Hienfeld · compared independently · advice from Finass
Cyber insurance through Hienfeld
In the cyber product we arrange through Hienfeld the emphasis lies on carrying on: getting systems back up and covering the turnover you lose in the meantime.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your situation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
A cyber policy can put heavy emphasis on two very different things: your own recovery, or the claim someone else brings against you. We mainly use the product we arrange with Hienfeld for Dutch businesses with a physical operation (manufacturing, wholesale, installation, healthcare practices) where the question after an attack is not who holds you liable, but how many days you are at a standstill.
That determines what to look at when comparing: the waiting period before the business interruption cover starts running, the indemnity period after that, and whether recovery of data and software also counts where the hardware itself was untouched. We set that alongside the general cyber cover and alongside what other insurers offer on this point.
If your emphasis lies instead on claims from customers whose data you processed, a different focus makes more sense. You can read about that on our page about cyber insurance through Hiscox. We are tied to neither and choose on the basis of your own situation.
The structure of the cover in three parts, with an overview per situation below.
Basic cover
The basic cover insures the essentials. We show what Hienfeld and other insurers offer here.
24/7 incident response (First Response)
Restoring systems, data & software
Forensic & IT investigation
Reporting a data breach (GDPR)
Extended cover
As well as restoration and assistance, also liability towards third parties, business interruption during downtime and crisis management.
Cyber liability (third parties)
Business interruption / network outage
Cyber extortion & ransomware
Crisis management & reputation repair
Complete package
The most complete cover. We compare Hienfeld's extended versions with the market.
Fines from the regulator (AP / PCI-DSS)
Defence & legal costs
Worldwide cover
Retroactive cover (prior risk)
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Provided it is declared
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Provided it is declared
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
What we do
What we do
At Finass
Direct with Hienfeld
Comparison across several insurers
Yes
No
Advice based on your own situation
Yes
Sometimes
One point of contact for claims
Yes
Sometimes
Cancellation with your current insurer arranged
Yes
No
We determine whether Hienfeld is the best choice
Yes
No
Advice fees for you as a customer
No
No
This overview concerns our service, not the cover. What is actually covered is set out in the policy conditions and on the insurer's insurance card (verzekeringskaart); you receive both before you take out cover.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Downtime is the largest item here
After a ransomware attack the loss rarely lies in broken equipment but in the days on which nothing happens: no orders, no invoices, no planning. The cover for network interruption has a waiting period before it starts running and a maximum indemnity period after that. Generally outside the cover are contractual penalties your customer imposes on you and the loss of turnover that only arises later because customers have gone elsewhere.
Back-ups and two-factor authentication are not advice but a condition
In products of this kind, prevention requirements appear in the policy itself: multi-factor authentication on access from outside, a back-up kept separate from the network and a patching policy. If you state that situation differently in the application from how it really is, you engage the duty of disclosure under Article 7:928 of the Dutch Civil Code and its consequences in 7:930 DCC. A known vulnerability you left open for months is generally excluded.
With extortion, paying is not the first answer
The incident team first looks at whether recovery from a clean back-up is possible. Only then does a ransom come up. If you pay on your own initiative before the insurer is involved, the reimbursement almost always lapses. Sanctions legislation may also prohibit payment, whatever the policy says. So report first, and record when you discovered what. That account later determines the size of your claim.
Reporting to the insurer is separate from reporting to the regulator
You have two clocks running. The policy requires a report as soon as you are reasonably aware of the incident. That is the duty to report under Article 7:941 of the Dutch Civil Code. The GDPR also requires you to report a data breach to the Autoriteit Persoonsgegevens (the Dutch data protection authority), with its own deadline and its own register. Reporting late to the insurer costs you cover; reporting late to the regulator costs you a fine. Set up both reporting routes in advance.
Retroactive cover (prior risk)
Retroactive cover (prior risk) Included for your staff during work.
Defence & legal costs
What does your premium depend on?
Annual turnover. Turnover is the basis of calculation for the business interruption component and therefore for most of the premium.
How quickly downtime hurts. A business that can carry on for a week on paper pays differently from a process that stops within an hour.
Security level. Multi-factor authentication, offline back-ups and a demonstrable patching policy determine whether an insurer is willing to accept the risk.
Waiting period chosen. The period before the network interruption cover starts running feeds straight through into the premium.
Indemnity period. How long the business interruption cover runs after an incident is your own choice. A longer period costs more.
Earlier incidents. A network previously infected or an earlier report weighs more heavily than with most other business covers.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Does this cover pay my lost turnover if everything is at a standstill?
Yes, that is the emphasis of this product. After a waiting period, compensation runs for lost gross profit and for additional costs of continuing to work, until the end of the agreed indemnity period. What your customer charges you contractually in penalties, and the loss of customers afterwards, fall outside it.
We had not patched a known vulnerability. What now?
That makes things difficult. In this type of policy prevention requirements appear as a condition, not a recommendation. A flaw that had been known for a long time and for which an update was available is generally excluded. Report the incident anyway, because the assessment turns on the actual cause and that is only established after forensic investigation.
Does the insurer pay the ransom in a ransomware attack?
Only if you report in advance and the insurer gives consent. First it is investigated whether recovery from a back-up is possible. If you pay yourself before the incident team is involved, the reimbursement almost always lapses. Sanctions legislation may also prohibit payment to a particular party. In that case the route is recovery in any event.
How does this differ from the Hiscox cyber product?
In the emphasis. Here the focus is on your own recovery and on the days you are at a standstill. In the Hiscox product, third-party claims and the costs of defence weigh more heavily. Which of the two suits you depends on whether your loss lies mainly in downtime or in other people's data.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
