Cyber insurance for churches and nonprofits

1. What cyber insurance is, in one paragraph

Cyber liability insurance pays for the costs that follow a computer-related incident: someone breaks into your email, ransomware locks your files, a donor database leaks, or an employee is tricked into wiring money to a stranger. Depending on the policy, it can pay for the specialists who clean it up, the legal notices you're required to send, the income you lose while you're down, and the claims other people bring against you afterwards.

That is the whole idea. Everything else on this page is detail about which of those things a particular policy actually does, because the differences between policies are enormous.

2. The two halves of a policy

Every cyber policy divides into two kinds of coverage, and the distinction runs through everything else.

First-party coverage pays you, for your losses. Your forensic investigators, your ransom payment, your lost income, your notification letters.

Third-party coverage pays other people who claim you harmed them — plus your legal defence. A congregant sues because their giving records leaked; a regulator opens an investigation; a vendor claims your compromised system infected theirs.

Small organisations almost always use the first-party half. The third-party half is what protects you from the rare, expensive event. A policy heavy on one and light on the other is a real gap, and the declarations page — the summary sheet at the front listing each coverage and its limit — is where you can see the balance.

3. What's inside a policy, piece by piece

A cyber policy is built from separate insuring agreements — individual promises to pay, each with its own trigger and often its own limit. You do not necessarily get all of them. Some are optional and must be bought deliberately.

Here are the agreements you're most likely to meet, what sets each one off, and what it pays for.

4. The gap that matters most

If you read one section, read this one. It is where the attack your organisation is most likely to suffer meets the part of the policy least likely to pay for it.

The scenario is familiar: an email that appears to come from your building contractor says their bank details have changed. Your bookkeeper updates the payee and sends the payment. The money is gone. Or a message that looks like it's from the pastor asks for an urgent transfer.

In insurance language, the first is funds transfer fraud, and the deception behind it is social engineering fraud. And there is a historical wrinkle that still shapes how policies respond.

How big the gap can be

This is easiest to see in a real published example. One denominational insurance programme publishes a base policy that automatically includes $250,000 for losses from system attacks and $25,000 for cybercrime — scams, theft and fraud. At the higher optional tier those become $1 million and $100,000.

Look at the ratio. At both tiers, the cybercrime limit is one tenth of the breach limit. Now set that against the loss data: in one large cyber insurer's own claims for 2025, the average funds transfer fraud loss was $141,000, and business email compromise plus funds transfer fraud together accounted for 58% of all incidents. That figure comes from a single carrier's book rather than the whole market, but the direction is unambiguous, and it matches what the FBI reports.

The attack you are most likely to suffer is the one your policy is most likely to cap at a fraction of the loss. Finding that number on your declarations page takes two minutes and is probably the single most useful thing you can do with this page.

Where the coverage lives

It may sit in your cyber policy, in a separate commercial crime policy, in both, or in neither. Crime policies often offer higher limits for this than cyber policies do. If both respond, you need to know which pays first and whether the other is excess or excluded. These are questions for your broker, and they are worth asking in writing.

5. Two very different things share the name

Cyber coverage reaches small organisations in two quite different shapes, and they are not close to equivalent.

An endorsement is an add-on bolted to your existing package policy, often called something like "data compromise coverage." A standalone policy is a separate contract written specifically for cyber risk.

Regulator data shows how different they are. In the National Association of Insurance Commissioners' most recent market report, endorsements were 55.1% of all cyber policies in force but only 4% of premium. More than half the cyber policies in America are endorsements, and they collect roughly one twenty-fifth of the money. You cannot buy much coverage for one twenty-fifth of the premium.

Concretely, one nonprofit-focused package endorsement publishes a $50,000 limit with a $5,000 sublimit for legal and forensic review. A competent breach counsel and forensics engagement can exceed $5,000 in the first few days.

What a data-compromise endorsement typically does not include

Coverage	Typically in an endorsement?
Notification, forensics, legal review, credit monitoring, PR	Yes — but sublimited, sometimes severely
Ransomware / cyber extortion	Often expressly excluded
Business interruption	Usually absent
Funds transfer fraud	Usually absent
Network security liability	Usually absent

In plain terms: a data-compromise endorsement is notification insurance. It handles the legal paperwork that follows a records breach. The three things a small church is most likely to actually face — ransomware that stops you operating, a wire that vanishes, and a lawsuit — are the three things it commonly does not address.

