Cyber Insurance for Small Business: Cover, Cost and Rules
Cyber insurance pays your own costs after a cyber incident, such as incident response, forensics, data restoration, lost income and extortion, and covers claims from people whose data was exposed. It is optional in Australia. Insurers now expect MFA, offline backups and endpoint security before they quote. Businesses with turnover of $3 million or more must report any ransom payment within 72 hours, and some smaller businesses are covered by the Notifiable Data Breaches scheme.
What you’ll get from this guide: Work out whether a cyber policy fits your risk, check a quote against the exclusions that matter, know your NDB and ransomware reporting duties, and have an incident-day plan ready.
- Cyber insurance splits into first-party cover (your response costs, lost income, extortion) and third-party cover (claims and regulatory costs when other people's data is exposed).
- Insurers ask about MFA, offline backups, endpoint protection, email security and past incidents before quoting. A wrong answer can reduce or void a claim.
- Fake-invoice and payment-redirection losses are often excluded or sub-limited unless you add a social engineering extension.
- Businesses with $3 million or more turnover in the previous financial year must report a ransom payment to ASD within 72 hours, including payments made on their behalf.
- Most businesses under $3 million turnover are outside the Notifiable Data Breaches scheme, but health service providers, several other categories and anyone holding TFN information can still be caught.
Cyber insurance pays for your own costs after a hack, ransomware attack or data breach, such as incident response, forensic investigation, data restoration, lost income and extortion. It also covers claims from people whose data was exposed. It is optional in Australia, but insurers now expect basic controls before they quote: multi-factor authentication (MFA), offline backups and endpoint protection.
This is general information, not financial product advice, and it doesn't consider your circumstances. Read the Product Disclosure Statement (PDS) and Target Market Determination (TMD) for any policy, and consider getting advice from a licensed broker or adviser.
| Question | Short answer (checked 17 October 2026) |
|---|---|
| Is it compulsory? | No. Some client contracts and tenders require it. |
| What does it pay for? | Your response costs and lost income (first-party), plus claims and regulatory costs when others' data is exposed (third-party). |
| What do insurers check? | MFA, offline backups, endpoint security, email security, past incidents, records held, revenue and industry. |
| Biggest gaps | Fake-invoice fraud without an extension, outages at your internet or power provider, betterment, state-backed attacks, past incidents you knew about. |
| Ransom payments | Not generally illegal, strongly discouraged, and reportable within 72 hours if your turnover is $3 million or more. |
| Privacy breach duties | Notifiable Data Breaches (NDB) scheme: assess within 30 days, notify as soon as practicable. Most businesses under $3 million turnover are exempt, with important exceptions. |
What does cyber insurance cover?
Small business cyber policies usually bundle two kinds of cover. First-party cover pays your own losses. Third-party cover pays when someone else claims against you, or a regulator investigates, because their data or systems were affected. Some brokers call the full bundle "cyber risk" insurance and use "cyber liability" for the third-party part only, so check what a quote actually includes.
First-party cover: your own costs
| Section | What it typically pays for | Watch for |
|---|---|---|
| Incident response | 24/7 hotline, incident manager, and coordination of lawyers and other specialists | Whether you must use the insurer's panel |
| Forensic investigation | Finding how the attacker got in, what they took, and securing systems | Consent before engaging your own IT provider |
| Notification and crisis communications | Notifying affected people and PR or crisis communications advice | Whether notification costs are covered if you aren't legally required to notify |
| Data restoration | Rebuilding or recovering data and software after corruption or deletion | Betterment (upgrades beyond the pre-incident state) is usually excluded |
| Business interruption | Lost profit and extra costs while systems are down | A waiting period before cover starts, typically 8 to 24 hours according to Finder |
| Cyber extortion | Negotiators and, where lawful, a ransom payment | Sanctions checks and who decides whether to pay |
Third-party cover: claims against you
| Section | What it typically pays for | Watch for |
|---|---|---|
| Privacy liability | Defence costs and damages when people sue after their personal information is exposed | Claims-made basis: the claim must be made during the policy period |
| Network security liability | Claims that malware spread from your systems, or an attack on you hurt a client | Also claims-made: check the limit covers several claimants |
| Regulatory investigations | Legal costs of responding to the OAIC or other regulators, and fines or penalties only where insurable by law | Assume penalties may not be covered |
Optional extensions to ask about
- Social engineering or funds transfer fraud. Covers money lost when staff are tricked into paying a fake invoice or changed bank details. Emergence lists "socially engineered theft" and "criminal financial loss" as optional covers, and Chubb asks extra questions before adding the extension.
