Incident response
- Reporting number outside office hours
- Forensic IT investigation
- Legal and communications support
- Support with the notification to the AP
Incident response · business interruption · data breach
Cyber insurance for your business
Cyber insurance does not only pay the loss after a hack; above all it puts specialists to work immediately to stop the incident. The cover stands or falls with the security requirements the insurer sets in advance.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
Deze pagina in het Nederlands: Cyberverzekering voor uw bedrijf.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Cyber insurance covers the consequences of an attack on, or a failure in, your own systems. The emphasis lies on incident response: a reporting number available 24 hours a day, forensic investigation, help in restoring data and systems and legal assistance after a data breach. On most policies that help is the most valuable component, because the first hours determine how large the loss becomes.
There are two kinds of loss alongside it. Own damage: the restoration of data and systems and the loss of turnover for as long as you cannot work, or can only work in a limited way. And liability: claims from customers, suppliers or employees whose data has leaked, generally based on tort (Article 6:162 of the Dutch Civil Code), plus the costs of informing those concerned and of the proceedings before the regulator.
Important to know in advance: insurers only accept you after a questionnaire about your security, and the answers to it become part of the policy. If what you stated is missing when a loss occurs — two-factor authentication or a working back-up outside the network, for example &mdash. The payout may lapse. See also the version for self-employed professionals.
What does cyber insurance cover?
The cover falls into three parts: help during the incident, your own loss and liability towards others.
Repair and downtime
The costs of recovery and the loss of turnover for as long as you cannot work normally.
- Restoring data and systems
- Loss of turnover after a waiting period
- Additional costs of continuing to work
- Sometimes ransomware, subject to conditions
Liability
Claims and costs when other people's data has been leaked from your systems.
- Defence against claims
- Informing data subjects
- Costs of the proceedings before the AP
- Administrative fines fall outside this
What is covered
| Situation | Basic | Extended |
|---|---|---|
| Investigation and containment immediately after a hack | Yes | Yes |
| Restoring data, systems and websites | Yes | Yes |
| Loss of turnover from business interruption | Provided that | Yes |
| Payment in a ransomware attack | No | Provided that |
| Loss through a fraudulent payment instruction | No | Provided that |
| Administrative fine from the regulator | No | No |
What is actually covered, including exclusions, limits, the waiting period and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) you receive before you take out cover.
Where things go wrong in practice
Four points that determine whether the policy actually pays after an incident.
The security requirements are not advice but a condition
Insurers ask about two-factor authentication on email and remote access, about back-ups that are kept separate from the network and tested periodically, and about updating software. What you enter falls under the duty of disclosure under Article 7:928 of the Dutch Civil Code. If the picture does not match at the time of a claim, the insurer can reduce or refuse the payout under Article 7:930 of the Dutch Civil Code. So go through the questionnaire together with your IT manager.
Downtime costs more than the ransom
The largest item is rarely restoring a server, but the period in which you cannot produce, invoice or deliver. So look at two things: the waiting period before the business interruption cover starts, and the indemnity period over which the loss is compensated. Anyone who cannot substantiate turnover week by week faces a difficult conversation afterwards; set out what records you can produce during downtime.
What is not included
Among the things that fall outside the cover are incidents and vulnerabilities that were already known before the start date, and loss caused by software for which the supplier no longer provides support, and damage caused by acts of war and attacks by or on behalf of a state. Also administrative fines are generally not insurable under Dutch law, and loss caused by intent or recklessness of the insured is excluded under Article 7:952 of the Dutch Civil Code. Failure of the power supply or the telecoms network also falls outside the policy in almost every case.
Call the insurer first, an IT firm afterwards
Report an incident as soon as reasonably possible; Article 7:941 of the Dutch Civil Code requires you to do so, and reporting late costs you cover. If you engage a forensic firm yourself without consent, those costs are often not reimbursed. Bear in mind, too, that in principle you have to report a data breach within 72 hours to the Autoriteit Persoonsgegevens (the Dutch data protection authority). The incident response service helps you meet that deadline.
Autoriteit Persoonsgegevens (the Dutch data protection authority)
What does your premium depend on?
- Turnover: the usual basis for calculation
- Sector and type of data: healthcare and web shops weigh more heavily
- Dependence on IT: how quickly your business comes to a standstill
- Security level: two-factor authentication, back-ups, patching policy
- Sum insured and waiting period: a higher limit means a higher premium
- Claims history: earlier incidents and notifications
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your situation, risk and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Frequently asked questions
This is what people ask us most.
Is cyber insurance worthwhile for a small business too?
Particularly there, because a small business rarely has a security team of its own. Attacks are largely carried out automatically and do not select by size. The practical advantage lies in the incident response service: you call one number and within a short time a specialist is available who knows which steps are needed in which order.
Is a ransom paid after a ransomware attack reimbursed?
Sometimes, and always subject to conditions. The insurer must give consent in advance, and it is assessed whether payment is legally permitted and whether there is no other way. If you pay on your own initiative, the reimbursement usually lapses. Restoring systems and the business interruption are generally more important than the ransom item itself.
Does public and employers' liability insurance not already cover this?
No. An AVB covers injury and damage to property and not the pure financial loss that arises after a data breach or systems failure. Restoring your own data and the loss of turnover through downtime also fall outside it. Professional indemnity covers professional errors, not a break-in in your network. The cyber policy fills precisely that gap.
What if the failure is at my cloud service?
That differs greatly from policy to policy. Some insurers cover failure at an external IT service provider, others exclude it or apply a separate, lower limit and a longer waiting period. Because many businesses run entirely on one cloud provider, this is one of the most important points to check before taking out cover.
Are GDPR fines insured?
Administrative fines are generally not insurable under Dutch law; they do not belong on a policy. What is usually reimbursed are the costs of legal assistance during the investigation by the Autoriteit Persoonsgegevens, informing those concerned and the loss those individuals recover from you themselves.
How quickly can I be insured?
Where turnover is limited, a short questionnaire is often enough and acceptance is possible within a few working days. Larger businesses or sensitive sectors receive further questions about back-ups, access management and past incidents. Make sure the answers are demonstrably correct. That is the basis on which a claim is later assessed.
Read more
Within Cyberverzekering
Similar pages
Want to know what your risk costs?
Request a quote without obligation. We set out the security requirements and the waiting period of each insurer side by side.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was written and checked by an adviser at Finass Verzekert. Last updated on .
The information on this page is general in nature and is not personal advice.