Cost Estimates, Best-Fit Selection and Checklists
Cyber insurance for Indian MSMEs: what it covers and how managed security affects it
Basics of business cyber insurance in India — first-party and third-party cover, exclusions, proposal-form security questions, panels, and how MDR, MFA and backups affect cover and premium.
Cyber insurance for a business typically pays for your own costs after an incident (forensics, data restoration, business interruption, notification) and for claims by others (liability for data breaches, defence costs, sometimes regulatory proceedings where insurable), up to a limit and after a deductible. In India it is sold by general insurers regulated by IRDAI, and wordings differ a lot between policies. Insurers increasingly ask detailed security questions in the proposal form: multi-factor authentication, endpoint detection, backups, patching and incident response. A managed security service does not replace insurance, but it often decides whether you can get cover and on what terms. This guide gives the basics with hedges; it belongs to the best-fit selection method and is not insurance advice.
What is commonly covered (varies by policy)
| Cover | What it pays for | Typical questions to ask |
|---|---|---|
| Incident response costs | Forensic investigation, legal advice, IT specialists | Must you use the insurer's panel? |
| Data restoration | Recovering or recreating data and systems | Is hardware replacement included? |
| Business interruption | Lost profit during downtime after a cyber event | Waiting period before cover starts (in hours) |
| Cyber extortion | Response to ransomware demands | Conditions, law and insurer consent |
| Privacy and data liability | Claims by individuals or customers after a breach | Defence costs inside or outside the limit? |
| Regulatory proceedings | Defence and, where insurable by law, penalties | Whether DPDP penalties could be insurable is a legal question |
| Notification and monitoring | Informing affected people, helplines | Sub-limit |
| Social engineering / funds transfer fraud | Money lost to fake payment instructions | Often a small sub-limit or excluded |
Common exclusions and conditions
- Known incidents before the policy start, and prior acts before a retroactive date.
- Failure to maintain security measures you declared in the proposal (for example MFA on email).
- Unpatched known vulnerabilities beyond a stated period, in some wordings.
- War and state-backed attacks, with wording that varies.
- Infrastructure failure (power, internet backbone) not caused by a cyber event.
- Contractual liability you took on beyond what the law imposes.
- Fines and penalties that are not insurable by law.
Read the wording, not the brochure.
How security controls affect cover
| Control | Why insurers ask | What a managed service can provide |
|---|---|---|
| MFA on email, remote access and admin accounts | Stolen passwords are a common entry point | Policy and monitoring of identity logs |
| EDR or MDR on all endpoints | Detects and stops ransomware | 24×7 detection and containment |
| Offline or immutable backups, tested | Recovery without paying ransom | Backup monitoring and restore tests (if in scope) |
| Patch management | Known vulnerabilities | Reporting on missing patches |
| Incident response plan | Faster, cheaper claims | IR retainer or plan from vCISO |
| Email security and awareness | Phishing | Filtering and phishing simulations |
If your proposal form says "24×7 monitoring is in place", make sure the contract actually covers 24×7, every endpoint and the cloud mailbox. A gap between what you declared and what you had can affect a claim.
Premium and deductible: an illustrative way to think
Insurers price on turnover, sector, data held, past incidents and controls. As a purely illustrative way to compare options:
| Option | Limit | Deductible | Annual premium (illustrative) |
|---|---|---|---|
| A | ₹1 crore | ₹2,50,000 | ₹1,20,000 |
| B | ₹2 crore | ₹5,00,000 | ₹1,80,000 |
In an incident costing ₹40 lakh, A pays ₹37.5 lakh and you bear ₹2.5 lakh; B pays ₹35 lakh and you bear ₹5 lakh. In a ₹1.5 crore incident, A pays ₹1 crore (limit) and you bear ₹50 lakh; B pays ₹1.45 crore and you bear ₹5 lakh. The extra ₹60,000 premium for B only matters in the larger incident. Check sub-limits too: business interruption or extortion may have their own lower caps.
Panels and your providers
Many policies give access to an insurer-appointed panel of incident-response, legal and PR firms. If you already have an MDR provider or IR retainer, ask the insurer before an incident whether your provider can be used and how costs will be treated.
Steps before buying
- List your controls honestly; fix MFA and backups first, they are often decisive.
- Ask a broker or insurer for two or three wordings and compare limits, sub-limits, waiting periods and exclusions.
- Check the policy's incident notification requirement (often immediate or within a short period) alongside the CERT-In six-hour duty.
- Keep evidence of controls: MDR reports, backup test logs, VAPT reports.
- Review cover at each renewal against changes in your business and the DPDP obligations from 13 May 2027.
FAQ
Does managed security lower the premium?
It can improve terms or make cover available, depending on the insurer. There is no fixed discount; ask.
Are DPDP penalties covered?
That depends on the wording and on whether such penalties are insurable under Indian law, which is a legal question. Do not assume they are.
Is cyber cover part of our business package policy?
Sometimes a small extension is included. Check its limit and conditions; it is often much narrower than a standalone cyber policy.
Sources
- IRDAI — insurance regulator; check that an insurer is registered
- Bima Bharosa — IRDAI grievance system
- Council for Insurance Ombudsmen — complaints against insurers (check eligibility for business policies)
- CERT-In — incident reporting