- Dependent business interruption. Lost income when a cloud or software provider you rely on is hit, not you.
- System failure. Lost income from a non-malicious outage, such as a botched update.
Does cyber insurance cover ransomware payments?
Many policies include cyber extortion cover. In practice the insurer's incident team brings in negotiators, checks sanctions lists and decides with you whether a payment is lawful and justified. Emergence publishes a case study in which a negotiator reduced a USD 350,000 demand to USD 150,000 and the insurer paid more than $900,000 of covered costs, including business interruption. That is one insurer's example, not a typical claim.
The legal position, from the Department of Home Affairs:
- Paying a ransom is not generally prohibited in Australia, but the Government "strongly discourages" it. Paying doesn't guarantee you get your data back or that it won't be published.
- Paying a sanctioned person or entity can breach sanctions law and attract criminal penalties. A payment may also raise anti-money laundering issues.
The ransomware payment reporting rule
Since 30 May 2025, Part 3 of the Cyber Security Act 2024 requires some businesses to report ransom and cyber extortion payments to the Australian Signals Directorate (ASD).
| Item | Rule (checked 17 October 2026) |
|---|---|
| Who must report | A business carrying on business in Australia with annual turnover of $3 million or more in the previous financial year, or a responsible entity for a critical infrastructure asset |
| Part-year businesses | The threshold is pro-rated: $3 million × days trading in the previous financial year ÷ days in that year |
| What triggers it | You make a payment, or become aware one was made on your behalf (for example by your insurer or a negotiator). Non-cash benefits count. |
| Deadline | Within 72 hours of the payment, or of becoming aware of it |
| How | ASD's online form at cyber.gov.au |
| What you report | ABN and contact details, the incident and its impact, the demand, the amount and method of payment, and communications with the attacker, to the extent you know or can find out |
| Penalty for not reporting | Civil penalty of 60 penalty units, which is $21,840 at the July 2026 penalty unit value of $364 |
| Enforcement | Education-first phase from 30 May to 31 December 2025; a "compliance and education" phase applies from 1 January 2026 |
| Protections | Report information can't be used against you in most civil, criminal or tribunal proceedings, with listed exceptions |
If you don't pay, there is nothing to report under this rule, though ASD encourages voluntary reports. Most small businesses fall below the $3 million threshold, but a part-year start-up can be caught: the Home Affairs factsheet's example business traded for 73 days, so its threshold was $600,000.
What cyber insurance doesn't cover: common exclusions
Exclusions differ between insurers, so compare wordings rather than headline limits. These are the ones worth checking first.
| Exclusion or limit | What it means | How to reduce the risk |
|---|---|---|
| Incidents you already knew about | Proposal forms ask about incidents, breaches, complaints and circumstances that could lead to a claim. Chubb's form asks about the last 3 years. Known matters can be excluded. | Disclose everything when you apply. Under the duty of disclosure, an insurer can cancel or reduce a claim if you didn't. |
| Security controls you declared but didn't have | If you said MFA or weekly offline backups were in place and they weren't, the insurer may reduce or refuse the claim. | Answer the proposal form with your IT provider. Keep evidence (screenshots, backup logs). |
| Unpatched or unsupported systems | Some wordings have conditions or exclusions about known vulnerabilities or software past end of support. | Ask the insurer whether yours does. Patch promptly and replace unsupported devices. |
| Social engineering fraud | Fake invoices and payment redirection are often outside the core policy, or capped by a low sub-limit. | Buy the extension if you pay suppliers by bank transfer, and use call-back checks and dual approval. |
| War and state-backed attacks | Lloyd's has required state backed cyber-attack exclusions in standalone cyber policies written there since 31 March 2023. Policies written elsewhere may have their own war or cyber operation exclusion. | Read the definition and how the insurer decides an attack was state-backed. |
| Infrastructure and utility outages | Aon and Compare the Market both list outages or failures at internet and utility providers as exclusions. | Plan a fallback (see our internet outage guide). |
| Betterment | Upgrades beyond your pre-incident set-up aren't paid. | Budget separately for improvements after an incident. |
| Bodily injury and property damage | Usually left to public liability and property policies. Physical damage other than computer hardware is often excluded. | Check your public liability and business pack. |
| Employee salary costs | Aon lists employee salary costs as an exclusion, so your normal wage bill during a response may not be paid. | Check how business interruption treats wages. |
| Uninsurable fines | Fines and penalties are covered only where the law allows them to be insured. | Assume regulatory penalties may not be covered. |
What do insurers ask before they quote?
