Cyber Insurance for Bookkeepers: What It Covers

Cyber insurance for bookkeepers pays for the cost of a breach, a ransomware attack or a payment scam: forensic help, client notices, lost income, restoring data and defending claims from clients. Policies differ most in their sublimits for payment fraud, their exclusions, and the security controls the insurer expects you to already have.

What does cyber insurance for bookkeepers pay for after an incident?

A cyber policy pays the costs that follow a security incident, both the bills you face directly and the claims others bring against you. For a bookkeeper that means investigators, a lawyer, client notices, restored files and income lost during downtime.

The Federal Trade Commission's small business page on cyber insurance from the FTC lists the costs policies typically cover. Among them are legal counsel on notification duties, recovery of lost data, customer notification and call center services, business interruption, crisis management, cyber extortion and fraud, and forensic investigation.

Picture the incidents a small practice actually faces:

• A staff laptop is stolen from a car with client statements in its Downloads folder.
• An attacker takes over the owner's email and reads two years of client threads.
• Ransomware encrypts the shared drive the week before quarterly payroll filings.
• A client's vendor invoice is altered and the client pays a fraudster on your instructions.

Each of these produces costs that ordinary business insurance often does not reach. A general liability policy is written for bodily injury and property damage. A cyber policy is written for data, systems and the money that moves through them.

What the policy will not do is replace the controls. Insurers price the policy on the assumption that you already run basic security, and they may refuse a claim if the application overstated it. That is why the security questions later in this post matter as much as the coverage list.

First-party and third-party sections of a cyber policy

A cyber policy usually has two halves. First-party coverage pays your own losses: investigation, restoring data, notices, extortion and lost income. Third-party coverage pays when someone else, such as a client or a regulator, makes a claim against you because of the incident. A bookkeeper needs both halves, because client data is the asset at risk.

First-party coverage

First-party coverage is the half you use in the first week. It typically pays for:

• Forensic specialists who find how the attacker got in and what they reached.
• A breach lawyer, often from the insurer's panel, who works out notification duties.
• Notices to affected people, and sometimes a call center or credit monitoring.
• Data restoration, such as rebuilding a server or recovering files from backup.
• Business interruption, meaning income lost while systems are down.
• Cyber extortion, the cost of responding to a ransom demand.

Third-party coverage

Third-party coverage is the half you use months later. The FTC page lists payments to affected consumers, claims and settlement expenses, litigation costs, responses to regulatory inquiries, and damages and judgments. For a bookkeeper the typical third-party claim comes from a client who says your breach exposed their records or led to a loss.

Ask each insurer whether the policy carries a "duty to defend". Under that wording the insurer appoints and pays for the defence. Without it you may have to fund your own defence and seek reimbursement. The FTC page names this wording as one of the questions to ask.

Security questions on a cyber insurance application

A cyber insurance application asks about the controls you have in place, and your answers set both the price and whether the insurer offers cover at all. Expect questions about multi-factor sign-in, backups, software updates, staff training and how payments are verified. Answer them about what is true today, not what you plan to do.

The questions vary by insurer, but a small practice should be ready to answer these:

1. Is multi-factor authentication on for email, remote access and every system holding client data?
2. Are backups made regularly, kept separate from the main systems, and tested by restoring a file?
3. Are operating systems and software updated on a schedule?
4. Do staff receive training on phishing and payment scams?
5. Is a callback to a known number required before changing a payment instruction?
6. Is there a written security plan and an incident response plan?
7. How many records do you hold, and do they include tax IDs or account numbers?

The written plan in question 6 is the item many sole practitioners lack. The guide to a written information security plan for bookkeepers shows how to produce a short one that covers what the application asks.

Question 7 is where retention policy pays off. A practice holding ten years of statements for clients it no longer serves carries more records, and more exposure, than one that deletes on schedule. The post on how long to keep client bank statements helps you set that schedule.

Insurers also ask which outside software holds client data. Keep a list of each tool, what it stores, and whether clients agreed to its use. The post on client consent for bookkeeping software explains how to record that agreement. A statement converter belongs on the list too; AutoBankConvert encrypts files in transit and at rest and lets you choose how long originals are kept after export, which is the kind of detail an underwriter may ask you to state.

