Cyber insurance can help a UK subscription-based professional firm recover after a breach, ransomware attack or covered system outage. It will not automatically replace recurring revenue when a CRM, billing tool or client portal fails. The real risk lies in policy triggers, time limits and small caps within the policy.
Check triggers, indemnity periods and sub-limits against MRR, SLAs and the ICO's 72-hour breach-reporting window.
Does your policy protect recurring income?
A policy protects recurring income only when its business interruption section covers the event that stopped work. It must also cover the loss of profit that followed.
What losses can cyber cover pay for?
Cyber liability insurance can potentially pay for incident response, forensic work, legal advice and data recovery. It may also pay notification costs, ransomware negotiations and third-party privacy claims.
A forensic investigation finds how an attacker entered, what they accessed and whether they remain in the system. Think of it like checking every door after a break-in.
The error most firms make is assuming all cyber costs sit under one limit.
When is recurring revenue actually lost?
Recurring revenue is lost when disruption stops a firm delivering, billing, collecting or retaining paid monthly services. Monthly recurring revenue, usually called MRR, is predictable subscription income expected each month before one-off fees.
A client portal may be offline for one day. Yet cancelled direct debits may affect income for several weeks.
A practical MRR test: Estimate lost or delayed MRR for the outage period. Add unavoidable operating costs. Then add the likely cost of winning back clients who cancel after access or billing fails. Compare that total with the business-interruption limit and each relevant sub-limit.
A SaaS outage may not trigger your cover
A SaaS outage may not trigger contingent business interruption cover. The outage must often arise from the policy's defined cyber event.
Is a CRM outage an insured cyber event?
A CRM outage is insured only if the supplier and failure cause fit the policy wording. A CRM holds customer records, sales notes and renewal tasks.
Its failure can delay work even when the firm's own network still works. But here is the part many policies make difficult: an ordinary outage may not count.
Are cloud and payment suppliers included?
Supplier cover should name, or clearly include, services that hold client data, run the portal or collect payments. Check software providers, cloud hosts, managed service providers, payment processors and key sub-processors.
Sub-processors are firms your supplier uses to process data or run part of its service. A payment processor may depend on several of them.
The consensus among insurance professionals is clear: well-known suppliers can still create uninsured downtime.
How a supplier outage becomes an insurance claim
1. Supplier fails
CRM, portal or payment service stops.
2. Check the cause
Attack, security failure or ordinary outage?
3. Apply wording
Is that supplier and cause covered?
4. Measure loss
Waiting period, MRR loss and recovery time.
Does the waiting period erase the claim?
A waiting period can remove the first part of a claim. This applies even when the supplier event is covered.
It is the uninsured time after an incident begins. It is often between 8 and 24 hours before business-interruption loss can count.
Supplier checks should test whether a provider can meet the firm's recovery commitments. Being well known is not enough.
Confirm who holds client data, processes card payments, manages identities or runs the client portal. Then ask for incident-notification times, backup plans and restoration plans.
Also check service-status history, data-location terms and the subcontractor list. Ask whether you can export data if the contract ends.
Check whether the supplier's liability cap matches your MRR and SLA exposure. This is where a cheap contract can become costly.
For a payment processor, check failed collections, chargebacks and account compromise. Also check how it handles changed payout bank details.
This evidence can reveal billing risks before renewal income is lost. The next section shows how to turn those risks into sensible limits.
Set limits using MRR, recovery time and SLAs
Set limits by adding MRR at risk, response costs, data exposure and contract duties. Do not choose a figure from staff numbers alone.
How much income should interruption cover?
Business-interruption cover should reflect income shortfall and continuing costs during a realistic recovery period. Start with monthly recurring revenue.
Then estimate delayed collections, failed card charges, payroll, rent and outsourced support. Include realistic client retention work after an outage.
A useful starting range is between 30 and 90 days of MRR disruption. The right period depends on your service and client contract terms.
| Exposure to model | What to measure | Policy wording to check |
|---|
| Recurring income | MRR at risk over 30 to 90 days | Business interruption limit and waiting period |
| Cloud dependency | Revenue stopped by CRM, portal or payment outage | Contingent interruption trigger and supplier definition |
| Client data breach | Records, notification, legal and support costs | Privacy liability, notification and forensic costs |
| SLA commitments | Service credits, refunds and termination risk | Contractual liability exclusion and PI wording |
Which sub-limits can undermine cover?
Sub-limits are smaller caps inside the overall policy limit. They often decide the policy's real value.
Review separate caps for cyber extortion, social engineering fraud and data recovery. Also check notification, regulatory investigations and supplier interruption.
A £1 million policy limit can mislead if fraud cover has a far lower cap.
Which policy period fits your contracts?
The indemnity period should match the time needed to resume normal service. It should not only match the time needed to restart a server.
For a subscription recruitment agency, systems may recover quickly. Candidate matching and client reassurance may still take weeks.
Insurers often assess cyber insurance eligibility by reviewing controls that reduce the likelihood and scale of claims. Multi-factor authentication is often central for email, administrator accounts, CRM and billing platforms.
Multi-factor authentication asks for more than a password. It is like needing both a house key and a door code.
Firms should also maintain tested offline or immutable backups, prompt patching and endpoint protection. They also need a written incident-response process.