Underwriters want to know whether the basics are in place before they offer terms. The questions below come from Chubb's short-form cyber proposal for businesses with revenue under $50 million. Other insurers ask similar questions.
| Insurer question | Why it matters | Free guidance |
|---|---|---|
| Any cyber incidents, data breaches, privacy complaints or circumstances in the last 3 years? | Known incidents can be excluded or change the terms | Disclose with details of fixes made |
| Is MFA used for all remote access to your network and email? | MFA stops a stolen password being enough on its own. Chubb's form says a VPN or an IP address doesn't count as a second factor. | Cybersecurity basics |
| Are business-critical systems backed up at least weekly and stored offline? | ASD says current offline backups and up-to-date software are the best protection against ransomware | ASD small business handbook |
| Do computers and phones run security tools such as antivirus, anti-malware or EDR? | Endpoint detection and response (EDR) spots and blocks attacks in progress | ASD Essential Eight |
| Is there an email security solution (spam filtering, sandboxing, anti-phishing)? | Email compromise and business email compromise fraud were the top two cybercrimes businesses reported to ASD in 2024–25 | ASD how-to guides |
| Would a breach require notifying more than 500,000 people? | Record volume drives liability exposure | OAIC NDB guidance |
| Revenue, industry, share of revenue from the US, parent company links | Base rating factors | Have last year's figures ready |
| (Social engineering extension) Do you verify changed supplier bank details by calling a number you already hold? Are payment initiation and approval split between people? | Determines whether the extension is offered and at what limit | Scams targeting small business |
ASD's Essential Eight lists eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. Chubb's short form doesn't ask for a formal Essential Eight maturity level, but each strategy you can evidence makes the proposal form easier to answer truthfully.
If you have 19 or fewer full-time equivalent staff, IDCARE runs a federally funded small business cyber resilience service with a free health check and advisory sessions (1800 595 170). ASD's Exercise in a Box lets you rehearse an incident before the real one.
Does the Notifiable Data Breaches scheme apply to you?
The NDB scheme sits in the Privacy Act. If it applies, you must notify the OAIC and affected individuals when a data breach is likely to cause serious harm. Cyber policies often pay for the legal advice and notifications, but the legal duty is yours.
Who is covered
A small business is generally exempt from the Privacy Act if annual turnover is $3 million or less. The OAIC says turnover "includes all income from all sources", not just sales, and excludes capital gains and proceeds of capital sales. A business that hasn't traded a full year projects its turnover.
Among other categories, you're covered regardless of turnover if your business:
- provides a health service and holds health information (the OAIC describes health services as services "in relation to physical, emotional, psychological and mental health")
- trades in personal information (pays for it or sells it)
- is a credit reporting body (and credit providers must follow the NDB scheme whether or not the rest of the Act applies to them)
- provides services under a Commonwealth contract
- operates a residential tenancy database
- is a reporting entity under the AML/CTF Act
- is accredited under the Consumer Data Right
- is related to a body corporate the Privacy Act covers, is prescribed by regulation, or has opted in.
The employer catch. OAIC guidance says the NDB scheme applies to tax file number (TFN) recipients "to the extent that TFN information is involved in a data breach". A TFN recipient is anyone who has a record containing TFN information. Most employers hold TFN declarations, so a breach involving your payroll files can be notifiable even if the rest of the Privacy Act doesn't apply to you. Our privacy policy guide covers the wider obligations.
What you must do after a breach
- Assess. If you suspect an eligible data breach, take all reasonable steps to complete a "reasonable and expeditious" assessment within 30 calendar days. The OAIC treats 30 days as a maximum.
- Contain and fix. If remedial action stops the likely serious harm, the breach is not notifiable.
- Prepare a statement. It must include your identity and contact details, a description of the breach, the kinds of information involved, and the steps you recommend individuals take.