Comparing cyber policy limits, sublimits and retentions

Two cyber quotes are comparable only when you line up four numbers: the overall limit, the sublimits on specific losses, the retention you pay first, and any waiting period on lost income. A higher overall limit means little if the fraud sublimit is small or the waiting period outlasts a typical outage.

Each term has a plain meaning:

• Aggregate limit: the most the policy pays in total during the policy year.
• Sublimit: a smaller cap inside the aggregate for one kind of loss, such as social engineering fraud.
• Retention: the amount you pay before the insurer pays, similar to a deductible.
• Waiting period: the hours of downtime before business interruption cover starts.

A worked comparison

The table below compares two quotes. The figures are examples for illustration, not market prices.

Quote A looks larger. Now test it against a likely claim. Suppose a client wires 60,000 to a fraudulent account after an email that appeared to come from your practice. Under Quote A the fraud sublimit caps the payment at 25,000, less the 5,000 retention, so it pays 20,000. Under Quote B the same loss is paid at 57,500, the 60,000 less the 2,500 retention. For a practice whose real risk is payment fraud rather than a large data breach, the smaller policy fits better.

Run the same test with the incident you think is most likely for your own practice, and compare the payout, not the headline limit.

Does a cyber policy cover a client's wire sent to a scammer?

A cyber policy may or may not cover a client's wire sent to a scammer, and the answer usually sits in the social engineering or funds transfer fraud section. Some wording covers only money taken from your own accounts, and the cap for it may sit far below the headline limit. Ask the broker about this scenario in writing.

Payment fraud is the incident bookkeepers are most exposed to, because they touch vendor details, payroll changes and bill payments for many clients. Three scenarios read differently under most policies:

1. Your own funds: an attacker tricks you into paying a fake invoice from the practice account. This is the case social engineering cover is most often written for.
2. Client funds you control: you pay a client's bills from their account and pay a changed bank detail. Whether this counts depends on the policy's definition of "your" money.
3. Client funds the client moves: the client pays on the strength of an email that appears to come from you. Any recovery here is more likely a third-party claim against you than a first-party fraud loss.

A policy may add conditions, such as a verified callback before any change to payment details. If the policy requires a callback and you skipped it, the claim may fail. Write the callback step into your procedures so that following it is routine, not an afterthought on a busy day.

Cyber insurance exclusions bookkeepers miss in the fine print

The exclusions that most often catch bookkeepers are unpatched systems, controls stated on the application but not in place, losses from a vendor's breach, and incidents that began before the policy started. Read the exclusions section before you compare prices, because an exclusion can remove the very scenario you bought the policy for.

Watch for these in particular:

• Failure to maintain controls: if you said multi-factor sign-in was on everywhere and one account lacked it, the insurer may deny the claim.
• Unpatched software: a policy may exclude or reduce cover when a known fix was available for a set period and not applied.
• Prior acts: incidents that started before the policy date, even if found later, may fall outside it.
• Vendor incidents: a breach at your cloud or software provider may or may not count. The FTC page lists cyber attacks on data held by vendors as a point to check.
• War and state actors: wording varies widely and is worth asking the broker to explain.
• Contractual liability: promises you made in an engagement letter that go beyond what the law requires may not be covered.

Contract promises also shape what you can bill. If an incident forces hours of restoration work you never priced, the guide to billing out-of-scope bookkeeping work covers how to treat that time with clients, and whether the policy reimburses your own labour is another question for the broker.

When cyber cover overlaps errors and omissions insurance

Cyber cover and errors and omissions insurance overlap when a mistake in your work and a security incident are part of the same loss. Errors and omissions covers professional mistakes, such as a wrong entry that leads to a penalty. Cyber covers data and system incidents. An E&O policy may exclude cyber events, so check both.

Consider a staff member who emails a client's statements to the wrong client. That is a data incident, so it falls under the cyber policy. Now consider a bookkeeper who keys a vendor's changed bank details from a fake email without checking them. The loss came from a security attack and from a professional lapse, and both insurers may point at the other.

Two steps reduce the gap. Buy both policies from the same broker where you can, so one person reads them side by side. Then ask that broker, in writing, which policy responds to the three or four scenarios that worry you most. Keep that answer with the policies, and review it at each renewal, because wording changes from year to year.