Most Ontario small businesses now depend on computers for billing, booking, payroll, and customer records. When ransomware locks those systems, the business often cannot operate until access is restored. Cyber insurance exists for that kind of disruption, but the coverage varies a lot from one policy to another, and the details matter more than the product name.
This guide explains what a typical cyber policy for a small business covers, what ransomware coverage usually includes, what it usually leaves out, and which questions are worth asking before renewal. It is general information about how these policies usually work in Ontario, not a promise about any specific policy. Policy wordings differ, so the wording of your own policy is the final word.
What cyber insurance usually covers
A cyber policy for a small business typically bundles several coverages. The most relevant ones are first party coverages, which pay for the business's own losses, and third party coverages, which respond when customers or others claim against the business.
First party coverage often includes the cost of restoring data and systems, hiring forensic specialists to find out how the attack happened, notifying affected customers where the law requires it, and public relations help to protect the business's reputation. It may also cover lost income while systems are down, which is often called business interruption or dependent business interruption when a third party provider is affected.
Third party coverage typically responds to claims that the business failed to protect someone else's information, or that a privacy law was breached. This can include defence costs and settlements, subject to the policy limit. For a business that stores customer names, emails, payment details, or health related information, this side of the policy deserves as much attention as the first party side.
What ransomware coverage usually includes
Ransomware coverage usually sits inside the cyber policy rather than as a separate product. When ransomware encrypts a business's files, the policy typically responds to the costs of investigating the attack, restoring systems from backups, and rebuilding data that cannot be recovered. If the business pays specialists to negotiate with the attacker or to verify that decryption tools are legitimate, those costs are often covered too.
Whether a policy covers a ransom payment itself depends on the wording. Some policies include it, often with conditions such as prior insurer consent and law enforcement notification. Others exclude it or cover it only up to a sublimit that is much lower than the overall policy limit. This is one of the first things to check, because a ransom sublimit can be a small fraction of the headline limit.
Coverage for lost income during a ransomware shutdown is also typically subject to a waiting period, often measured in hours. Income lost during the waiting period is usually not covered, and income lost after it is covered up to the policy limit and the indemnity period. Knowing both numbers before an incident happens makes the coverage much easier to use when it matters.
What cyber coverage usually does not cover
Cyber policies usually do not cover everything connected to an attack. Physical damage to property is typically handled by a property policy, not a cyber policy. Bodily injury claims are usually excluded as well. Losses caused by a failure to maintain basic security, such as running unsupported software long after support ended, can also be a problem if the policy has a security requirements condition.
Many policies also exclude losses from war or state sponsored attacks, and some exclude attacks on critical infrastructure. Prior known incidents are usually excluded too: if the business already knew about a breach before buying the policy and did not disclose it, related claims will typically be denied. Honest disclosure at application time protects the coverage later.
How limits, sublimits, and deductibles work
The headline limit is not the only number that matters. Cyber policies are full of sublimits that cap specific parts of the coverage, such as notification costs, forensic costs, ransom payments, and dependent business interruption. A policy with a one million dollar limit might cap ransom payments at one hundred thousand dollars, for example. Reading the sublimits is essential.
Deductibles also vary. Some policies use a single deductible for the whole incident, while others apply separate retentions to different coverages. A waiting period for business interruption acts like a second deductible measured in time rather than money. Ask your broker to walk through a sample incident, such as a three day shutdown, and show what the policy would pay and what it would not.
Questions to ask before renewal
Start with backups. Insurers often ask whether backups are encrypted, stored separately from the main network, and tested regularly. A business that can restore from backups quickly may never need to consider a ransom payment, and that fact often improves both pricing and coverage.
Ask whether the policy requires multi factor authentication for remote access and email, and whether the business meets that requirement today. Ask what the ransom sublimit is, what the waiting period is, and whether dependent business interruption covers a cloud provider outage. Finally, ask who to call first during an incident. Most cyber policies include a breach response hotline, and calling it early usually preserves coverage and speeds up recovery.
Cyber insurance does not replace good security, and good security does not replace insurance. The two work together: backups, authentication, and staff training reduce the chance and size of an incident, and the policy covers the costs that remain. Reviewing both sides at renewal is the practical move.