Cyber insurance has become a basic part of protecting a business. But a policy is only as good as the answers on your application and the security controls behind them. If an insurer finds those answers weren't true when a claim comes in, coverage can be challenged at the worst possible moment.
At the same time, Texas law sets firm deadlines for notifying people and the Attorney General after certain data breaches. Insurance, security and compliance are now tied together.
What cyber insurers expect
Applications and renewals increasingly ask detailed questions about your security. Common areas include:
- Multi-factor authentication (MFA) on email, remote access and administrator accounts.
- Endpoint detection and response (EDR) on computers and servers, often with monitoring.
- Backups that are offline or immutable and regularly tested.
- Patching of operating systems and internet-facing devices.
- Security awareness training and phishing exercises for staff.
- Payment verification procedures to prevent wire fraud and business email compromise.
- An incident response plan that names who to call and what to do.
Each question is really a promise. Answer "yes," and the insurer may rely on that control being in place.
Why claims get denied or policies challenged
Inaccurate applications. In a widely watched 2022 case, Travelers asked a federal court to rescind a cyber policy it had issued to International Control Services after a ransomware attack. Travelers said the application stated that MFA protected administrative and privileged access when, according to the insurer, it protected only the firewall. The case ended with the policyholder agreeing the policy was rescinded. The lesson: an optimistic "yes" can cost you the entire policy.
Controls that lapsed. MFA turned off for one executive, a backup that stopped running, or EDR missing from new laptops can all become disputes after an incident.
Coverage you didn't know you lacked. Payment fraud from fake instructions, regulatory fines, or business interruption may be excluded, sublimited or subject to conditions such as verifying payment changes by phone.
Late notice or unapproved vendors. Many policies require prompt notice of an incident and the use of the insurer's approved breach response firms.
What Texas law requires after a breach
- Notify affected people. Under Texas law, a business that owns or licenses sensitive personal information must notify affected individuals without unreasonable delay and no later than 60 days after determining a breach occurred, subject to limited exceptions.
- Notify the Texas Attorney General. If a breach involves at least 250 Texas residents, the business must report it to the Attorney General as soon as practicable and no later than 30 days after determining the breach occurred.
- Privacy obligations. The Texas Data Privacy and Security Act, effective July 1, 2024, adds privacy duties for many businesses that process Texans' personal data.
Industry rules may also apply, such as HIPAA for healthcare and the FTC Safeguards Rule for many financial businesses. Our Texas cybersecurity compliance guide and Texas data breach response guide cover the details. This article is general information, not legal advice; talk with your attorney about your specific obligations.
Simple steps to protect your coverage
- Answer applications with evidence, not memory. Have your IT team or provider confirm every security answer before you sign. If a control is only partly in place, say so and fix it.
- Keep an evidence file. Save screenshots and reports showing MFA settings, EDR coverage, backup tests, patch status and training completion. Update it before each renewal.
- Check controls quarterly. Make sure MFA, EDR and backups cover every user and device, including new hires and new laptops.
- Read your coverage for fraud and interruption. Know your limits and conditions for social engineering fraud, business interruption and regulatory costs.
- Put your insurer's hotline in your incident plan. Know who to call first and which response firms your policy requires.
- Know your notification deadlines. Build the 30-day and 60-day Texas deadlines into your incident response plan so they aren't discovered mid-crisis.
Where to start
Before your next renewal, pull last year's application and check every security answer against what's actually in place today. Fix the gaps, then document the proof. Our cyber insurance readiness guide and cyber liability insurance page explain how to prepare.
HUFF DATA SYSTEMS helps Texas businesses put the controls insurers expect in place and keep the evidence to prove it. If renewal is coming up, talk with our team.
Sources
- Texas Identity Theft Enforcement and Protection Act (Business & Commerce Code Chapter 521), Texas Legislature
- Data Breach Reporting, Texas Attorney General
- Consumer Data Protection (Business & Commerce Code Chapter 541), Texas Legislature
- Insurance applications under scrutiny: lessons from Travelers v. ICS, Reed Smith
- FTC Safeguards Rule: What Your Business Needs to Know, Federal Trade Commission