Cyber Liability Insurance for Colorado Businesses

What Colorado law requires after a breach

This is the part that makes cyber coverage concrete rather than abstract, because the obligations are already in statute.

The Colorado Attorney General states that Colorado law requires covered entities that experience a data breach to notify affected Coloradans, and to provide notice to the Office of the Attorney General if the breach affects 500 or more Coloradans.

There is also a clock. According to the Attorney General, notice must be provided in the most expedient time possible, without unreasonable delay, and within 30 days after the date of determination that a security breach has occurred. Notice may be delayed consistent with the legitimate needs of law enforcement, or with measures necessary to determine the scope of the breach and restore the integrity of the data.

The Attorney General also points businesses to the governing statutes: section 6-1-716, C.R.S. for persons and commercial entities, and section 24-73-103, C.R.S. for governmental entities. A security breach is defined there as the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information.

Who this applies to

The instinct is that data breach law is for large companies. It is not, and this is the single most common misconception we deal with on this coverage.

If you hold names alongside Social Security numbers, driver’s licence or identification numbers, financial account details, or usernames and email addresses combined with passwords or security questions, you hold the kind of personal information these obligations attach to. That describes most businesses with employees and customers, including small ones.

Practically, that means:

• A dental or medical practice with patient records
• A restaurant or shop taking card payments
• A contractor holding customer addresses and payment details
• An accountant or bookkeeper holding client financial data
• Any business with employee payroll and tax records

What cyber liability can cover

What it does not do

Cyber coverage funds a response. It does not prevent a breach, and it does not excuse a business from having reasonable security in place. Carriers increasingly ask about controls at application, and some require multi-factor authentication and backups as a condition of coverage.

It is also not general liability, which generally excludes data exposures, and not errors and omissions, though a claim can touch both. A business owners policy can often be endorsed with cyber coverage, which is usually narrower than a standalone policy but a reasonable starting point.

What affects your premium

Cyber pricing reflects the data you hold and the controls around it. It is generally shaped by your industry, your revenue, how many records you hold and of what type, your security controls, whether you have had a prior incident, and the limit and retention you select.

The parts you can influence, and they matter more here than on most lines:

• Multi-factor authentication. Frequently the single control carriers ask about first, and sometimes a condition of an offer.
• Backups, tested and offline. The difference between a ransomware inconvenience and a ransomware catastrophe.
• Employee training. Most incidents at small businesses start with someone clicking something.
• Patching and endpoint protection. Basic, documented, and looked for at application.

Applications on this line ask detailed questions about controls, and policies differ as much on response services as on premium, so both are worth comparing.

How to get a cyber liability quote

As an independent agency, we compare what is available on coverage and on incident response.