Maintenance
Part of Cyber insurance splits into two halves most buyers never separate
Cyber insurance exposure base: revenue, records, industry
The cyber insurance exposure base is revenue, records held and industry. How to measure each from your own systems before a broker or an underwriter asks.
A cyber premium is scaled against something, and the underwriter chooses that something before any rate is applied. For this line it is a mix of revenue, the records you hold and your industry. A business that measures all three first walks into the quote knowing what the number rests on.
What to take away
- The exposure base is what the premium is measured against. For cyber it is some combination of revenue, records held and industry.
- Revenue stands in for the income that stops when systems stop.
- Records drive notification, monitoring and regulatory exposure, which scale with the database rather than with sales.
- Industry sets what attackers want, what regulators require and what an outage costs.
- Answer from your systems, not from memorythe base is also what an audit or a claim is checked against.
Why the base comes first
An insurer needs to scale the risk before it can price it. For a shop, the measure of size might be sales. For an employer, payroll. For cyber, the underwriter looks at a few things at once.
The three measures pull in different directions. A firm with large sales and little data looks different from a small firm holding a large sensitive database. Knowing your own position on each is the first step in reading any quote.
| Measure | What it stands in for | Where the figure comes from |
|---|---|---|
| Revenue | Income that stops when systems stop, and business at stake in a reputational event | Your accounts |
| Records | Notification, monitoring and regulatory exposure | A data inventory from your systems |
| Industry | What attackers want, what regulators require, what an outage costs | The trade you actually operate in |
Revenue: what stops when systems stop
Revenue is a proxy. The underwriter is asking how much income halts when the systems halt, and how much business rides on your name after a public event.
Work that out for your own firm in plain terms. Which systems take orders, issue invoices or collect payments? What happens to sales if each one is down? Which customers cannot work without your systems?
A business with almost no revenue can still pay a real premium. Revenue is one input among several, and a small firm whose systems a larger customer depends on is priced on that fact.
Records: count them and rate their sensitivity
Records are easy to underestimate. The cost of notifying and monitoring affected people, and the regulatory exposure, scale with how many people's information you hold, and a small business holding a large sensitive database is priced as the database.
Build the inventory in four steps:
- List every place you keep personal, financial or health-related information about customers, staff or suppliers.
- Note roughly how many people each place covers.
- Rate each by sensitivitycontact details sit at one end, and government ID numbers, payment data and health information at the other.
- Note which systems hold the data and who can reach them.
Health information and payment card data carry their own rules, and breach notification duties exist in every US state. The FTC's data security guidance for business is a fair guide to what holding that data is taken to commit you to.
Industry: three questions about your trade
Sectors differ in what attackers want from them, in what regulators require of them, and in what an outage costs. Those are three separate questions, and your answers can differ on each.
Ask them in order. What would an attacker take from a business like yours? Which regulator expects what from you if that data is lost? What does an hour of downtime cost a firm in your trade?
Your own trade may not match the label an application assigns. Read the class the insurer used, and say so if it misdescribes the work you do.
Three firms, three different bases
The same premium question lands differently on different firms. Three sketches show how the measures pull apart.
- A small clinic has modest revenue and a database of health records. The records dominate its base, and it is priced as the database.
- An online seller has revenue tied to its systems, so an outage stops sales at once. Revenue and payment data both matter.
- A consultancy with one large client has little data and moderate revenue. A larger customer depends on its systems, and that dependence is the fact the underwriter prices.
None of these firms can read a price off a website. Each can state its own base, which is what lets a broker compare offers.
Turning the base into a one-page sheet
Put the three answers on one page before you call a broker. A broker who sees revenue, a data inventory and an industry note can approach more than one market with the same facts, which makes the offers comparable.
Knowing what markets expect before they quote tells you which other papers usually travel with the page.
If the application asks about these, answer from your systems, not from memory. The same figures are what an audit or a claim will be checked against, so a loose answer today becomes a dispute later.
The premium audit process shows how declared figures are tested after the policy year ends.
What the base does not settle
The base is the first input, not the whole price. Limits, sub-limits, retentions and waiting periods decide how much of a loss the policy carries and how much you carry first. Prior incidents are read as a pattern, not as a single event.
Same Limit, Different Policy
Quote A
- Headline limit
- $1M
- Social engineering
- $100k
- Funds transfer fraud
- $100k
- Extortion
- $250k
- Dependent BI
- $250k
- Retention
- $25k
- Waiting period
- 24 hours
Quote B
- Headline limit
- $1M
- Social engineering
- $250k
- Funds transfer fraud
- $250k
- Extortion
- $500k
- Dependent BI
- $500k
- Retention
- $10k
- Waiting period
- 12 hours
Controls are the only input you can change inside a policy year. CISA's Cyber Essentials covers most of the same ground the application asks about, written for people who do not do this for a living.
How the policy is built and claimed on is a separate subject: how a cyber policy splits into its parts. The other factors that move a small business premium sit beside the base, not inside it.
Common questions
Why does a business with almost no revenue pay a premium at all?
Because revenue is one input among several. A small business holding sensitive records, or one whose systems another firm relies on, is priced on those facts.
Which weighs more, revenue or records?
The answer depends on the firm. Records drive the costs that follow a breach, which scale with the database rather than with revenue, so a small holder of sensitive data can be priced as the database.
Can I change the base during the policy year?
No. Controls are the only input you can change inside a policy year. Keep the inventory current all the same, because declared figures are tested again later.
Is the application the right place to estimate?
No. Use figures pulled from your systems and keep the source of each one.
