Should you pay for cyber insurance at your size
How cyber insurance works for a small Indian business, the exclusions that decide whether a claim pays and what to fix before buying a policy.
The quote on your desk
A broker has sent a cyber policy quote, or a client contract has started asking whether you carry one. Either way the question is narrow. At twenty or fifty people with a handful of systems does this cover do anything useful or is it a premium paid against a vague fear.
It helps to know what the product pays for. Cover in this category is built mainly around the cost of responding to an incident. Forensic investigation, restoring data and systems, legal and notification costs where personal data is involved, lost income while you are down and third party liability. Some policies extend to extortion payments and some do not.
The exclusions come first
Read the exclusions before the limit. Policies in this class commonly exclude loss arising from a known vulnerability you did not patch, from the absence of a control you declared you had, and from incidents that began before the policy started. Fines that are uninsurable as a matter of law sit outside cover regardless of what the schedule says. Money moved because an employee was deceived into transferring it is frequently a separate add-on rather than part of the base cover.
On price, expect an annual premium plus an excess you bear on every claim, and note that some sections carry sub-limits well below the headline number. GST at 18% applies on service fees such as a broker or consultant charge. There is also an unpriced cost in the proposal form itself, which takes real time because it asks specific questions about your controls that someone must answer accurately.
Who should not buy this yet
If you have no tested backups and no multi-factor authentication on email and finance systems then do not spend the money on a premium. Spend it there instead. Those two controls reduce the loss you are insuring against and insurers increasingly require them anyway.
Do not buy it if you cannot answer the proposal form truthfully today. Cover in this market rests on what you declared. A statement about encryption or access control that is not accurate can leave you paying premiums for a policy that will be contested at the one moment you need it.
A business with no customer data worth taking, no card or payment flow and no dependence on a system to trade is also a poor fit. A workshop billing in cash with records on paper has little that an attacker can monetise and little that a policy would restore.
The clear cases sit elsewhere. You hold personal data at volume, you move money through online banking daily, your trading stops when your systems stop, or an enterprise customer has made cover a contractual requirement.
How a claim actually unfolds
The proposal form becomes part of the contract. Your answers about controls are the basis on which the risk was accepted. The form deserves the same care as the policy wording.
When something happens the timeline is strict and short. Most policies require notification to the insurer within a defined window and require you to use their panel for forensic and legal work. Appointing your own consultant first is one of the common reasons costs get disputed. Call the notification number before you call anybody else.
The part with genuine value at small scale is that panel. A small business discovering ransomware on a Friday evening has no idea who to telephone. Access to people who have handled it before, within hours, is often worth more than the eventual settlement. Weigh that alongside the limit when you compare quotes.
How to judge the policy in front of you
Write down your worst realistic scenario in one paragraph. Email compromise leading to a fraudulent supplier payment. Ransomware on the server that holds order history. A laptop with customer records lost in transit. Then trace that single scenario through the schedule section by section and find the sub-limit and the excess that would apply to it. That exercise answers the question the premium cannot.
The flattering figure is the aggregate sum insured. It is the number on the first page and it is rarely available to any one claim. Sub-limits per section, the excess and the exclusions decide what you receive.
The mistake that empties the cover
The expensive mistake is treating the policy as a substitute for the controls. Businesses buy cover, feel protected and leave backups untested for a year. When the claim comes the insurer examines whether the declared controls were in place. A failed restore turns a covered event into an argument.
The second error is buying on price without reading which add-ons were dropped to reach it. Funds transfer fraud and business interruption are trimmed most often and they are the scenarios a small business is most likely to meet.
The regulatory thread
Notification obligations sit outside the policy and apply regardless of cover. Where personal data is involved Indian data protection law places duties on the business that decided why the data was processed. Insurance does not transfer those duties though it can pay the cost of discharging them.
Policy wording in this class varies considerably between insurers and the exclusions move from year to year. A qualified insurance professional should confirm what any specific policy covers for your situation before you rely on it.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.