Ransomware, data breaches, and network outages are increasingly routine events for small businesses. A standard BOP covers none of them.
A small business's email system gets compromised. A ransomware attack encrypts their files and locks them out of their own systems. A customer database gets breached, and the business is now required under state law to notify everyone affected.
These are not hypothetical scenarios. And for most small businesses, the cost of responding to a cyber incident is not covered under their BOP or any other policy they currently carry.
What a BOP Doesn't Cover
A standard BOP is built around physical property and general liability. Cyber incidents — data breaches, ransomware, phishing-driven fraud, network outages — fall outside both categories. There is no property damage in the traditional sense when data is stolen. There is no bodily injury when a client's personal information is exposed.
Some BOPs include limited cyber coverage as a standard feature, but the limits are typically modest and may not extend to all types of cyber events. Businesses that rely on that default often discover its limits at the worst possible moment.
What Commercial Cyber Coverage Does
Commercial cyber liability policies cover costs that arise from a cyber incident on both sides. First-party costs include data recovery, forensic investigation, business interruption while systems are down, and in some cases ransomware response costs. Third-party costs include claims from customers or partners whose data was compromised, notification requirements under state law, and credit monitoring for affected individuals.
Many policies also include regulatory defense — legal defense and fines from state or federal regulators following a breach. The specific terms vary significantly between carriers and forms, and what a business needs depends on the type of data it holds and how dependent it is on its systems.
Why Small Businesses Assume It Won't Happen to Them
The assumption is that hackers target large companies with large data sets. The reality is that small businesses are often easier targets — they are less likely to have dedicated IT security, less likely to be monitoring for intrusions, and more likely to pay a ransom quickly to restore operations.
Any business that holds customer data — names, addresses, payment information, health records — has a breach exposure. Any business that relies on its systems to function has a ransomware exposure. The size of the business does not change the nature of the risk.
The Conversation
Does your business hold any customer data, and do you know whether your current coverage includes anything for a cyber incident? For most small business owners, the answer to the first question is yes and the answer to the second is uncertainty.
Walking through what they hold, what a breach or outage would actually cost them, and what commercial cyber coverage would add is a straightforward conversation for any business client — and one that more clients are prepared to have than they used to be.