A data center aisle at night, locked server racks with status lights and bundled network cabling, an operations room behind glass — small business cyber insurance

California commercial insurance

Small Business Cyber Insurance California

A small business usually runs on one email system, one bank login and one accounting platform, and a single compromise can reach all three. This page explains what small business cyber insurance covers in California, what answering a breach actually involves, and what to have ready for a quote.

Breach Response & Notice
Ransomware & Downtime
Payment Fraud Coverage

Reviewed by David Gleason, Principal — October 11, 2026

Start Quote Now 844-978-7283

Next Level Experience. Insurance Done Right.

Request a Quote Call 844-978-7283 See FAQs

CaliforniaGeneral information only, not legal advice — illustrative scenarios and coverage, subject to change without notice. Content may be out of date or contain errors, and requirements vary by city, county, state, agency, project, contract, carrier and policy, among other factors; verifying what applies to your own situation is your responsibility. Full disclaimer

Prefer to send everything at once? Complete a streamlined submission — just needs your review. Especially worth it if your business does $2M+ in annual sales — it can meaningfully speed up carrier turnaround.

Interactive coverage guide

Build a coverage stack around how the business actually operates.

Start with the preselected industry or trade, then adjust the operational questions. The commonly considered stack updates live. Keep the coverages you want GIB to evaluate, remove ones you do not want included in your quote request, and add other available lines before continuing.

Common Starting Coverages

General LiabilityThird-party injury and property damage

What it is

General Liability commonly addresses covered third-party bodily injury, property damage and certain personal or advertising injury claims, subject to the policy.

Why businesses like yours commonly carry it

Businesses commonly use it as a starting liability policy and to satisfy customer, landlord or contract requirements.

Possible coverage gap

General Liability is not intended to replace policies for employee injuries, business vehicles, owned property, cyber events or professional errors.

Learn more about General Liability

Cyber Liability & Data BreachCyber events, data and system interruption

What it is

Cyber insurance may address certain first-party and third-party losses from covered data breaches, cyberattacks, ransomware and system interruption, depending on the policy.

Why businesses like yours commonly carry it

A smaller business often runs on one email system, one bank login and one accounting platform, so a single compromise can reach all three.

Possible coverage gap

General Liability generally should not be assumed to address data breach response, ransomware or network interruption.

Learn more about what cyber insurance costs in California

Commonly Added Based on Operations

Business Owners Policy / Commercial PackageLiability and property components evaluated together

What it is

A Business Owners Policy commonly combines liability and property coverages for eligible businesses. A Commercial Package Policy may combine multiple commercial coverage parts depending on the account and carrier.

Why businesses like yours commonly carry it

Businesses with premises, contents, inventory or other property exposures may ask GIB to evaluate whether liability and property components can be packaged where appropriate.

Possible coverage gap

Eligibility, included coverages and package structure vary by carrier. Commercial Property may also be written separately rather than as part of a package.

Learn more about Business Owners Policy / Commercial Package

Commercial Crime / FidelityEmployee theft and certain fraud losses

What it is

Commercial Crime may address certain covered theft, fraud and funds-transfer losses, depending on the selected insuring agreements.

Why businesses like yours commonly carry it

Businesses handling money, inventory, payments or account access commonly consider crime coverage.

Possible coverage gap

Property and cyber policies do not necessarily cover every employee theft or social-engineering loss.

Learn more about Commercial Crime / Fidelity

Exposure-Dependent Coverages

Employment Practices LiabilityEmployment-related allegations

What it is

EPLI may address certain covered employment-related claims such as discrimination, harassment, retaliation or wrongful termination.

Why businesses like yours commonly carry it

Businesses with employees or managers commonly consider employment-practices protection as the workforce grows.

Possible coverage gap

Workers Compensation and General Liability generally do not replace employment-practices coverage.

Learn more about Employment Practices Liability

Umbrella / Excess LiabilityAdditional limits above scheduled liability policies

What it is

Umbrella or Excess Liability may provide additional limits above identified underlying liability policies, subject to its own terms and exclusions.

Why businesses like yours commonly carry it

Businesses with larger contracts, vehicles, public exposure or higher severity potential commonly consider additional limits.

Possible coverage gap

An umbrella does not automatically broaden every exclusion or sit over every policy unless the issued terms say it does.

Learn more about Umbrella / Excess Liability

Do you have specific insurance requirements from a project, customer, vendor, landlord, lender, lease, or contract?

Yes — I have them nowOpen the Requirements Analyzer to review or upload them.Yes — but I don't have them available yetContinue now and flag the quote for follow-up.No — I don't have specific requirementsContinue directly to the quote request.

Loading quote and requirements options…

Continue With These Coverages

Educational guidance only. Results are not a coverage recommendation, quote, binder, policy interpretation, or guarantee of coverage. Actual needs, availability, forms, limits, exclusions and requirements vary. A licensed insurance professional should review the complete risk and issued policy terms.

