Five years ago, cyber insurance was something only large enterprises worried about. Today, it's becoming a requirement for businesses of every size, especially in Canada, where data privacy regulations under PIPEDA carry real consequences.

If you're running a business in Ontario with 10 to 200 employees, chances are your clients, vendors, or partners are already asking whether you carry cyber insurance. Some won't sign contracts without it.

What Does Cyber Insurance Cover?

Cyber insurance (sometimes called cyber liability insurance) typically covers the costs associated with a data breach or cyberattack. This includes:

Incident response costs: forensic investigation, legal counsel, and breach notification
Business interruption: lost revenue during downtime caused by a cyberattack
Data recovery: costs to restore or recreate lost data
Ransomware payments: some policies cover ransom payments (controversial, but available)
Legal liability: lawsuits from affected customers or partners
Regulatory fines: penalties from the Office of the Privacy Commissioner under PIPEDA
Public relations: reputation management after a breach

What Do Insurers Require?

This is where most businesses get stuck. Cyber insurance isn't just about paying a premium; insurers want to see evidence that you are protecting your business. If you can't demonstrate basic security hygiene, you'll either be denied coverage or pay significantly higher premiums.

Here's what most Canadian cyber insurers now require as minimums:

1. Multi-Factor Authentication (MFA)

This is the single most common requirement. Insurers want MFA enabled on all email accounts, VPN access, and administrative portals. If you're using Microsoft 365, this means enabling MFA through Azure AD at minimum.

2. Endpoint Detection and Response (EDR)

Basic antivirus is no longer sufficient. Insurers expect EDR solutions that can detect, investigate, and respond to threats in real time. Products like SentinelOne, CrowdStrike, or Microsoft Defender for Business meet this requirement.

3. Regular Backups

You need to demonstrate that your data is backed up regularly and that backups are stored separately from your production environment. Cloud backup solutions for Microsoft 365 (Exchange, OneDrive, SharePoint) are increasingly expected.

4. Security Awareness Training

Insurers want proof that your employees receive regular security training, including phishing awareness. Annual training is the minimum; quarterly is better.

5. Patch Management

Operating systems and software must be kept up to date. Insurers may ask about your patch management process and how quickly critical vulnerabilities are addressed.

6. Incident Response Plan

Having a documented plan for what happens when (not if) a breach occurs. This includes who to contact, how to contain the breach, and how to notify affected parties.

The Cost of Not Having Coverage

The average cost of a data breach in Canada reached CAD $6.32 million in 2024 according to IBM's annual Cost of a Data Breach Report. The figure is a national average across organizations of all sizes, and even a fraction of it can be devastating for a small business.

Beyond the financial impact, a breach without insurance means:

You pay for forensic investigation out of pocket
You personally handle legal notification requirements under PIPEDA
You absorb all business interruption losses
You may lose clients who require their vendors to carry coverage

How to Get Started

The good news is that getting cyber insurance isn't complicated if your security foundations are in place. Here's a practical path:

Assess your current security posture: Do you have MFA, EDR, backups, and training in place?
Fill the gaps: A managed IT provider can help you implement what's missing quickly
Document everything: Insurers want proof, not promises. Keep records of your security measures.
Get quotes: Work with an insurance broker who specializes in cyber liability
Review annually: Cyber insurance requirements evolve as threats change

How ClayGen Can Help

At ClayGen, we help Ontario businesses meet cyber insurance requirements as part of our managed IT services. We handle MFA deployment, EDR setup, backup configuration, and security training so you can focus on running your business. Through ClayGen Connect, you get a clear view of your security posture and compliance status, which makes renewal conversations with your insurer straightforward.

If you're not sure where your business stands, we offer a free security assessment that maps directly to what cyber insurers are looking for. Get in touch to schedule yours.

For the broader view of this topic, see our complete cybersecurity guide for Canadian SMBs.

Does Your Business Need Cyber Insurance? A Canadian SMB Guide