Payment controls matter too. Use dual approval for bank-detail changes and verify changes with clients through a separate channel.
Weak or unmaintained controls may raise the premium or excess. Strong, well-maintained controls may also reduce fraud and ransomware cover.
Record controls before completing a proposal form. Wrong answers can cause serious claim problems.
These figures set the financial target. The next question is which policy should pay each type of loss.
Match cyber, PI, crime and D&O to each loss
Cyber, professional indemnity, crime and D&O insurance cover different loss routes. One cyber event can create claims under more than one policy.
When does professional indemnity respond?
PI may respond when negligent advice, a missed professional duty or faulty work harms a client. It does not replace cyber cover.
PI may not pay for forensic work, ransomware response or a personal data breach. Each policy deals with a different part of the same event.
When is crime insurance the right policy?
Crime or fidelity insurance can cover employee dishonesty, funds transfer fraud and some social engineering fraud. Exact conditions always apply.
Social engineering fraud tricks someone into paying money or sharing login details. A fake email asking for a new bank account is a common example.
A common case involves a finance employee receiving a convincing supplier email. The employee changes bank details, then sends a genuine payment to criminals.
📦Available on Amazon
A USB security key can support multi-factor authentication for administrator accounts. These accounts may access billing, CRM and cloud systems.
It does not replace insurance. It can reduce the chance that a stolen password becomes an insured incident.
- Helps protect administrator logins for Microsoft 365, Google Workspace and many cloud platforms.
- Reduces phishing risk where staff would otherwise approve a login with only a password.
- Creates a physical check before billing-record changes or client account access.
Search on Amazon →Claims often develop differently across professional services. A recruitment consultancy may lose MRR after ransomware locks candidate records and blocks placements.
Its immediate costs can include forensic work, ransomware cover and data recovery. Lost income depends on the business interruption wording.
An accountancy firm may suffer a client-account takeover. The attacker may change payment instructions and expose tax records.
That event can create privacy-response costs and a possible crime claim for transferred funds. A legal practice may miss a deadline after a SaaS outage.
Cyber cover may address a covered cyber event. PI may be needed for an allegation of negligent service.
A managed service provider may face third-party claims after compromised tools affect several client systems. Limits, aggregation wording and the indemnity period then matter greatly.
Knowing the policy split avoids false confidence. Fraud prevention needs its own close review.
Protect recurring payments from fraud and takeover
Recurring-payment fraud is often covered only when the firm follows crime policy conditions. The firm must also show how the deception happened.
Is a fake bank-detail change covered?
A fake bank-detail change may fall under social engineering fraud or funds transfer fraud. Policy terms differ sharply.
Some insurers cover payments made after impersonation. Others exclude them because an authorised employee instructed the bank.
The most frequent mistake is trusting an email address that looks familiar. Always verify changed bank details through a known phone number.
What if a client account is hijacked?
A hijacked client account can expose personal data and allow fraudulent invoice changes. It can also damage trust in a paid service.
Check the policy for privacy liability, network security liability and incident response cover. Each part addresses a different loss from the event.
The ICO expects reportable personal data breaches within 72 hours of awareness. That deadline can arrive while client access remains down.
This approach is less relevant for a business with no recurring income, little client data and low digital reliance. It may still need basic cyber cover. Its limit should reflect payment exposure, personal data and operational reliance, rather than MRR or SaaS interruption.
Common questions
Does cyber insurance cover a CRM outage?
Cyber insurance may cover a CRM outage after a defined cyber event. The policy must also include business interruption cover.
A non-malicious software fault or supplier capacity failure can be excluded. Check the event trigger and waiting period.
How much cyber insurance does a subscription firm need?
A subscription firm should model between 30 and 90 days of MRR disruption. Add response costs and client data exposure.
Add separate allowances for supplier outage, fraud, legal costs and contract duties. The total should reflect the firm's real recovery period.
Does cyber insurance pay SLA credits to clients?
Cyber insurance does not automatically pay SLA credits to clients. Credits can be contractual liabilities rather than cyber losses.
Check contractual liability exclusions. Ask whether PI cover addresses service-failure claims.
Are GDPR fines covered by cyber insurance?
Cyber insurance can sometimes cover defence costs and insurable regulatory penalties. Fines are not automatically payable.
Under UK GDPR, serious fines can reach £17.5 million or 4% of worldwide annual turnover. Legal and factual circumstances determine whether cover applies.
Is a cloud provider outage covered as business interruption?
A cloud provider outage is covered only when the supplier and cause meet contingent interruption wording. Many policies require a cyber attack or security failure.
Policies may exclude ordinary technical outages. Check the supplier definition before buying cover.
Does cyber insurance cover stolen recurring payments?
Cyber insurance may cover stolen recurring payments when crime or social engineering extensions apply. Bank-detail fraud often has lower sub-limits.
The insurer may require evidence of independent payment verification. Keep records of calls and approval checks.
The essentials:- Choose cover from the revenue and systems that can actually stop, not headcount alone.
- Test each critical SaaS supplier against the cyber-event trigger and contingent interruption wording.
- Separate ransomware and data claims from professional negligence, payment fraud and director liability.
- Check the 72-hour ICO reporting position before an incident takes client access down.
Learn more
Here are some additional resources on this subject:
