A cyber policy is for the cost of a digital event: a breach, a locked system, a demand. It is not a substitute for backups, unique passwords, and software you actually update. CISA publishes the basic practices. Insurance sits behind those practices. Companies now ask, on the application, whether you do them.
What it covers
On a typical form: lawyers and a breach coach, notice to affected people, credit monitoring if you offer it, some liability if someone sues, and the cost to restore data and systems after a covered attack. Business interruption from a covered cyber event, if that insuring agreement is on the policy. Dependent business interruption, when a vendor's system takes you down, only if the form says so. Each of these can have its own sublimit.
What it doesn't cover
A paper flood in the stockroom. Bodily injury. A vendor you never disclosed. An attack that started before the policy, if the form excludes a prior event. A funds transfer you were tricked into sending, unless social-engineering coverage is included. Improvements you had been postponing. A policy does not patch the server.
Florida specifics
Section 501.171 is Florida's breach-notice statute. If the business holds personal information and a breach meets the definition, notice is a legal duty. Healthcare and financial firms have extra federal rules this page does not try to teach. A Northeast Florida firm that takes cards at the counter, or stores client files in email, has the exposure even without an information-technology department.
How we help
We ask what data you keep, whether you use multi-factor authentication, and whether you have offline backups. The application is part of the policy. A wrong answer is a problem at claim time. Start a business quote and name cyber, or call either office. If you are in the middle of an incident, call. Do not put the details of a live breach in a web form.