Cyber · For contractors and owners
One wrong click. Insure the response before you need it.
Cyber insurance pays to respond when your systems or data are hit: getting the business running again, notifying the people whose data was exposed, and the claims that follow, up to the policy’s limits.
Light RFP Risk Management Services LLC · NY DFS License # PC-1978982
What cyber insurance covers.
Typically covered
- Incident response: forensic experts, legal advice and notifying the people affected
- Ransomware: restoring systems and data, and extortion costs on many policies
- Income lost while your systems are down, once the waiting period the policy sets has passed
- Claims from clients, tenants or employees whose data was exposed
- Funds-transfer fraud and phishing losses, often to a smaller limit, and on some policies only when added
- Media liability: claims over what you publish, such as photos, ads or posts, if you add it
Where another policy answers
- A design error that costs a client money: Professional liability
- Theft of the laptop itself: Business owner’s policy, or your commercial property policy
- Someone hurt at your office: General liability
Usually not covered
- An incident you knew about before the policy began
- An outage of the power grid, the internet or another outside utility
Who on the block needs it.
Contractors and trades
You send and receive large payments by email: draws, invoices, retainage. That makes a spoofed invoice or a changed bank account a real risk. Ask for funds-transfer fraud by name: it is often a smaller limit or an add-on. The reverse happens too: a fraudster spoofs your invoice and the owner pays them. Covering that lost payment is a separate add-on on many policies, often called invoice manipulation: ask for it by name too.
Owners and operators
Tenant applications, leases and payment details are personal data. A breach can bring notification costs and claims, under privacy rules that vary by state.
How the RFP asks for it
Some contracts require it, mostly when the work touches the owner’s network, building systems or tenant data, usually with a stated limit (for example $1M per claim).
How we quote it.
Light RFP’s brokerage quotes cyber insurance alongside the rest of your program: you fill in the application, and our team takes it to market.
Tell us about the business
The records you keep, the security controls you have in place, how you pay and get paid, and any past incidents.
We take it to market
A Light RFP broker reads your application, contacts you about anything missing, and takes it to the insurers that write cyber for businesses like yours.
Compare the quotes
Limits, deductibles and exclusions side by side, matched to what your contracts, RFPs and lender require. Applying commits you to nothing; you choose whether to buy.
We place it
Our brokerage puts the policy you choose in force and issues the certificates your projects and lenders ask for.
Our application
6 sheets. Plan on 15 to 30 minutes for a contractor or an owner with no incidents, with your IT provider’s answers to hand.
- A contractor paying by wire
- about 67 answers, 62 required
- An owner with online rent
- about 70 answers, 64 required
Follow-up questions appear only when an answer calls for them.
What it asks
Open a sheet for a few of its questions.
CY-01Business
- What is the business’s annual revenue, and how many people work there?
- Has the business bought, sold or merged with another business?
CY-02Your work and your records
- How many records do you keep with Social Security numbers or bank details?
- Do you take card payments, and does an outside processor handle the card numbers?
CY-03Security controls
- Is multi-factor authentication required for email and for every remote login?
- Is at least one backup kept offline, out of ransomware’s reach?
- Does every employee take security and phishing training each year?
CY-04Payments and wire transfers
- When someone asks you to change their bank details, do you call them back at a number you already have?
- Does a second person approve larger payments?
CY-05Coverage
- Which limit and retention do you want?
- Should fraudulent payments be covered too?
CY-06Insurance and incidents
- Do you have cyber insurance today?
- Any cyber incidents or losses in the last five years?
Have these ready
- Your business basicsLegal name, FEIN, the year you started, revenue and headcount.
- Rough counts of your recordsHow many records you keep with Social Security numbers, bank details or health information, for employees, tenants, applicants and subs. Counts only.
- Your IT setupWhether email and remote logins need multi-factor authentication, how you back up, and what protects your computers. Your IT provider can answer most of it.
- How you pay and get paidWho approves wire and ACH payments, and how you check a request to change bank details.
- Your current policy, if you have oneThe declarations page: limit, retention, premium and expiry date.
- Any past incidentsWhat happened, what it cost and what changed afterwards, for the last five years.
Cyber questions.
Is fraud by email covered?
It depends on the policy. Funds-transfer fraud and social engineering are often covered to a smaller limit, or only by endorsement, and some policies require you to have verified the request. Ask for it by name.
Doesn’t my business owner’s policy cover this?
Some BOPs offer a data breach add-on, but it is usually narrow. A cyber policy is written for ransomware, lost income and fraud, and usually covers them more broadly.
What do insurers expect before they quote?
Most want multi-factor authentication on email and every remote login, a backup kept offline, and a call-back check before any change to bank details. Without them, many decline or offer less cover. Ask your IT provider what you have before you apply.
When does a cyber policy pay?
Cyber is almost always claims-made: the policy in force when you find and report the incident pays. Report anything suspicious at once, renew without a gap, and call the insurer’s response line first; many policies pay only for vendors they approve.
What affects the price?
Mostly your revenue and the kind of data you hold, the controls you have in place, such as staff security training, the limits you choose and any past incidents.
Get a cyber quote.
Getting a quote is free. Light RFP earns a commission from the carrier on all policies.
Light RFP Risk Management Services LLC · NY DFS License # PC-1978982