Cyber insurance through Nationale-Nederlanden
In a cyber incident the first twenty-four hours are decisive. Who you may call then, and who pays that bill, is not in the brochure but in the policy conditions.
- Several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
This page in another language: Nederlands
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
- Independent advice
- Several insurers
- Switching arranged
- Help with claims
In brief
Finass acts as intermediary for the business range of Nationale-Nederlanden and sets it objectively alongside more than thirty other companies. The choice follows from what cover you need and not from any preference. Cyber insurance in fact consists of three parts: help during the incident, your own loss and liability towards others. The first part is the most valuable, because it buys you a forensic investigator, a lawyer and a communications adviser within a few hours. The main structure is set out on the cyber insurance hub page.
Where a claim goes wrong is almost never the question of whether there was a hack. It goes wrong on the application questions. Insurers now ask expressly about multi-factor authentication on login points from outside, about offline or immutable back-ups and about installing security updates in good time. Anyone who answers yes there and does not have it runs into Articles 7:928 and 7:930 of the Dutch Civil Code: the duty of disclosure when entering into the insurance. Where a statement is incorrect, the payout may be reduced or lapse entirely.
Also note the sub-limits. Loss of money through a forged payment instruction or a manipulated invoice is not paid under the main limit on many policies, but under a separate, considerably lower section for fraud and social engineering — often on condition that two-person authorisation applies to changes of bank account numbers. Compare that point expressly. For interruption with a physical cause, such as a fire in the server room, the business interruption insurance the appropriate policy.
This page deals with one situation. The full overview is on Compare business cyber insurance.
Independent, personal, sorted quickly
We compare your cyber insurance across dozens of insurers, explain where the real differences lie, and arrange the switch from start to finish — without you having to chase it yourself.
Cyber insurance
Compare
Get coveredWhy arrange it through Finass Verzekert?
We look at the terms as well as the premium, and stay your point of contact when there is a claim.
Independent
We are not tied to one insurer and compare on the basis of an objective analysis of several companies.
One fixed adviser
You call or email someone who knows your file. No menu options, no changing call centres.
Switching without hassle
We cancel your old policy and align the start date, so you are never a day without cover.
Help with claims
We report the claim and monitor how it is handled. In urgent cases you can reach us on the emergency line.
What to look out for
Four subjects that are more often decisive in a cyber claim than the sum insured.
Reporting goes through the emergency number, not through your own IT provider
Almost every cyber policy requires you to call the incident number before any costs are incurred. If you set your own system administrator to work and forward the invoice later, that invoice may fall outside the cover. Article 7:941 of the Dutch Civil Code also requires you to report as soon as you are reasonably aware of the incident and to cooperate with the investigation.
What is structurally outside the cover
Excluded are, among others administrative fines and penalty payments, including those of the Autoriteit Persoonsgegevens (the Dutch data protection authority); loss caused by a vulnerability for which an update had been available for some time and that you had not installed; and the costs of replacing or improving your systems beyond the level they were at before the incident. Acts of war and attacks attributed to a state are also generally among the exclusions.
A ransom is a separate decision
Payment of a ransom in a ransomware attack is sometimes included, but always with the insurer's prior consent and after a sanctions check. Without that consent you pay at your own expense. In all cases, keep a clean back-up separated from the network: that is the only measure that makes the discussion about paying unnecessary.
Outdated software and end of support
If you are still running an operating system or server package for which the supplier no longer provides updates, say so in the application. Insurers sometimes exclude those systems or set a higher excess for them. Not declaring it while still running on it is the most common reason for a reduced payout after a successful attack.
What does your premium depend on?
- Annual turnover: the usual basis for the premium
- Volume and nature of the personal data: medical or financial data weighs more heavily
- Multi-factor authentication: on email, VPN and administrator accounts
- Back-up strategy: frequency, retention period and whether there are offline copies
- Dependence on cloud suppliers: an outage at a hosting provider affects you directly
- Limit and excess chosen: per claim and per insurance year
Insurers weigh these details differently. That is where your saving is.
What is covered
| Situation | Basic | Extended |
|---|---|---|
| Ransomware encrypts your servers and you cannot invoice for three days | Yes | Yes |
| An employee emails a file with customer data to the wrong address | Provided that | Yes |
| The turnover you lose because your webshop is offline for a week | No | Yes |
| A customer holds you liable because his data is public after your data breach | No | Yes |
| Your hosting provider is down for two days and your staff cannot work | No | Provided that |
| Your design drawings are copied and turn up at a competitor | No | No |
The incident team is the starting point in almost every version. Your own loss of turnover and liability towards customers are separate sections.
Frequently asked questions
This is what people ask us most.
I have been defrauded with a false invoice. Is that covered?
Usually only under the separate section for fraud and social engineering, with its own limit that is lower than the main cover. It is often a condition that changes of bank account numbers are verified by telephone on a known number. If that procedure does not exist or was not followed, the insurer may limit the payout.
What if my hosting provider is down and I am not?
Failure at a service provider falls under an extension often called contingent business interruption. Without that extension the policy requires an incident in your own network. Have it recorded which suppliers count and from how many hours of downtime the cover starts, because there is almost always a waiting period in hours before anything is paid.
Does the policy cover the claim of customers whose data has leaked?
The liability section is intended for that: claims from individuals for unlawful processing or inadequate security, together with the costs of defence. The basis of such a claim is generally Article 6:162 of the Dutch Civil Code. The fine the regulator imposes on you is expressly not included, because that is a penalty and not compensation for loss.
Do I need this in addition to professional indemnity insurance (BAV)?
Yes, they are different risks. A professional indemnity insurance concerns errors in your advice or work. The cyber policy concerns a breach of your systems and the costs of recovery, investigation and notifications. Where a customer file leaks, both may be touched, and it is then helpful for the policies to sit with the same adviser so that coordinating them does not land on you.
Every situation is different. For these situations we have a separate page.
- Compare business cyber insuranceThe main page
- Cyber insurance for GPsGP system failure, medical data breach, incident response
- Cyber insurance for your businessIncident response, business interruption, data breach
- Cyber insurance through Hienfeld
- Cyber insurance for self-employed professionalsCustomer data, incident response, small business
- Cyber insurance for businessesRansomware, data breach, interruption