Online bookings, electronic payments and customer records can make cyber risk part of everyday life for an Ontario small business. The Insurance Bureau of Canada (IBC) highlights customer data, electronic payments and digital infrastructure as areas of cyber exposure. Start with the systems and information your business depends on, then compare the actual insurance wording. IBC’s business cyber-risk guide.
1. Does the policy cover your recovery costs and claims from others?
Ask your broker to separate the costs of getting your own business back on its feet from liability claims brought by other people. Potential coverages include breach investigation, customer notification, data restoration and legal expenses. The precise protection depends on the contract.
IBC describes stand-alone cyber policies, cyber endorsements and limited protection within some traditional business policies. Ask which arrangement you are being quoted, and what its exclusions leave you to manage. IBC’s business coverage guide.
2. What has to happen before downtime is covered?
List the services that would stop you taking orders, booking appointments or issuing invoices if they became unavailable. Include outsourced systems such as cloud software and payment services.
Ask whether the quoted protection covers an incident affecting your own systems, an incident at a service provider, or both. Chubb’s Canadian product overview, for example, lists service-provider business interruption as an optional coverage. That is a useful reason to check the relevant clause in each quote. Chubb’s Canadian cyber coverage overview.
Also ask how lost income is calculated, which extra expenses qualify, whether a waiting period applies, and how long the policy will pay after a covered interruption.
3. Would a fraudulent payment instruction be covered?
An email impersonating a supplier can ask staff to send a legitimate invoice payment to a different account. The Canadian Anti-Fraud Centre warns businesses about this form of payment redirection. Confirm changed payment instructions through a trusted contact method before sending money. Canadian Anti-Fraud Centre’s business fraud guidance.
Ask specifically about social engineering, computer fraud and funds-transfer fraud, and which policy would respond. Intact lists these as separate insuring agreements within its crime offering. The label “cyber insurance” alone leaves important questions unanswered. Intact’s crime coverage overview.
4. Who helps with an incident, and what would you pay?
Before choosing a quote, ask for clear answers to these practical questions:
- What is the overall limit, and are there lower limits for particular losses?
- Which deductible or retention applies to each coverage?
- Do investigation, legal and notification costs reduce the amount left for other claims?
- Who is the incident-response contact, and when must you notify the insurer?
- Does the insurer need to approve specialists or spending in advance?
Incident support can be an important part of the product. For example, Intact’s privacy-breach offering describes access to specialist assistance, alongside specified remediation, business interruption and legal expense coverages. Check the services included in your own proposal. Intact’s privacy-breach coverage overview.
Ask who will help assess applicable privacy obligations. For organizations subject to PIPEDA, certain breaches must be reported to the Privacy Commissioner and affected individuals notified when there is a real risk of significant harm. Obtain advice promptly if an incident occurs. Privacy Commissioner’s breach-reporting guidance.
5. Can you verify the security answers on the application?
Have the person responsible for your IT check the application before it is submitted. Describe what is in place today and identify anything still being implemented.
Prepare information about multi-factor authentication, software updates, backups and recovery testing, employee training, and the systems managed by outside providers. The Government of Canada’s small-business guide provides practical steps in these areas. It is a preparation resource; the insurer sets its own application and underwriting requirements. Get Cyber Safe’s small-business guide.
Keep a written incident-response plan and an accessible offline copy of essential contacts. The Canadian Centre for Cyber Security recommends planning who will respond and considering insurance for response and recovery activities. Cyber Centre’s baseline controls.
Bring the business details to your review
Bring your current policies, the services you rely on and your verified security information to A-Z Insurance. We can help you frame the coverage questions and review available commercial insurance options.
General information checked October 13, 2026. Insurer examples illustrate coverage questions; availability and eligibility require confirmation. Actual protection depends on the issued policy, endorsements, limits, exclusions and claim circumstances. This article is general information and does not replace legal or cyber-security advice.