# Cyber insurance for small businesses: what it really covers

> Understand cyber insurance for small businesses: cover, exclusions, costs and security requirements to check before signing a policy in Germany.

- Quelle: https://bezahlbare-webseite.de/en/ratgeber/cyberversicherung-kleinunternehmen/
- Datum: 2026-11-02
- Sprache: en
- Thema: Preise & Abo-Modell

Cyber insurance can provide financial and practical support after a cyberattack. It does not replace secure passwords, backups or updates, and it only pays within the agreed cover and obligations.

## What does business cyber insurance cover?

A policy may combine first-party losses, emergency support and third-party liability. Typical areas include IT forensics, restoration, business interruption, legal advice and crisis communication. The contract wording, not the product name, determines the actual cover.

Germany’s insurance association GDV lists 24/7 expert support, data restoration, interruption, legal advice and communication among common components. Its model terms are non-binding and insurers may differ. Source: GDV cyber cover overview and model terms, accessed 2 November 2026.

*Typical cyber insurance components – source: GDV, accessed 2 November 2026*

| Component | Typical purpose | Check before signing |
| --- | --- | --- |
| Forensics and emergency help | Contain the incident and preserve systems | Hotline, response time, approved providers |
| Data and system restoration | Clean and restart operations | Backup rules and restoration limits |
| Business interruption | Cover lost income and extra costs | Waiting period, indemnity period and limits |
| Liability and privacy | Review and defend third-party claims | Fines, contractual penalties and legal support |
| Crisis communication | Inform customers and the public | Scope, approval and external specialists |

## What is commonly excluded?

Known vulnerabilities, obsolete systems, missing safeguards, intentional acts and incidents outside the insured period may be excluded. Ransom payments, fines, contractual penalties, hardware failure or cloud-provider outages may also be limited.

Answer the insurer’s security questionnaire accurately. If you confirm multi-factor authentication, backups and prompt updates, those controls must exist and be documented.

Check phishing, social engineering, fraudulent transfers, remote work, personal devices, subcontractors and cloud services explicitly. Small firms often lose money through compromised email accounts as well as encrypted servers.

## How much does cyber insurance cost?

Pricing depends on turnover, sector, data, staff numbers, cover limit, deductible and existing security. A trades business and a medical practice do not present the same risk.

The Rhine-Neckar Chamber of Commerce cited entry-level policies from roughly €300 per year on 7 March 2024. This is not a current quote; pricing and wording may have changed by 2 November 2026. Compare several offers on identical limits and conditions.

Do not compare premium alone. Include deductibles, sublimits, waiting periods, emergency response and the maximum interruption period.

- Overall limit and sublimits
- Deductible per incident
- Waiting and indemnity periods
- 24/7 response and reaction time
- Forensics, legal, privacy and communication costs

## When is cyber insurance useful?

It is worth considering when the business cannot operate without email, specialist software, point-of-sale systems, online booking, an online shop or customer data. Sensitive health, payment or personal data increases the exposure.

Germany’s BSI described the national situation as tense and ransomware as the largest threat in its 2025 report. Small and medium organisations remain attractive because known vulnerabilities can be exploited at scale. Source: BSI report on Germany’s IT security situation 2025, accessed 2 November 2026.

Estimate how many days you can work without systems, the cost of one lost day and the specialists you would need immediately. If you could fund all of that yourself, insurance may be less urgent.

## Which security controls will the insurer expect?

Insurers often ask about multi-factor authentication, patching, endpoint protection, separate privileges, tested backups and incident plans. Requirements differ, so review them continuously rather than only for the application.

BSI guidance for SMEs recommends current systems, secure configuration, backups, staff awareness and prepared incident procedures. Its DIN SPEC 27076 CyberRiskCheck offers a structured entry point for organisations with up to 50 employees. Source: BSI SME guidance and CyberRiskCheck, accessed 2 November 2026.

Your website is part of this chain. A managed website subscription can assign updates, backups and recovery clearly, but the policy still only covers the agreed financial consequences.

- MFA for email, cloud and administration
- Documented patch process
- Separate and tested backups
- Individual accounts instead of shared passwords
- Emergency contacts for IT, privacy, insurer and management

## What should you do after a cyberattack?

Disconnect affected systems carefully, but do not destroy evidence with rushed deletion or reinstallation. Call the policy’s emergency line, document the timeline and coordinate external specialists with the insurer.

Under Article 33 GDPR, a personal-data breach may need to be reported to the competent authority. Where the breach is likely to create a risk, notification should generally be made within 72 hours of awareness. Source: Article 33 GDPR via EUR-Lex, accessed 2 November 2026. Obtain professional advice for the specific case.

Close the cause, rotate passwords and keys, restore clean backups and communicate clearly. Insurance, technical safeguards and a rehearsed incident plan complement one another.

## Frequently asked questions

### Is cyber insurance mandatory for small businesses?

Usually not, although a client or contract may require it and the business risk may still justify it.

### Does it cover ransomware?

It may, depending on the wording, exclusions, required controls and the actual loss.

### Is insurance enough without IT security?

No. Missing or incorrectly declared controls increase losses and may affect cover.

### How much cover do I need?

Base it on interruption, restoration, forensics, legal support and possible third-party claims.

### Must every data breach be reported?

No. Reporting depends on the risk to people; when required, Article 33 GDPR generally sets a 72-hour deadline.

---
Veröffentlicht von bezahlbare-webseite.de — Website im Abo ab 79 €/Monat. https://bezahlbare-webseite.de/