Incident response
- 24/7 reporting line
- Forensic investigation
- Recovery and restart
Cyber insurance for IT companies
Anyone who manages other companies' systems is left, after a break-in, not with one loss but with the loss of every customer connected to that management access.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
This page in another language: Nederlands
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
- Independent advice
- Several insurers
- Switching arranged
- Help with claims
In brief
An IT company usually processes little personal data itself. The risk lies in the management layer: your RMM tooling, your password vault, the VPN connections and the administrator accounts you hold in every customer environment. Anyone who gets in there is not in one network but in dozens at once, with rights nobody has to work around.
As a result, the emphasis of your policy lies not on recovering your own data but on liability. Your customers claim their downtime, their recovery costs and their own data breach costs from you, partly under the management agreement and partly under Article 6:162 of the Dutch Civil Code. Your sum insured has to be able to carry those claims added together, not those of one customer.
If you build software yourself or manage websites rather than infrastructure, also look at the cyber insurance for software companies, the version for hosting companies or the one for web agencies.
Independent, personal, sorted quickly
We compare your cyber insurance across dozens of insurers, explain where the real differences lie, and arrange the switch from start to finish — without you having to chase it yourself.
Cyber insurancePhoto coming soon
ComparePhoto coming soon
Get coveredPhoto coming soon
What does cyber insurance for IT companies cover?
The structure of the cover in three parts, with an overview per situation below.
Own damage
What the incident costs you yourself.
- Data recovery and reconstruction
- Business downtime
- Ransom under consideration
Liability
Claims from customers and data subjects.
- Claims after a data breach
- GDPR notification costs
- Legal assistance
What is covered
| Situation | Cyber | AVB | BAV |
|---|---|---|---|
| Ransomware brings your systems down | Yes | No | No |
| Data breach involving personal data | Yes | No | Sometimes |
| Costs of notification and informing those affected | Yes | No | No |
| Fraud through a falsified payment instruction | Sometimes | No | No |
| Administrative fine from the regulator | No | No | No |
| Hardware that is physically damaged | No | No | No |
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
What does your premium depend on?
- Number of customer environments managed. How many organisations are reachable through one compromised management account determines the maximum accumulation.
- Set-up of management access. Two-factor authentication on RMM and the password vault, separate management accounts per customer, and management work kept apart from office work.
- Turnover from management and support contracts. Recurring management turnover weighs more heavily than turnover from one-off hardware supplies.
- Limitation of liability in your terms. A limit per event and per year caps what customers can recover from you and with it your exposure.
- State of back-up and recovery at your customers. Offline or immutable back-ups that you demonstrably test shorten the downtime you have to compensate.
- Dependence on underlying suppliers. If you run customer work on third-party cloud or hosting services, an outage at that party counts in your risk.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your activities, turnover and wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
Why arrange it through Finass Verzekert?
We look at the terms as well as the premium, and stay your point of contact when there is a claim.
Independent
We are not tied to one insurer and compare on the basis of an objective analysis of several companies.
One fixed adviser
You call or email someone who knows your file. No menu options, no changing call centres.
Switching without hassle
We cancel your old policy and align the start date, so you are never a day without cover.
Help with claims
We report the claim and monitor how it is handled. In urgent cases you can reach us on the emergency line.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Your management access is the real question on the policy
At an IT company, insurers look above all at how your management environment is arranged: separate administrator accounts per customer, two-factor authentication on the password vault and on the RMM console, and management work that is not done from an ordinary office account. What you state about this on the application is a disclosure within the meaning of Article 7:928 DCC. If it turns out afterwards that the stated measure was not in place, the insurer can invoke Article 7:930 DCC and pay less or nothing.
What your customers can claim is set out in your own terms
At management companies the size of a claim is rarely determined by the attack but by your contract. If you have limited liability per event and per year, that is your ceiling. If you have not, it is up to the court. Note that liability which you took on contractually without having it in law, such as penalty clauses in an SLA and guaranteed availability percentages, is excluded on almost every cyber policy.
Redoing your own work is not an insured loss
If after an incident you have to run a migration again, put right a wrongly configured firewall or spend hours correcting something you should have done properly yourself, those are costs of re-performing your own work. They fall outside the cover. The policy pays the customer's loss, not your own unpaid hours. Intent and wilful recklessness on your part or that of a director are also excluded, as Article 7:952 DCC allows.
Pass reports on in time as a processor
For your customers you are usually the processor. If you discover an incident, you have to inform the clients concerned without undue delay, because they are the ones who have to report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours. Towards your insurer the duty to report under Article 7:941 DCC applies: report as soon as you become aware of it. Reporting late costs the insurer evidence and scope for investigation and may affect your right to a payout.
Frequently asked questions
This is what people ask us most.
Are my customers' claims covered if the attack came in through me?
That is exactly what the liability section is for: loss suffered by third parties because their data or their operations were affected through your systems. Your sum insured does, however, apply per insurance year for all customers together. In an incident affecting dozens of environments, that is the point at which too small a sum hurts. So set the sum against the largest simultaneous outage you can imagine, not against one customer.
Does the policy pay for the hours my team spends putting everything right?
Recovery at your customers that results from the incident can count as loss; hours you spend correcting your own error or your own delivery do not. Insurers separate recovery of third-party loss from re-performing your own work. So during an incident, record which hours are attributable to which customer and which cause; reconstructing that afterwards rarely works.
I am a processor. Who has to report the data breach to the Autoriteit Persoonsgegevens?
Your client, because he is the controller. Your obligation is to inform him without delay as soon as you know of the breach, so that he meets his deadline. When it comes to it you often carry out the reporting for him. The costs of that reporting process and of informing those concerned fall under the notification costs cover, provided you reported the incident to the insurer in good time.
Do I still need professional indemnity insurance alongside this?
Usually yes. The cyber policy works from a security incident: a break-in, ransomware, a data breach. Wrong advice, a migration you planned badly or a system you deliver in an unsound state without any attack being involved belongs with professional indemnity. When advising, we look at how the two policies join up, so that nothing falls between them.
Every situation is different. For these situations we have a separate page.
- Compare business cyber insuranceThe main page
- Cyber insurance for web agenciesClient websites, management access, hosting
- Cyber insurance for software companiesSource code, customer systems, supply chain risk
- Cyber insurance for marketing agenciesClient accounts, advertising budget, data
- Cyber insurance for hosting companiesCustomer systems, downtime, supply chain
- Cyber insurance for webshopsPayment details, customer data, downtime
- Cyber insurance for shopsTill system, card terminal, customer data
- Cyber insurance for dental practicesPatient records, X-rays, downtime
- Cyber insurance for psychologistsTreatment records, confidentiality, duty to report
Ready to compare?
Request a quote without obligation. We will look at which insurer best matches your activities and your risk.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was compiled by Finass Verzekert (LinkedIn). Last updated on .
The information on this page is general in nature and is not personal advice.