Cyber coverage for firms that move money and hold data.

An employee receives convincing instructions to change wire details and follows them. Many cyber forms sublimit this heavily or push it to a crime policy. For any business that moves client funds, this is the first coverage to confirm, not the last.

Carriers increasingly ask whether you have multi-factor authentication, offline backups, and endpoint detection, and answering yes creates a condition. If it lapses, the claim is exposed. Answer accurately, and tell us when your controls change.

Systems-down cover usually carries a waiting period before it responds. For a practice that bills hourly, that waiting period is the coverage decision.

Targeting is largely automated and indifferent to size, and small firms typically have fewer controls. The more relevant question is what a week without systems, or a misdirected client wire, would cost you.

Almost never in any meaningful way. General liability forms typically exclude electronic data and privacy exposures outright. A small endorsement occasionally appears, but the limits are not intended to respond to a real event.

Many forms cover extortion payments subject to sublimits, carrier approval, and legal restrictions on payments to sanctioned parties. The more valuable part of the coverage is usually the incident response team the carrier brings, not the payment itself.