very few companies operate as an island. Businesses rely on other businesses or service providers to operate efficiently. Maybe it's web hosting or credit card processing. Maybe it's recordkeeping, banking, distribution networks, inventory or invoicing systems. In this day and age, when partners like these suffer an outage, it impacts your business operations and your bottom line.

While we've talked about cyber liability insurance and data breach insurance on this blog, we've only hinted at the problems that cyber incidents can have on business continuity. The fact is that business continuity can be a significant challenge for many organizations when systems go down. It's especially challenging when those systems aren't yours, but a service provider's.

Contingent Business Interruption (CBI) means that your business' operations are impacted due to the interruption in service of a third-party service provider. Imagine if you were temporarily unable to fulfill orders, process invoices, ship and receive goods or access information that is vital to your organizations' efficient operation all because somebody else's operations were halted.

One 2022 study showed that 20 percent of businesses report having had a “serious” or “severe” outage in the past three years that involved significant financial losses, reputational damage, regulatory issues and in some severe cases, loss of life.

What would the impact of a shutdown be on your revenue? On your reputation with customers? And what would it take to become fully operational again and eventually made whole for the losses incurred?

Ideally, every organization would have a back-up plan to get up and running as quickly as possible, but even the most thorough plan may not avoid all potential interruptions. With many shifting to cloud-based solutions, the perception is that the risk is transferred to another party. The reality is that the risk is still present; the organization simply relies on this third party to provide security. That's where CBI coverage comes into play.

It's important to understand if your cyber insurance policy covers CBI and, if so, does it cover just the "period of restoration" (insurance lingo for the period of time that the outage lasted) or does it extend beyond that. In some cases, businesses might incur overtime or other costs after restoration to get back up and running or to make up for the backlog caused by the outage. Some policies cover the period of restoration plus an additional time. These are all nuances to be aware of when comparing policies.

More and more businesses understand the need for comprehensive cyber insurance coverage to handle a wide array of potential cyber incidents. Oftentimes, however, they may not be thinking about business interruptions. It’s a topic every organization should be talking with their broker or carrier about.

Contact your McClone strategic risk advisor if you’d like more information about CBI coverage or to determine if your policy covers you for these interruptions.