Verified Google reviews

What our cyber insurance clients say about us

5.0 / 5from 7 Google reviews

Reviews reflect individual client experiences and are not a guarantee of coverage, pricing or results.

91 Enterprise LLC

March 24, 2026

We are using Gleason insurance for our commercial auto policy and GL policy. David is the best insurance broker I've worked with — very honest, responsive, and knowledgeable. Highly recommend.

Fito Plumbers

February 20, 2026

We have been working with David at Gleason Insurance Brokers for 8+ years. David always goes above and beyond to make sure we have the appropriate coverages. He explains everything in detail and makes sure we feel confident and understand all of our policies. He is always available and responds right away!

Barry Stay

February 17, 2026

David provides great service and I highly recommend him for your insurance needs.

Why small businesses end up on the target list

Most attacks on small businesses are not personal. Criminals send the same phishing message to thousands of inboxes, scan for unpatched software and buy stolen passwords in bulk, then work whichever accounts open. A business with fewer controls is simply more likely to be one of them.

The losses are large in aggregate. The FBI's Internet Crime Complaint Center received 859,532 complaints in 2024 with $16.6 billion in reported losses, and California businesses and residents filed more complaints and reported more losses — about $2.54 billion — than any other state.

Most attacks are automated, not aimed at one business

Fewer controls make a business more likely to be breached

IC3 recorded $16.6 billion in reported losses in 2024

California led every state in complaints and losses

What a small business cyber policy usually includes

A standalone cyber policy typically combines several coverage parts. First-party parts pay the business's own costs: forensic investigation, legal advice, notifying affected people, credit monitoring, restoring data, income lost during a network outage and, where included and lawful, responding to extortion. Third-party parts respond to claims from customers, vendors or regulators over the incident.

Payment fraud usually sits on its own line. Social-engineering coverage, for an employee tricked into sending money, is often included with a sublimit well below the policy limit, and some carriers add invoice-manipulation coverage when a business's own customers are deceived into paying a criminal. What any particular policy includes depends on its form and endorsements.

Breach response: forensics, legal, notice, monitoring and restoration

Business interruption for income lost during an outage

Liability for claims from customers, vendors or regulators

Social-engineering coverage, often with a lower sublimit

What answering a breach involves in California

California's breach-notification law applies to any business that owns or licenses computerized personal information about California residents, not only large companies. Under Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, affected residents must be notified within 30 calendar days of discovering a breach, subject to limited delays, and a sample notice goes to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.

Meeting that deadline usually means hiring a forensic firm to find out what was accessed, a privacy attorney to decide who must be told and what the letters must say, and a vendor to mail notices and offer credit monitoring — all within weeks. Those are the costs a cyber policy's breach-response coverage is designed to fund. The separate California Consumer Privacy Act applies to larger businesses, including those with annual revenue above $26,625,000 after the 2025 inflation adjustment.

Breach-notice law applies to businesses of every size

Notify affected residents within 30 calendar days (SB 446)

Over 500 residents: sample notice to the Attorney General in 15 days

Forensics, legal review and mailing are the costs coverage funds

Controls that matter to underwriters and attackers alike

The controls insurers ask about are the same ones that stop most attacks: multi-factor authentication on email, banking and remote access; backups kept separate from the network and tested by actually restoring them; automatic software updates; endpoint protection on every computer; phishing training; and a rule that any change to payment instructions is confirmed by calling a number already on file.

Free federal guidance covers each of them. The Cybersecurity and Infrastructure Security Agency's Secure Your Business pages, the FTC's Cybersecurity for Small Business materials, the Small Business Administration's cybersecurity guide and NIST's Small Business Cybersecurity Corner are written for owners without an IT department.

Multi-factor authentication on email, banking and remote access

Separated backups, tested by restoring them

Updates, endpoint protection and phishing training

Free guidance from CISA, the FTC, the SBA and NIST

A cyber endorsement on a package policy versus a standalone policy

Some business owners policies and package policies offer a data-compromise or cyber endorsement. These can be a useful start, but they are usually narrow: lower limits, fewer coverage parts and sometimes response costs only, with no business interruption, extortion or social-engineering coverage.

A standalone cyber policy is where broader limits and coverage parts are generally found. The practical test is to read both against the three losses most likely for the business — a breach of customer or employee data, a ransomware outage and a diverted payment — and see which document answers each one. Our comparison of cyber insurance and general liability goes further.

Package-policy endorsements are often narrow and sublimited

Standalone policies generally carry broader coverage parts

Test both against a breach, a ransomware outage and a diverted payment

General liability is generally not written for cyber events

An illustrative small-business incident

An eight-person bookkeeping firm's office manager opens an invoice attachment that installs ransomware over a weekend. On Monday the client files, payroll records and accounting software are encrypted, and a note demands payment. The firm needs a forensic team to restore systems and confirm whether client tax data was taken, a privacy attorney to assess notice duties, and income support while it cannot bill.