- Notify the OAIC as soon as practicable using its online Notifiable Data Breach form.
- Notify individuals as soon as practicable: everyone affected, only those at risk of serious harm, or, if neither is practicable, by publishing the statement on your website.
Since 11 December 2024 the OAIC can issue infringement notices without going to court, including for failing to give a statement about an eligible data breach. The amount for a body corporate is up to 60 penalty units, or $21,840 as at July 2026.
The OAIC received 1,205 notifications in calendar year 2025, the most since the scheme began, and 716 were attributed to malicious or criminal activity.
What changed in 2024 to 2026
| Date | Change | What it means for a small business |
|---|---|---|
| 10 December 2024 | Privacy and Other Legislation Amendment Act 2024 received assent | New OAIC enforcement tools, including infringement and compliance notices for conduct after 11 December 2024 |
| 30 May 2025 | Ransomware payment reporting started | Businesses with $3 million or more turnover must report payments within 72 hours |
| 1 January 2026 | Ransomware reporting moved from education-first to "compliance and education" | Expect a more active regulator from 2026 |
| 6 July 2026 | OAIC published 2025 NDB statistics | Record 1,205 notifications in 2025 |
| July 2026 | Commonwealth penalty unit value of $364 applied (as cited by the OAIC) | 60 penalty units is $21,840 |
| 31 August to 18 September 2026 | Consultation on the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026 | The Bill "remains subject to further consideration by government". The consultation page doesn't mention the small business exemption, which is still law as at 17 October 2026. |
How much does cyber insurance cost?
We couldn't find an independent, published average premium for Australian small business cyber cover. Comparison sites and brokers in the top search results give no figures, and insurer quotes depend heavily on your answers to the proposal form. Get two or three quotes on the same limits and excess.
What drives the price
| Factor | Why it moves the premium |
|---|---|
| Revenue and industry | Bigger and more data-heavy businesses face larger claims. Proposal forms ask whether you work in higher-risk areas such as payment processing, data brokerage or IT managed services. |
| Records held | More personal, health or payment records means more notification and liability cost |
| Security controls | MFA, offline backups, EDR and email security can decide whether you're offered cover at all |
| Claims and incident history | Recent incidents raise the price or lead to exclusions |
| Sum insured and sub-limits | Higher limits cost more. Low sub-limits on extortion or social engineering cut the price and the protection. |
| Excess and waiting period | A higher excess or longer business interruption waiting period lowers the premium |
| Extensions | Social engineering, dependent business interruption and system failure add cost |
What an incident costs
ASD's Annual Cyber Threat Report 2024–25 put the average self-reported cost per cybercrime report at $56,600 for a small business (up 14%), $97,200 for a medium business and $202,700 for a large business. The most common cybercrimes reported by businesses were email compromise with no financial loss (19%), business email compromise fraud with a financial loss (15%) and identity fraud (11%).
Illustrative example: what a policy actually pays
These figures are invented to show the arithmetic. They are not quotes or typical claims.
A design studio's email is compromised. Ransomware locks its file server for four days, and a client pays $25,000 to a fake account after a spoofed invoice. The studio's policy has a $2,500 excess, a 12-hour business interruption waiting period and a $10,000 social engineering sub-limit.
| Loss | Amount | Policy pays | Why |
|---|---|---|---|
| Incident response and forensics | $18,000 | $18,000 | Within the response limit |
| Data restoration | $9,000 | $9,000 | Restores the pre-incident set-up |
| Lost gross profit: 4 days × $1,500 | $6,000 | $5,250 | 12-hour waiting period removes half a day ($750) |
| Fake invoice loss | $25,000 | $10,000 | Capped at the social engineering sub-limit |
| Excess | −$2,500 | One excess per claim (check your wording) | |
| Total | $58,000 | $39,750 | Uninsured: $18,250 |
The two lines that hurt are the sub-limit and the waiting period. Both are cheap to check before you buy and impossible to change afterwards.