That is not an argument that endorsements are bad or that you should buy something else. It is an argument for knowing which one you have. Many organisations believe they have cyber insurance and have an endorsement; some need nothing more, and some would be badly surprised.

6. The exclusions that actually bite

Exclusions are where policies say what they will not pay for. Most are unremarkable. These are the ones that decide real claims.

Failure to maintain the security you said you had

This is the most dangerous provision in cyber insurance, and it is entirely avoidable.

When you apply for cyber coverage, you answer a questionnaire about your security: do you use multi-factor authentication, do you back up, do you patch. Many policies then contain an exclusion tying coverage to those answers. One published form excludes loss arising from failure to keep systems protected by practices "equal to or superior to those disclosed in the proposal."

Your application becomes a continuing promise. Whatever you told the underwriter you were doing, you must keep doing.

What to do about it: ask for a copy of the completed application to be attached to your policy, keep it, and re-read every answer at each renewal to confirm it is still true. If something has changed, tell your broker before renewal rather than after a claim.

War and state-backed attacks

Since 31 March 2023, insurers at Lloyd's of London have been required to include an exclusion for state-backed cyber attacks in standalone cyber policies. The market bulletin setting this out (Lloyd's Y5381, issued 16 August 2022) requires clauses that exclude losses from war, and from state-backed attacks that "significantly impair the ability of a state to function" or "significantly impair the security capabilities of a state," together with a stated basis for attributing an attack to a state.

Several standard clause variants exist and they differ substantially in breadth. This matters because ransomware groups frequently have murky relationships with national governments.

You may have read that a policyholder beat a war exclusion in the Merck litigation over the NotPetya attack (New Jersey Appellate Division, No. A-1879-21, decided 1 May 2023; settled in January 2024 before a final ruling). That is true, and it is reassuring about older wording — the case concerned a legacy property policy. The industry's response was to write new wording designed to produce a different result. Merck is comforting about the past, not the present.

Claims-made cover and the retroactive date

Most general liability insurance is occurrence-based: if the event happened while you were covered, you're covered whenever the claim shows up. Cyber policies are almost always claims-made: you're covered only if the claim arrives during the policy period.

Paired with that is the retroactive date — a date before which nothing is covered, no matter when the claim arrives.

This is where switching insurers can hurt. A cheaper quote from a new carrier may come with a retroactive date set at the new policy's start, wiping out coverage for anything that happened earlier. Intrusions routinely sit undetected for months. A cheaper renewal with a fresh retroactive date can be a very expensive saving. Ask what the retroactive date is, every time, and ask whether prior acts are covered.

Betterment — the exclusion that makes the case for prevention

Policies exclude the cost of improving your systems beyond where they were. One form excludes "any expenses to improve, restore, replace or update the Computer System and/or Data Asset(s) to a level beyond that which existed prior to" the incident.

In plain English: insurance pays to put you back on the insecure system you were attacked on. It does not pay to make you secure. Upgrading from an old on-premises server to a hosted platform, extending monitoring beyond the immediate response, rebuilding the network more sensibly — those are improvements, and improvements are yours to fund.

Waiting periods on business interruption

Business interruption coverage doesn't start the moment you go down. A waiting period — commonly somewhere between six and twelve hours, sometimes twenty-four — must pass first.

Two structures share that label and pay very differently. Under one, the waiting period is a time deductible: with a twelve-hour wait and a twenty-four-hour outage, you're paid for twelve hours. Under the other, it is only a trigger: cross twelve hours and coverage applies back to hour zero, so you're paid for all twenty-four. The declarations page may look identical in both cases. Ask which one you have.

Consent and panel vendors

Policies typically require the insurer's prior written consent before you spend on forensics, legal advice, credit monitoring or PR — and usually direct you to their approved panel of specialists.

This has a practical edge and a genuine upside. If you call your usual IT company first and run up a large bill, that bill may not be covered. But the carrier's breach counsel and forensics firm are generally far more experienced at this than a local provider. The constraint is often to your benefit — as long as you call the incident hotline before anyone else. Put that number somewhere you can find it without logging into a computer.