This example is illustrative, not a report of an actual case or a promise of how any real claim would resolve — real outcomes depend on the specific policy, the facts involved, and the carrier's own review. For a situation that's actually happened or is happening, talk to your broker, a licensed attorney, or the relevant regulatory authority directly.

Ransomware arrives through a routine-looking attachment

Client data and accounting systems are encrypted together

Forensics, legal review and lost income follow at once

Illustrative only — real claims depend on the policy and the facts

Getting a small business cyber quote

A small business cyber submission is usually short. Have annual revenue, employee count, the kinds and number of records held, the software used for email, banking and accounting, and which of the controls above are in place. If a client contract or landlord requires cyber coverage, include the wording.

We compare small business cyber policies across carriers on limits, sublimits, retentions and what comes with the policy. Call 844-978-7283 or request a quote with Cyber Liability selected, and see what cyber insurance costs for the factors that move the premium. Medical and dental practices face patient-record and HIPAA exposures that call for coverage built for them, outlined on healthcare cyber insurance.

Revenue, employees, records held and software used

Which security controls are already in place

Any contract or lease that requires cyber coverage

Call 844-978-7283 or request a quote with Cyber Liability selected

Frequently asked questions

8 questions — start typing to filter

What does small business cyber insurance cover?

Typically breach response (forensics, legal advice, notice and credit monitoring), data restoration, income lost during a network outage, extortion response where included and lawful, liability for claims over a data incident and, often with a sublimit, social-engineering losses. Each policy's form and endorsements control.

Is cybersecurity insurance for a small business worth it?

Size is rarely what decides it. Most attacks are automated, and California's breach-notice law applies to any business holding computerized personal information about California residents. The data you hold and how much revenue depends on systems staying up are better guides to whether the premium is worth it.

Does my business owners policy include cyber coverage?

Some include or offer a data-compromise endorsement, but it is usually narrow and sublimited and may not include business interruption, extortion or payment-fraud coverage. A standalone cyber policy generally offers broader coverage parts and limits.

What does California require after a small business data breach?

Under Civil Code section 1798.82, as amended by SB 446 effective January 1, 2026, affected California residents must generally be notified within 30 calendar days of discovery, and a sample notice goes to the Attorney General within 15 calendar days of notifying consumers when more than 500 residents are involved.

Which security controls do insurers ask small businesses about?

Multi-factor authentication on email and remote access, separated and tested backups, automatic updates, endpoint protection, phishing training and a callback procedure for payment changes are among the most common.

Does cyber insurance cover money lost to a fake invoice or payment request?

It may, if the policy includes social-engineering or fraudulent-instruction coverage and the loss fits the wording. That coverage is often sublimited and may carry a verification condition. See wire fraud under cyber and crime policies.

How much does small business cyber insurance cost?

It depends on revenue, industry, records held, security controls, prior incidents and the limit and retention chosen. Our cyber insurance cost guide explains each factor rather than quoting a number that would not fit your business.

What do I need to request a small business cyber quote?

Annual revenue, employee count, the kinds and number of records held, the software used for email, banking and accounting, the security controls in place and any contract wording that requires cyber coverage.

Official resources

Verify current licensing, regulatory and program requirements directly with the responsible agency — this is general information, not legal advice, requirements change without notice, and what is summarized here may be out of date or contain errors. Confirming what applies to your own city, project, contract and policy is your responsibility.

California Civil Code §1798.82 — Breach Notification (as amended by SB 446)Verified 2026-10-11 California Attorney General — Data Security Breach ReportingVerified 2026-10-11 CISA — Secure Your Business (small and medium businesses)Verified 2026-10-11 FTC — Cybersecurity for Small BusinessVerified 2026-10-11 U.S. Small Business Administration — Strengthen Your CybersecurityVerified 2026-10-11 NIST — Small Business Cybersecurity CornerVerified 2026-10-11 FBI IC3 — 2024 Internet Crime ReportVerified 2026-10-11

Explore Related Coverage and Resources

Related coverage

Cyber insurance quotes by industry Management liability: D&O, EPLI and crime Professional liability and errors and omissions General liability insurance in California Commercial property insurance Business owners policy for smaller operations Workers compensation insurance in California Umbrella and excess liability limits Commercial auto and fleet insurance

Guides and resources

What cyber insurance costs in California Cyber insurance for restaurants Does GL cover a data breach?Preparing a cyber insurance application Ransomware response and coverage Cyber insurance directory by industry

Updated October 11, 2026

Next Level Experience. Insurance Done Right.

One Stop. We Shop. Real Results.

Get a Quote