For a flooring contractor, the exposures cyber liability insurance is written for sit mostly outside general liability and property: customer card and bank details, emailed invoices, cloud estimating software and the office computer. Under the standard forms, electronic data is not tangible property, and a separately written cyber policy is built for breach costs and the claims that follow.
Where a flooring business actually holds data and moves money
A small flooring business holds more personal and financial information than its size suggests, most of it in email, phones and cloud software.
Payments first. A deposit taken by phone at the estimate, a card number jotted on a job ticket, a homeowner paying by card or bank transfer: on residential work, you handle individuals’ financial details directly. On commercial work, money moves the other way too, as progress invoices and change orders go by email to general contractors and property managers, and suppliers email their invoices to you.
Then the records. Estimating, scheduling and invoicing tools hold customer names, addresses, photos of homes and measurements, usually on a vendor’s servers. The office keeps tax forms, Social Security numbers and driver’s license numbers for employees and 1099 installers. Phones and tablets with photos, email and payment apps ride in vans all day.
The devices themselves are property. Computers at the shop belong on the property coverage page, and equipment that leaves the shop belongs on the tools and equipment floater. This post is about the data on them.
What the standard general liability form does with electronic data
General liability is built around physical harm, and under the standard ISO form as commonly written it treats lost or corrupted data as outside that shape. The Commercial General Liability Coverage Form (CG 00 01 04 13, the edition we read) defines property damage in the first instance as “Physical injury to tangible property, including all resulting loss of use of that property.” The same definition closes with a sentence that settles the data question: “For the purposes of this insurance, electronic data is not tangible property.”
Its electronic data exclusion then removes “Damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” It keeps one door open: “However, this exclusion does not apply to liability for damages because of ‘bodily injury’.”
The form’s personal and advertising injury coverage does list, among its offenses, “Oral or written publication, in any manner, of material that violates a person’s right of privacy”, but nothing we read establishes that this offense answers a data-breach claim, and this post does not treat it as one. That coverage part is the subject of personal and advertising injury for flooring contractors. For what the policy is built to answer, see what general liability answers for, and what it hands off.
The access-or-disclosure exclusion an insurer can add
Some general liability policies go further, through an exclusion endorsement an insurer can add. The standard ISO version is the access-or-disclosure exclusion, CG 21 06 05 14 (the edition we read).
It replaces the base form’s electronic data exclusion with a wider one. Its first paragraph reaches “Any access to or disclosure of any person’s or organization’s confidential or personal information, including patents, trade secrets, processing methods, customer lists, financial information, credit card information, health information or any other type of nonpublic information; or” the loss of or inability to access electronic data. It names the costs a breach typically brings: “This exclusion applies even if damages are claimed for notification costs, credit monitoring expenses, forensic expenses, public relations expenses or any other loss, cost or expense incurred by you or others”.
The endorsement keeps a narrower bodily injury exception than the base form; that exception does not reach injury arising from access or disclosure. It also adds a parallel exclusion to the personal and advertising injury coverage for “‘Personal and advertising injury’ arising out of any access to or disclosure of any person’s or organization’s confidential or personal information”.
Not every policy carries it, and nothing we read shows how often it is attached. If it appears in the forms schedule on your declarations, that side of the data question is closed in writing.
What the property form restores, and where it stops
A commercial property policy repairs some data loss at the shop, but only through a narrow additional coverage with its own cap. Under the standard ISO form as commonly written, the Building and Personal Property Coverage Form (CP 00 10 10 12, the edition we read) lists among property not covered “Electronic data, except as provided under the Additional Coverage, Electronic Data.”
That additional coverage lists among its covered causes “a virus, harmful code or similar instruction introduced into or enacted on a computer system (including electronic data) or a network to which it is connected”, and it says “we will pay for the cost to replace or restore electronic data which has been destroyed or corrupted by a Covered Cause of Loss.” To the extent the data is not restored, “the loss will be valued at the cost of replacement of the media on which the electronic data was stored, with blank media of substantially identical type.”
Three limits follow. That coverage is a separate, capped amount printed in the form, which the declarations can raise. It excludes manipulation of the system by an employee or by a firm you retain to install or maintain it; employee dishonesty belongs to commercial crime coverage for a flooring business. And it pays to restore data, not to answer a customer’s claim. Lost income after physical damage is the property page’s business income section; a data outage with no physical damage is a different question.
