Is Cyber Liability Insurance Required by Law?

No. No U.S. state or federal law requires general businesses to carry cyber liability insurance. All 50 states have data breach notification laws, which require businesses to disclose a breach to affected individuals within a certain timeframe, but none of those laws require buying insurance to cover the cost of responding to one.

There is one adjacent rule worth knowing about: at least 28 jurisdictions have adopted some version of the NAIC Insurance Data Security Model Law, but that law applies to insurers and insurance agencies themselves, requiring them to maintain an information security program. It is not a mandate on general businesses to purchase a cyber policy.

Even without a legal requirement, many businesses carry cyber liability insurance because vendor contracts, client agreements, or lender requirements increasingly expect it, and because the average cost of an incident ($246,000 for small and medium-sized businesses, per NetDiligence) dwarfs the typical premium.