Describe systems and access
Identify customer network access, remote maintenance connections, employee data and business-critical applications. Explain who manages security and incident response. A contractor with limited office data may still create contractual exposure through access to a mine operator’s systems.
Compare incident and liability coverage
Review proposed provisions for response costs, privacy liability, business interruption and cyber extortion where offered. Funds-transfer fraud, social engineering and operational technology may have separate conditions or exclusions. Do not assume a cyber label includes every computer-related loss.
Coordinate response obligations
Read customer notification and security requirements alongside the policy’s reporting and consent conditions. Identify whom to contact after a suspected incident and how evidence will be preserved. Insurance supports a risk program but does not replace technical controls, contractual review or a qualified incident-response team.
Illustrative review scenario
A maintenance contractor uses remote access to support a customer’s equipment and later receives notice of a suspected compromise. Its cyber application described only office systems. Review the connection, contractual duties and relevant policy conditions with qualified technical advisers and the insurer. Timely notification and evidence preservation matter; the existence of remote access alone does not establish liability or coverage. Could remote access used for maintenance expose a customer system as well as your own business? Describe those connections and review contractual notification requirements before selecting limits or assuming third-party protection.