Cyber Insurance in Canada: Cover, Cost, and How to Qualify

Five years ago, cyber insurance was something only large enterprises worried about. Today, it's becoming a requirement for businesses of every size, especially in Canada, where data privacy regulations under PIPEDA carry real consequences.

If you're running a business in Ontario with 10 to 200 employees, chances are your clients, vendors, or partners are already asking whether you carry cyber insurance. Some won't sign contracts without it.

Do You Need Cyber Insurance?

The honest answer for most businesses is yes, and the reason is simple: cyber insurance covers a risk you already carry. If any of the following is true, you are exposed to exactly the losses a policy is designed to absorb.

• You hold personal or financial data: Customer records, payment details, employee information, or health data all trigger notification duties and liability if breached.
• You send or receive payments by email: Invoice and wire fraud (business email compromise) is one of the most common and expensive incidents for Canadian SMBs.
• You depend on email, cloud apps, or a website: Downtime from ransomware or an account takeover stops revenue, and recovery costs add up fast.
• Clients or contracts require it: Many enterprise customers, government bodies, and partners now make proof of cyber coverage a condition of doing business.
• You operate in a regulated sector: Legal, healthcare, financial services, and accounting firms hold sensitive data and face higher scrutiny after an incident.

The harder question is not whether you need coverage but whether an insurer will offer it. Underwriting has tightened, and carriers now decline or surcharge businesses that cannot show basic security controls. That makes the controls below the practical gate to getting insured at a reasonable premium.

What Does Cyber Insurance Cover?

Cyber insurance (sometimes called cyber liability insurance) typically covers the costs associated with a data breach or cyberattack. This includes:

• Incident response costs: forensic investigation, legal counsel, and breach notification
• Business interruption: lost revenue during downtime caused by a cyberattack
• Data recovery: costs to restore or recreate lost data
• Ransomware payments: some policies cover ransom payments (controversial, but available)
• Legal liability: lawsuits from affected customers or partners
• Regulatory response: legal help dealing with the Privacy Commissioner and other regulators, and, where the law allows them to be insured, fines and penalties
• Public relations: reputation management after a breach

Breach Response vs Business Interruption: What Is the Difference?

These are the two parts of a policy people most often confuse, and they pay for very different things.

• Data breach response pays to deal with the breach itself: forensic investigators to find out what happened, a lawyer (often called a breach coach) to manage your legal duties, notifying affected people, credit monitoring if personal information was exposed, and public relations help.
• Business interruption pays for the income you lose, and the extra costs you take on, while your systems are down. It usually starts only after a waiting period set in the policy, and it is often subject to its own sub-limit. Some policies also cover an outage at a cloud provider or other supplier you depend on (sometimes called dependent or contingent business interruption); many do not.

A business that holds lots of personal data leans on breach response. A business that cannot work without its systems, such as a manufacturer, clinic, or dispatch operation, leans on business interruption. When you compare quotes, compare these two limits and the waiting period, not just the headline amount.

What Cyber Insurance Does Not Cover

Wording differs between insurers, so read your policy, but these are common gaps:

• Funds sent to a fraudster after a fake invoice or a spoofed email, unless you add social engineering or funds transfer fraud cover (on the cyber policy or a separate crime policy).
• Known problems that existed before the policy started, and claims arising from them.
• Upgrades and improvements after an incident: the policy restores you, it does not buy you better systems.
• Failure to keep up promised controls. If you said MFA was on everywhere and it was not, the insurer may dispute the claim.
• Lost future value, such as the long-term worth of stolen intellectual property.
• War and certain state-backed attacks, under exclusions that insurers have been tightening.

For a fuller walk-through, see what cyber insurance covers (and what it does not).

Standalone Cyber Policy vs an Add-On to Your Business Policy

Some Canadian businesses already have a little cyber cover without knowing it, as an add-on (an endorsement) to their commercial package policy. The difference matters:

• An add-on is inexpensive and easy, but it usually has a low limit and may leave out business interruption, ransomware, or social engineering fraud.
• A standalone cyber policy costs more but typically offers higher limits, broader cover, and access to an incident response team you can call the moment something happens.

Add-ons worth asking your broker about, depending on how you operate:

• Social engineering and funds transfer fraud, if you pay or receive money by email or bank transfer.
• Full ransomware and cyber extortion limits: check this cover is not sub-limited well below the main limit.
• Dependent business interruption, if a cloud provider or key supplier going down would stop you.
• Hardware replacement (often called bricking), for devices an attack leaves unusable.
• Payment card (PCI) costs, if you take card payments.

What Do Insurers Require?

This is where most businesses get stuck. Cyber insurance isn't just about paying a premium; insurers want to see evidence that you are protecting your business. If you can't demonstrate basic security hygiene, you'll either be denied coverage or pay significantly higher premiums.

Here's what most Canadian cyber insurers now require as minimums:

1. Multi-Factor Authentication (MFA)

This is the single most common requirement. Insurers want MFA enabled on all email accounts, VPN access, and administrative portals. If you're using Microsoft 365, this means enforcing MFA through Microsoft Entra ID (formerly Azure AD) at minimum.

2. Endpoint Detection and Response (EDR)

Basic antivirus is no longer sufficient. Insurers expect EDR solutions that can detect, investigate, and respond to threats in real time. Products like SentinelOne, CrowdStrike, or Microsoft Defender for Business meet this requirement. Application questionnaires increasingly ask directly whether you run EDR on every endpoint, and an inaccurate answer can let an insurer dispute a claim later, so it is worth getting this one right before you apply.

3. Regular Backups

You need to demonstrate that your data is backed up regularly and that backups are stored separately from your production environment. Cloud backup solutions for Microsoft 365 (Exchange, OneDrive, SharePoint) are increasingly expected.