Others worth checking

• Unencrypted data and devices. Some forms exclude loss involving unencrypted transmitted data or unencrypted mobile devices.
• End-of-life software. Running an operating system past its support date can be excluded outright.
• Dishonest acts by insiders. A bookkeeper embezzling is a fidelity or crime claim, not a cyber claim.
• Bodily injury and physical damage. A cyber policy will not replace hardware that was physically destroyed.
• Mass texting and email rules. Claims under telephone and anti-spam statutes are commonly excluded — relevant if you text or email your congregation at scale.
• Anything you already knew about. Incidents known before the policy began are excluded. Do not shop for insurance after you suspect something has happened.

7. What cyber insurance never covers

Some losses are outside every policy. Being clear-eyed about these is part of deciding how much coverage you actually need.

• Reputational damage that affects revenue — the industry body's own guidance lists revenue-impacting damage to brand and reputation as not typically covered. Some policies do include a narrowly defined reputational harm agreement, so it is not universally absent, but the broad version does not exist.
• Long-term donor attrition. If giving declines over the year after a breach becomes public, no policy makes that up. Note a real distinction: foregone donations from a specific cancelled event during a defined interruption period may be reachable under business interruption. Generalised loss of confidence is not.
• The cost of becoming more secure — betterment, as above.
• Your people's time. Policies pay outside vendors. The forty hours your administrator spends on this are not a covered loss in any form we could find.
• Loss of congregational trust. Not insurable in any form, and for most churches the loss that actually matters.
• Anything below the retention (the amount you pay before coverage begins) or inside the waiting period.

8. What insurers now require before they'll quote

Cyber underwriting has tightened considerably. Applications now ask detailed technical questions, and the answers affect whether you can buy coverage at all — not just what it costs.

Drawn from an actual carrier application for organisations under $10 million in revenue, and from a US state government's cyber insurance toolkit, the controls asked about most consistently are:

• Multi-factor authentication — on email, on remote access, on cloud services, and specifically on administrator accounts. Applications ask about each separately, which is exactly where organisations get caught out.
• Backups — with questions about frequency, encryption, offline or air-gapped storage, separate credentials, MFA on the backups themselves, and whether restoration has been tested.
• Endpoint detection and response — security software on computers with central monitoring, rather than traditional antivirus alone.
• Email filtering — screening attachments and links before delivery.
• Patching — a written process, with critical updates applied within about 30 days, and no software past its end-of-support date.
• Least-privilege access — people have only the access their role needs.
• Security awareness training, often including simulated phishing.
• Written incident response and recovery plans, tested at least annually.
• Payment verification procedures — confirming bank detail changes by phone, using a number you already held.

Whether a given control is a hard requirement, a pricing factor, or a condition you must maintain depends entirely on where the insurer puts it — in its rating model, in an exclusion, or in a warranty. There is no universal answer, which is precisely why the application-and-renewal discipline described earlier matters so much.

9. How to read your own policy in fifteen minutes

You do not need to read the whole contract. Go to the declarations page — the summary at the front — and find these seven things.

1. Is this a standalone policy or an endorsement? An endorsement will be attached to your package policy and will usually be short.
2. The overall limit, and whether breach response costs sit inside it or on top of it.
3. Every sublimit. Write them down. Look specifically for social engineering, funds transfer fraud, cybercrime, ransomware, and forensic and legal costs. This is where the surprises live.
4. The retention or deductible — what you pay before the insurer pays.
5. The waiting period on business interruption, and whether it is a time deductible or only a trigger.
6. The retroactive date, and whether prior acts are covered.
7. The incident hotline number. Print it. Put it somewhere reachable without a computer, because the day you need it your computers may be the problem.

Then find the completed application attached to the policy and check that every answer is still true today.

10. Questions worth asking your broker

Sources: National Association of Insurance Commissioners, Report on the Cybersecurity Insurance Market (2025); Lloyd's of London, Market Bulletin Y5381, Cyber-attack exclusions; Coalition 2026 Cyber Claims Report; National Conference of State Legislatures, Security Breach Notification Laws; Insurance Information Institute, Cyber insurance; Indiana Cybersecurity Hub, Underwriting Security Controls; Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 22-cv-2145 (C.D. Ill.); Merck & Co. v. ACE American Insurance Co., No. A-1879-21 (N.J. App. Div. 2023).