Cyber insurance for digital agencies: questions before you buy

Map what your agency can access

For each service, write down the platforms you access, the level of permission and who owns the account. Separate your business email and files from client advertising accounts, analytics properties and customer databases. This is a discussion worksheet, not a request to publish credentials or customer information.

Then identify the person who could explain each system to an insurer. In a small agency this may be the founder, an external IT provider or the freelancer responsible for account administration. Avoid guessing about technical controls on an application.

Use three concrete scenarios

• Account access: a staff login is compromised and used to change a client campaign.
• Data handling: a file containing client customer information is exposed.
• Operational interruption: the agency cannot access the systems needed to deliver work.

These are hypothetical briefing examples. For each one, ask which policy section could apply, what loss categories it addresses and what would be outside the scope. Avoid converting a reassuring sales conversation into an assumption that every scenario is insured.

Understand the response process

The NCSC highlights the value of understanding incident support and the security conditions associated with a policy. Ask for the contact process before there is an emergency. Record who may call, which suppliers the insurer expects you to use and what permission is needed before incurring costs.

A practical agency exercise is to imagine that your usual email is unavailable. Where would you find the policy, incident contact and account ownership records? Keep an accessible recovery plan that does not depend on the single system you may lose.

Discuss fraud and overseas work explicitly

The NCSC cautions that some cyber policies do not cover money lost through business email compromise. The ABI also highlights territorial and jurisdictional exclusions. Ask targeted questions about payment instructions, client funds, account misuse and US-connected work instead of treating the word “cyber” as an all-purpose answer.

Write each unresolved issue beside the applicable clause. Ask whether any endorsement is proposed, whether a separate policy should be considered and whether the answer changes for subcontractors. The objective is a clear record, not a list of speculative claims.

Make the application match reality

Check answers about access controls, backups and other security measures with the person responsible for them. If a question is ambiguous, ask the insurer how to answer it. Keep the final submitted application; do not rely on an early draft in which an intended control was described as already implemented.

Use our agency briefing framework to organise the wider conversation about professional services and contracts. Cyber cover should be reviewed alongside those exposures rather than in isolation.

Run a document-access rehearsal

Choose a harmless practice scenario: your normal email is unavailable and you need to find the incident contact. Without simulating an attack or using real client data, check whether the authorised person can locate the policy and the relevant response instructions.

Record only practical gaps, such as a contact list stored exclusively in the unavailable mailbox or uncertainty over which person may call. Resolve those organisational issues with your own team and adviser. Do not contact an emergency response line as a test unless the provider has agreed to that exercise.

This small rehearsal does not establish cyber resilience or insurance compliance. It simply makes the response documents easier to use when time matters.

Worked example: a compromised client advertising login

Imagine a UK agency managing campaigns in a client-owned advertising account. A team member notices unexpected campaign changes and unfamiliar access. At this point, the cause and financial consequences are unconfirmed. This fictional example shows how to prepare an insurance discussion; it does not predict a claim outcome or replace an incident-response plan.

Separate the information into three records. First, record observed facts: when the unusual activity was noticed, which account was affected and who owns it. Second, list possible consequences that still need verification, such as disputed advertising charges, lost access or exposure of customer information. Third, identify the documents to consult: the client agreement, the agency's policies and their incident-reporting instructions. Keep an assumption out of the facts column until someone can verify it.

A broad question such as “Are we covered for hacking?” hides several different questions. Ask the broker which provisions address the agency's response expenses, a client's allegation against the agency, and disputed spending in an account owned by someone else. Record an unanswered question where the broker needs more facts. A platform refund, the client's own insurance and the agency's policy are separate enquiries; none should be assumed to settle the others.

The ABI's cyber guidance distinguishes losses suffered by the insured business from liability claims brought by others. That distinction helps organise questions, but it does not establish whether this particular account, expense or allegation falls within a policy.

A five-part worksheet for the broker call

Copy these headings into your own private document. Use roles and account categories; keep passwords, access tokens and identifiable customer records out of the worksheet.

1. Account and responsibility. Record the account owner, the agency's permissions and who authorises spending. Question: which description of insured activities and systems needs checking? Evidence to request: the relevant definition or endorsement.
2. Agency expenses. Identify the response help the business might need, without inventing a cost estimate. Question: what contact, supplier and authorisation conditions apply before costs are incurred? Evidence: the incident instructions and applicable policy section.
3. Client allegation. Describe the service and allegation separately from the suspected technical event. Question: how should the cyber and professional-indemnity providers be notified, and which wording needs review? Evidence: each provider's own instructions. Do not decide for yourself that only one policy could matter.
4. Money and interruption. Separate disputed platform charges, a diverted payment and inability to deliver work. Question: which loss definitions, exclusions, sublimits or waiting conditions, if any, apply to each? Evidence: a clause reference for each answer, not a single tick beside “cyber”.
5. People and geography. Note relevant subcontractors, client entities and countries. Question: do territorial, jurisdictional or related-party provisions affect the answer? Evidence: the wording and amendments, plus any facts the provider still requires.

Give each unresolved item an owner and a follow-up date. Keep the provider's written response with the document version it discusses. This is an original preparation tool, not a standard insurance application or a test of policy suitability.

Describe controls as they are, not as planned

For each application answer, record who verified it and which systems the answer covers. For example, confirming a control for the agency's email does not establish the same fact for every client-owned platform. Mark a planned change as planned and ask how the insurer wants any uncertainty explained.

The NCSC's guidance stresses accurate security information, checking policy exclusions and understanding incident support. Its example of business-email-compromise exclusions is a reason to ask specifically about diverted payments, rather than assume every money loss is insured. Insurance remains separate from preventing and managing an incident.

If an incident is already suspected, follow the actual response and notification instructions promptly; do not wait to finish this worksheet. For preparation before purchase or renewal, pair it with the policy-document reading guide and the cross-border client questions. This article concerns UK-based businesses and does not state US insurance requirements.