Cyber Risk for Small Texas Businesses: What Your BOP Won't Cover

Ransomware, phishing, and email fraud aren't only large-company problems. Small businesses are frequent targets precisely because they tend to have fewer defenses. And when an incident happens, many owners discover that their Business Owners Policy (BOP) offers little or no help.

What a cyber incident actually costs

The direct cost of a cyber incident goes well beyond fixing your computers. A typical small business incident can involve:

• Forensic investigators to determine what happened and what data was accessed
• Legal counsel to guide your response and notification obligations
• Notifying affected customers and, in some cases, offering credit monitoring
• Restoring or recreating lost data and systems
• Lost income while your business is down
• Ransom demands, and the specialists who negotiate them
• Lawsuits or regulatory inquiries from affected customers

For a small business, those costs can add up quickly, and many of them arrive in the first few days when cash flow is already disrupted.

Why your BOP probably isn't enough

A standard BOP is designed for physical property and general liability. Data isn't considered tangible property, and many general liability policies now exclude data breaches altogether. Some BOPs include a small data compromise endorsement, but these usually carry low sublimits and cover only a narrow set of costs. They rarely cover ransomware, business interruption from a network outage, or fraudulent wire transfers.

What a cyber policy covers

A standalone cyber policy typically includes two types of protection.

First-party coverage pays your own costs:

• Breach response, including forensics, legal counsel, and notification
• Business interruption and extra expense from a network outage
• Cyber extortion and ransomware response
• Data restoration

Third-party coverage protects you when others make claims against you:

• Privacy and network security liability if customer data is exposed
• Regulatory defense and, where insurable, fines
• Media liability for content on your website and social channels

Texas breach notification rules

Texas law requires businesses to notify affected individuals after a breach of sensitive personal information, generally within 60 days of determining that a breach occurred. If the breach affects 250 or more Texans, the business must also notify the Texas Attorney General, currently within 30 days. Meeting these deadlines while also trying to restore operations is one of the main reasons the breach response services in a cyber policy are so valuable.

Underwriters now expect basic security controls

Cyber insurance applications have become more detailed. Most carriers now ask about, and may require, controls such as:

• Multi-factor authentication on email and remote access
• Regular, tested backups stored separately from your network
• Endpoint protection on company devices
• Employee phishing awareness training

These controls lower your premium and, more importantly, lower the chance you'll ever need to file a claim.

The bottom line

If your business uses email, accepts payments, or stores customer information, you have cyber exposure. A dedicated cyber policy is the only reliable way to cover it. If you've never asked what your current policies would pay after a ransomware attack, now is a good time.

This article is for general educational purposes only and does not constitute legal or insurance advice. Breach notification requirements are summarized generally and are subject to change; consult an attorney about your obligations. Cyber coverage terms, sublimits, and underwriting requirements vary by carrier.