Cyber insurance compared with your other policies
| Policy | Covers cyber events? | Where the gap usually is |
|---|---|---|
| Professional indemnity | May cover a client's claim that your error caused a loss, and some wordings extend to cyber events | Your own response costs, data restoration, lost income and extortion |
| Public liability | Built for bodily injury and property damage to others | Data breaches and financial losses from a hack |
| Business pack (property and business interruption) | Physical damage, including to hardware, and interruption after insured physical events | Ask whether data loss or downtime caused by a cyber event is covered at all |
| Management liability or crime | Depends on the wording | Ask whether fake-invoice fraud is covered and at what limit |
| Cyber | Response, restoration, cyber interruption, extortion, privacy liability | Exclusions and sub-limits listed above |
Ask the insurer or broker to confirm in writing which policy responds to a cyber event, so two policies don't both point at each other. Our business insurance overview explains how the covers fit together, and sole trader insurance covers the one-person version.
Buying checklist
Use this to compare quotes on the same basis. It covers criteria, not products.
- Limits. Overall limit, plus sub-limits for extortion, business interruption, regulatory cover and social engineering.
- Business interruption. Waiting period (hours), indemnity period (how long lost income is paid) and how lost profit is calculated.
- Dependent business interruption. Does it cover an outage at your cloud accounting, POS or email provider?
- Incident response. A 24/7 hotline, and whether you must use the insurer's panel or can use your own IT provider with consent.
- Ransom position. Is extortion covered, what consent is needed, and who does sanctions checks?
- Social engineering. Is it included? What is the sub-limit, and what payment controls must you follow?
- Claims-made terms. Is there a retroactive date or continuity of cover, so a breach that started before inception is still covered?
- Security conditions. Which controls are conditions of cover, and what happens if one lapses mid-year?
- Exclusions. War and state-backed attacks, infrastructure failure, unpatched systems, betterment, prior known circumstances.
- Excess. Per claim or per section, and whether a time excess also applies.
- Contracts. Does a client or tender require a minimum cyber limit or a certificate of currency?
- Overlap. How does it interact with your PI, business pack and management liability?
- Documents. Read the PDS, policy wording and TMD. If you use a broker, ask how they are paid.
Incident-day checklist
Keep this with your insurer's hotline number and policy number, offline.
- Call the insurer's incident response line first if you have cover. Your policy may require consent before you spend money or appoint your own specialists.
- Isolate affected devices from the network. Don't wipe or rebuild them, because forensic evidence matters for the claim and any notification decision.
- Call your bank immediately if money has moved. Ask it to try to recall the payment.
- Reset passwords from a clean device, starting with email, banking and admin accounts. Sign out all sessions and check mailbox forwarding rules.
- Report to ASD through ReportCyber at cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), available 24/7.
- Don't pay a ransom on your own. Get the insurer, a lawyer and sanctions checks involved.
- If a payment is made and your turnover is $3 million or more, report it to ASD within 72 hours.
- Start the NDB assessment if personal information may be involved. You have a maximum of 30 days to assess.
- Notify the OAIC and affected people as soon as practicable if the breach is eligible.
- Tell customers what to do, such as watch for scam calls or change passwords, even if notification isn't legally required.
- Keep a log of times, decisions, costs and invoices for the claim. See business insurance payouts for the accounting side.
- Run a review after recovery and update your one-page business interruption plan.
Key takeaways
- Cyber insurance splits into first-party cover (your response costs, lost income, extortion) and third-party cover (claims and regulatory costs when other people's data is exposed).
- Insurers ask about MFA, offline backups, endpoint protection, email security and past incidents before quoting. A wrong answer can reduce or void a claim.
- Fake-invoice and payment-redirection losses are often excluded or sub-limited unless you add a social engineering extension.
- Businesses with $3 million or more turnover in the previous financial year must report a ransom payment to ASD within 72 hours, including payments made on their behalf.
- Most businesses under $3 million turnover are outside the Notifiable Data Breaches scheme, but health service providers, several other categories and anyone holding TFN information can still be caught.
Where to get help
- Australian Signals Directorate (cyber.gov.au): Small business hub, ReportCyber, ransomware payment reports and the 1300 CYBER1 (1300 292 371) hotline, 24/7.
- OAIC (oaic.gov.au): Notifiable Data Breaches guidance and the online breach notification form.
- IDCARE: free small business cyber resilience service for businesses with 19 or fewer FTE staff, 1800 595 170.
- Department of Home Affairs: ransomware payment reporting factsheet.
- Australian Financial Complaints Authority (afca.org.au): external dispute resolution if a complaint to your insurer about a claim isn't resolved.
