Although cyberliability insurance is negotiable and policies vary significantly, the key protections offered by cyberliability insurance include the following:

• Cyberliability insurance typically covers the costs of investigating, responding to, and terminating an actual or suspected security or privacy breach, often including the fees, costs, and expenses to retain counsel to determine notification obligations.
• Many cyberliability insurers include coverage for losses incurred as a result of cyber extortion, including ransom payments, data recovery and restoration, and business interruption costs.
• In addition, cyberliability insurance may cover liability arising from an alleged failure to prevent a security or privacy breach or the disclosure of protected confidential information, including the costs of defending against claims by affected parties.
• Cyberliability policies also often cover the cost of engaging forensic investigators to determine the cause of a cyberattack and terminate the threat, as well as the cost of other professionals, such as crisis management firms, to help contain the fallout from the public disclosure of a cyberattack.

Potential areas to consider enhancing or negotiating in these policies (among many others) include:

• Obtaining coverage for more than just "theft" or "publication" of personal information; include collection, use, storage, and disclosure of personal information.
• Expanding coverage to include regulatory actions or investigations.
• Ensuring that the policyholder can choose (or at least has the right to consult in choosing) defense counsel or other third-party incident response vendors.
• Limiting the trigger for notice obligations to discovery or knowledge by as few personnel as possible.
• Ensuring that the policyholder can take emergency action without negatively impacting coverage.

Companies potentially at risk for data breaches or ransomware attacks should undertake a comprehensive review of all of their insurance policies to make sure they are covered to the extent possible. As always, it is important to consult with attorneys who concentrate on and are knowledgeable in this area. Reed Smith Insurance Recovery Group attorneys have been at the forefront of this issue, negotiating the placement and renewal of cyberliability insurance coverage and minimizing, or eliminating, any potential coverage gaps for large and small companies.