IT risks sit across several policies
A burst pipe that destroys the comms cabinet, a power surge that kills a server, a stolen laptop full of client files, a week offline because of a fibre fault, a fraudulent invoice that diverts a supplier payment and a ransomware attack are all IT-related losses. Each may fall under a different policy, or under none. Owners often assume one policy covers everything, only to discover at claim time that it does not.
Start by listing your main technology-related risks, ideally from your IT risk register, then sit down with your broker and ask which policy, if any, would respond to each one. The answers are often surprising, and the conversation is far more useful before an incident than after. This is general information only, and your broker and policy wording are the authority on your cover.
Equipment and material damage
Computers, servers, network equipment and phones are usually covered for physical loss or damage under a business contents or material damage policy, sometimes with specific conditions for portable equipment taken outside the office. Check whether laptops are covered when staff take them home or travel, whether there are limits per item, and whether cover is for replacement or indemnity value.
Keep your asset register up to date with purchase dates and costs, because it makes claims faster and helps you check that the sum insured is realistic. Underinsurance is common when equipment has been added over time without the policy being updated. Ask whether data restoration costs are covered after physical damage, since rebuilding systems can cost more than the hardware.
Business interruption and lost income
Business interruption cover is designed to replace lost income and pay extra costs when the business cannot trade normally, but many policies only respond when the interruption follows physical damage to your premises or property. An outage caused by an internet provider fault, a cloud service failure or a cyber attack may not be covered unless the policy specifically extends to it.
Ask your broker what triggers business interruption cover, whether there is a waiting period before it applies, and whether it extends to failures of suppliers or utilities you depend on. Your downtime cost calculation helps here, because it gives a realistic figure for what an interruption would actually cost and whether the cover is proportionate.
Liability and professional indemnity
If a mistake involving technology harms a client, for example by sending confidential information to the wrong person, losing client data or giving advice based on faulty data, professional indemnity or liability policies may be relevant. Some policies exclude losses arising from cyber events or data breaches, assuming a separate cyber policy will handle them.
Check how your liability policies interact with any cyber cover, so there are no gaps between them. Contracts with larger clients may also require specific insurance types and minimum amounts, and those requirements increasingly include cyber or data-related cover. Make sure your policies match what you have promised in contracts. A quick comparison of client contract clauses against your policy schedule, done once a year, catches most mismatches.
Conditions and assumptions inside policies
Many policies, particularly cyber policies, include conditions about the security measures you have in place, such as multi-factor sign-in, regular backups, updated software and staff training. Answers you give in a proposal form or questionnaire can form part of the contract. If they turn out to be inaccurate, or if controls lapse, the insurer may have grounds to reduce or decline a claim.
Treat those answers seriously and keep evidence that the controls exist and continue to operate. Review them at each renewal. If something changes, such as switching off a security tool or moving systems, ask your broker whether you need to notify the insurer. Some policies require you to tell the insurer about material changes during the policy period, and failing to do so can affect cover. A short note to the broker costs nothing and removes the doubt.
Practical steps before renewal
Before each renewal, update your asset register, review your risk register, confirm your security controls are still working and recalculate your downtime cost, so the figures you give the broker reflect the business as it is today rather than when the policy was first taken out. Share the relevant information with your broker and ask specifically about gaps involving technology, payment fraud, suppliers and data. Keep a copy of the proposal answers you submitted.
Insurance is a backstop, not a substitute for good controls. The best outcome is never needing to claim, and the controls insurers ask about are largely the ones that prevent incidents in the first place. An IT health check before renewal can confirm what is in place, which makes the questionnaire easier to complete accurately.
In short
- IT losses can fall under several policies, or none.
- Check portable equipment, data restoration and sums insured.
- Business interruption may only follow physical damage unless extended.
- Keep evidence that security controls stated to insurers stay in place.