The short version
- Property insurance usually does not respond. Property business income generally requires physical loss or damage, which a cyberattack or outage does not cause.
- Cyber business interruption covers your own systems going down from a covered cyber event, after a waiting period measured in hours.
- Dependent business interruption covers your vendors' outages. If your scheduling, billing, payment, or practice software goes down, your income stops too.
- System failure coverage covers accidents, such as a faulty update or an IT error, with no attacker involved.
- Two 2024 events showed why: the Change Healthcare ransomware attack disrupted claims processing for health care providers across the country, and a faulty CrowdStrike software update crashed Windows systems worldwide.
Four kinds of outage, four coverage questions
| Outage | Example | Coverage needed |
|---|---|---|
| Attack on your systems | Ransomware encrypts your server | Business interruption (security failure) |
| Accident on your systems | A bad update or IT mistake takes your systems down | System failure |
| Attack on a vendor | Your cloud practice management provider is hit by ransomware | Dependent business interruption (security failure) |
| Accident at a vendor | Your payment processor's update breaks transactions for a day | Dependent business interruption (system failure) |
Many policies include the first automatically and offer the others as options or with lower sublimits. Read which ones your policy actually includes.
What the coverage pays
| Component | What it includes |
|---|---|
| Lost net income | The profit you would have earned had systems stayed up |
| Continuing normal operating expenses | Payroll you keep paying, rent, loan payments, subscriptions |
| Extra expense | Overtime, temporary staff or equipment, manual workarounds, expedited shipping, outside IT to get running sooner |
| Claim preparation costs | Some policies pay for forensic accountants to calculate and document the loss |
The terms that decide what you collect
| Term | What it means | What to look for |
|---|---|---|
| Waiting period | Hours the outage must last before coverage starts | Shorter is better; compare with how long you can operate on paper |
| Period of restoration | How long lost income is covered after the event | Whether it ends when systems are restored or when revenue recovers |
| Extended period | Extra time for revenue to return after systems are back | Valuable when customers drift away during an outage |
| Dependent business interruption sublimit | The cap for vendor outages | Often lower than the main business interruption limit |
| Named vs unnamed vendors | Some policies cover only listed vendors, or only IT providers | Whether non-IT vendors, such as a payment processor or supplier, count |
| Voluntary shutdown | Shutting systems down yourself to limit damage | Whether a precautionary shutdown is covered |
Lessons from 2024
Change Healthcare: a vendor's ransomware attack becomes your outage
In February 2024, a ransomware attack on Change Healthcare, a major processor of medical claims and payments, disrupted claims processing and payments for health care providers nationwide. Practices that never had a breach of their own still saw revenue stall. For them, the relevant coverage was dependent business interruption, and whether their policy covered an outage at a vendor like a claims clearinghouse.
CrowdStrike: an accident, not an attack
On July 19, 2024, a faulty update to CrowdStrike's security software crashed Windows computers worldwide. CISA's alert relayed CrowdStrike's confirmation that it was caused by a content update, not malicious cyber activity. Businesses that lost a day or more of operations needed system failure coverage, and if the failure was at a vendor, dependent system failure coverage. Policies limited to security failures did not respond.
How the loss is calculated
Insurers typically start from your historical results and project what you would have earned:
- Look at revenue and expenses for the same period in prior months or years.
- Adjust for trends, seasonality, and growth.
- Subtract what you actually earned during the outage.
- Add continuing expenses and extra expenses.
- Subtract the waiting period.
Good records shorten the claim. Keep monthly financial statements current, and track overtime, rentals, and other extra costs during any outage from the first hour.
How to size it
- Daily gross profit: revenue per working day minus costs that stop when you stop.
- Days offline: ransomware recovery commonly takes days to weeks. Test a restore to learn your real number.
- Single points of failure: list every vendor your business cannot operate without, including scheduling, practice management, payment, payroll, ecommerce, and phone systems.
- Seasonality: a week down in your busiest month costs more than an average week.
More on putting the numbers together in how much cyber insurance a small business needs.
Reduce the downtime, not just the loss
- Tested, separated backups shorten recovery more than anything else.
- A paper fallback for scheduling, intake, and payments keeps revenue flowing.
- Vendor contingency: know how to reach critical vendors in an outage and whether they offer manual workarounds.
- An incident response plan that names who calls the insurer, the bank, and key customers.