4. Security Awareness Training

Insurers want proof that your employees receive regular security awareness training, including phishing awareness. Annual training is the minimum; quarterly is better.

5. Patch Management

Operating systems and software must be kept up to date. Insurers may ask about your patch management process and how quickly critical vulnerabilities are addressed.

6. Incident Response Plan

Having a documented plan for what happens when (not if) a breach occurs. This includes who to contact, how to contain the breach, and how to notify affected parties. Our incident response plan guide for Canadian SMBs walks through one.

Do this before you apply, not after: if these controls are not in place, the application questionnaire will ask about each of them. The full list of cyber insurance requirements in Canada goes control by control.

What Drives the Cost of Cyber Insurance in Canada?

Premiums are quoted business by business, so be wary of any single number. What moves your premium up or down:

• Revenue and size: more revenue and more staff usually means a higher premium. A business with 1 to 10 employees typically sits at the lower end.
• Industry: firms holding sensitive data, such as accounting, legal, healthcare, and financial services, are usually priced higher.
• How much data you hold: the more personal and financial records, the bigger a breach can be.
• Your security controls: MFA, EDR, tested backups, and training can be the difference between a reasonable quote, a surcharge, or a decline.
• Claims history and past incidents.
• The limit and deductible you choose, and which add-ons you include.

The controls are the part you can change. Ask a broker to quote with more than one insurer, and ask what would lower the premium: the answer is usually a specific control.

How Much Cyber Insurance Do You Need?

There is no standard answer, but you can work it out from four questions:

1. What do your contracts require? Clients and government buyers often set a minimum cyber limit. That is your floor.
2. How many people would you have to notify? Count customer, patient, and employee records. Notification, legal help, and credit monitoring scale with that number.
3. How long could you go without your systems? Multiply a day of lost revenue and extra costs by the days it would realistically take to recover.
4. How much money moves by email? If one fake invoice could cost you a large payment, check the social engineering limit, which is often much lower than the main limit.

Take those numbers to your broker. They are also what an insurer will want to understand.

How to Choose a Cyber Insurance Policy

There is no single best cyber insurer for every business, and ClayGen is not a broker, so we do not recommend carriers. What we do see is which policy features matter when something goes wrong. Compare quotes on these, not on price alone:

• A 24/7 incident response line and breach coach you can call the moment you suspect an attack.
• Separate limits for breach response, business interruption, and social engineering fraud, not just one headline number.
• The business interruption waiting period: shorter is better.
• Whether ransomware is fully covered or sub-limited.
• Exclusions tied to unpatched systems or missing controls, and how strictly they are worded.
• Whether you can use your own IT provider during an incident, or must use the insurer's.

For accounting firms, law firms, and clinics: you hold exactly the data that makes breaches expensive, and your professional liability policy may not cover a cyber incident. Ask your broker how the two policies fit together, and make sure the cyber policy covers client data you hold on their behalf. See IT for accounting firms, law firms, and healthcare.

The Cost of Not Having Coverage

The average cost of a data breach in Canada reached CAD $6.98 million in 2025 according to IBM's annual Cost of a Data Breach Report. The figure is a national average across organizations of all sizes, and even a fraction of it can be devastating for a small business. A breach can also trigger reporting duties under PIPEDA when it creates a real risk of significant harm, which is where proper compliance support and documentation matter as much as the technology.

Beyond the financial impact, a breach without insurance means:

• You pay for forensic investigation out of pocket
• You personally handle legal notification requirements under PIPEDA
• You absorb all business interruption losses
• You may lose clients who require their vendors to carry coverage

Your Cyber Insurance Action Plan: How to Become Insurable in Canada

Getting cyber insurance is not complicated once the security foundations are in place. This is the order we recommend:

1. Check your readiness. Take the cyber insurance readiness check and note every gap.
2. Turn on MFA everywhere. Email, remote access, admin accounts, and banking first.
3. Put EDR on every device and confirm none were missed, including laptops that rarely come to the office.
4. Back up, separately, and test a restore. Include Microsoft 365: see how to back up Microsoft 365.
5. Train your staff on phishing and payment fraud, and keep the completion records.
6. Write a one-page incident response plan: who to call, in what order.
7. Gather the evidence. Screenshots, reports, and policies an underwriter may ask for: see what insurers ask you to document.
8. Get quotes through a broker who handles cyber, using the limits you worked out above.
9. Answer the application exactly as things are. An optimistic answer can cost you the claim.
10. Re-check before every renewal. Insurers add questions every year.

Go Deeper on Cyber Insurance

Three companion guides go further on the questions businesses ask most:

• What cyber insurance covers (and what it does not): first-party versus third-party, cyber liability, data breach response, business interruption, and the exclusions that can void a claim.
• Cyber insurance requirements in Canada: the security controls insurers now expect (MFA, EDR, backups, patching) and how they affect both eligibility and premium.
• Cyber insurance documentation: what insurers ask you to submit and attest once the controls are in place.

How ClayGen Can Help

At ClayGen, we help Ontario businesses meet cyber insurance requirements as part of our managed IT services. We handle MFA deployment, EDR setup, backup configuration, and security training so you can focus on running your business. Through ClayGen Connect, you get a clear view of your security posture and compliance status, which makes renewal conversations with your insurer straightforward.

If you're not sure where your business stands, we offer a free security assessment that maps directly to what cyber insurers are looking for. Get in touch to schedule yours.

For the broader view of this topic, see our complete cybersecurity guide for Canadian SMBs.

Last updated October 2026. Answered the questions people search most: what drives the premium, standalone policy vs add-on, breach response vs business interruption, what is not covered, how much cover you need, and how to choose a policy. Added three next steps up front and a ten-step action plan. Corrected the regulatory fines wording and updated the breach cost figure to IBM's 2025 report.