Cyber insurance pays to respond to a data breach or attack: forensic experts, legal advice, notifying customers, restoring systems and lost income while you are down, plus liability if customers or partners sue.

Canadian organisations covered by PIPEDA must report breaches that create a real risk of significant harm. Insurers now expect basics such as multi-factor authentication, backups and staff training before they offer coverage.