- Scamwatch (scamwatch.gov.au): for scams, including fake invoices and payment redirection.
Related tasks
Continue through the business insurance guides.
Did this guide help you finish your task?
Optional feedback helps us see which guides need more work.
Feedback is off while site analytics is unavailable or disabled.
We report your choice and this guide’s page through site analytics. Your analytics preference applies. About feedback and privacy.
Where to go from here
Decide what can continue when the internet or a core cloud service is unavailable
Explore a related question linked in this guide.
3 min readPublic Liability Insurance: Cover, Limits and Who Needs It
Explore a related question linked in this guide.
21 min readCybersecurity for Small Business: 8 Things That Stop Attacks
Explore a related question linked in this guide.
9 min read
Frequently asked questions
Do small businesses need cyber insurance in Australia?
No law requires it, but it is worth quoting if an incident would stop you trading, if you hold customer personal or payment data, or if a client contract asks for it. ASD's 2024–25 threat report put the average self-reported cost of a cybercrime report at $56,600 for a small business. The policy's most useful part is often fast access to incident responders, lawyers and forensic specialists, paid for by the insurer.
What does cyber insurance cover?
Most small business policies combine first-party cover for your own losses (incident response, forensic investigation, legal advice, notifying customers, data restoration, business interruption and cyber extortion) with third-party cover for claims by people whose data was exposed and costs of regulatory investigations. Fines are only covered where the law allows them to be insured. Fake-invoice fraud and outages at your internet or utility provider are often excluded or need an extension.
How much does cyber insurance cost for a small business?
There is no reliable independent average premium for Australian small businesses, so get quotes. Price depends on your revenue, industry, how many personal records you hold, your security controls, the sum insured, the excess, the business interruption waiting period and any extensions such as social engineering cover. A business with MFA, offline backups and endpoint protection in place is easier to insure and may be declined without them.
Does cyber insurance pay ransomware demands?
Many policies include cyber extortion cover that can pay a ransom where it is lawful, typically managed by the insurer's incident team using negotiators and sanctions checks. Paying is not generally illegal in Australia, but the Government strongly discourages it, and paying a sanctioned person can be a criminal offence. Businesses with $3 million or more turnover must report any payment to ASD within 72 hours, even if the insurer paid.
Does cyber insurance cover fake invoice or payment redirection scams?
Often not under the core policy. When a staff member is tricked into paying a fake invoice, the loss usually needs a social engineering or funds transfer fraud extension, which often comes with a sub-limit well below the main cover. Insurers such as Chubb ask whether you verify changed bank details by phone on a known number and require two people to approve payments. Check the extension limit before relying on it.
Does the Notifiable Data Breaches scheme apply to my small business?
Usually not if your annual turnover is $3 million or less, counting all income from all sources. You are covered regardless of turnover if you provide a health service and hold health information, trade in personal information, are a credit provider, contract to the Australian Government, are an AML/CTF reporting entity, or have opted in. Any business holding tax file number information must also follow the scheme for breaches involving that information.
Do I have to report paying a ransom?
Yes, if your business had turnover of $3 million or more in the previous financial year or is a responsible entity for a critical infrastructure asset. You must report through ASD's form on cyber.gov.au within 72 hours of the payment, or of learning that someone paid on your behalf. Failing to report can attract a civil penalty of 60 penalty units, which the OAIC lists as $21,840 at the July 2026 penalty unit value.
Does professional indemnity insurance cover a cyber attack?
Sometimes, partly. A professional indemnity policy may respond to a client's claim that your error caused them a loss, and some wordings extend to certain cyber events. It usually won't pay your own costs of forensics, data restoration, lost income or extortion. Ask your insurer or broker to confirm in writing how your PI, business pack and cyber policies interact so you are not paying twice or leaving a gap.
Is cyber insurance worth it for a sole trader?
It depends on what you hold and how you get paid. A sole trader who stores client records, takes payments online or relies on email to invoice can lose income and face claims after one compromised account. Your personal assets back a sole trader's debts, so third-party claims matter. If your data is minimal and backed up offline, a cheaper first step is fixing MFA and backups, then pricing a small policy.
General information only. This guide doesn't take your personal or business circumstances into account and isn't financial, legal or tax advice. Rates and thresholds change — check the official sources linked in this guide and get qualified advice where your circumstances require it.