Real-World Scenario: A flooring contractor’s office manager opens an email that looks like a supplier’s statement. By morning the office computer and shared drive are locked, with a payment demand on the screen. Schedules, estimates and the customer file with card details from phone deposits are out of reach, and nobody knows whether the files were copied. General liability does not respond to lost data, and the property form’s data coverage only restores files, up to its cap. Forensics, legal advice on whether customers must be told, notification and the lost days are the kind of losses a cyber policy is built to answer.
The two halves of a cyber policy
A cyber policy is built in two halves: one pays your own costs after an incident, the other answers claims others bring against you. Cyber policies are written by each insurer rather than on one standard bureau form, so wording varies.
Cyber Insurance, a guide insurance regulators publish with the FTC, puts the purpose plainly: “Cyber insurance is one option that can help protect your business against losses resulting from a cyberattack.” It describes the first half this way: “First-party cyber coverage protects your data, including employee and customer information.” Among the items it says that coverage typically includes are “Legal counsel to determine your notification and regulatory obligations”, “Recovery and replacement of lost or stolen data”, “Customer notification and call center services”, “Lost income due to business interruption”, and “Forensic services to investigate the breach”.
The second half is liability: “Third-party cyber coverage generally protects you from liability if a third party brings claims against you.” The guide lists “Payments to consumers affected by the breach” and “Costs for litigation and responding to regulatory inquiries” among its typical items.
The guide frames the buying decision as a choice, “including whether you should go with first-party coverage, third-party coverage, or both.” A business taking card deposits from homeowners should price both.
Email invoices, fake payment instructions and where the cyber question ends
Payment diversion is the exposure where no policy should be assumed to respond. The FBI’s Internet Crime Complaint Center, in a public service announcement on business email compromise, describes business email compromise as a scam that “targets both businesses and individuals who perform legitimate transfer-of-funds requests.” It works when someone “compromises legitimate business or personal email accounts through social engineering” or “computer intrusion to conduct unauthorized transfers of funds.” It is not only a large-company problem: “The BEC scam continues to target small local businesses to larger corporations, and personal transactions”.
For a flooring contractor it runs both ways: a customer pays a fraudster posing as you, or your office pays a fraudster posing as a supplier or installer.
The regulators’ guide lists “Cyber extortion and fraud” among typical first-party items, but whether a particular policy answers a diverted payment depends on its own definitions. Ask three questions before you rely on anything: does the cyber policy define fraud to include a payment your office was tricked into sending; does it address a payment a customer sent to a fake account; and does a commercial crime policy’s funds-transfer or social-engineering wording apply instead. The commercial crime post takes up that side.
The FBI’s advice is practical. “If you discover a fraudulent transfer, time is of the essence.” “Immediately contact your financial institution and request a recall of the funds along with any necessary indemnification documents.” And to prevent one: “Use secondary channels and/or two-factor authentication to verify requests for changes in account information.”
Breach-notice duties, with Florida’s law as one example
Breach-notice duties come from state statutes, and the smallest flooring outfit can be inside one. We read one state’s law as an example; this post does not describe other states’ laws.
Florida’s data-breach law defines the term this way: “‘Breach of security’ or ‘breach’ means unauthorized access of data in electronic form containing personal information.” Its covered entity includes “a sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other commercial entity that acquires, maintains, stores, or uses personal information.” Personal information includes “A financial account number or credit or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual’s financial account”.
The duties follow. A covered entity “shall take reasonable measures to protect and secure data in electronic form containing personal information.” After a breach, “A covered entity shall give notice to each individual in this state whose personal information was, or the covered entity reasonably believes to have been, accessed as a result of the breach”, on a deadline the statute sets. The law also reaches vendors: “‘Third-party agent’ means an entity that has been contracted to maintain, store, or process personal information on behalf of a covered entity or governmental entity.” It also requires reasonable disposal of old customer records. And “A violation of this section shall be treated as an unfair or deceptive trade practice in any action brought by the department”.
If you work there, see the Florida flooring contractor insurance page.
What to ask before you buy a cyber policy, and habits that help
Because cyber policies are carrier-written, the questions matter more than the label. The regulators’ guide suggests asking whether a policy covers “Cyberattacks on your data held by vendors and other third parties”, whether it will “Defend you in a lawsuit or regulatory investigation (look for ‘duty to defend’ wording)”, and whether it will “Provide coverage in excess of any other applicable insurance you have”.
How you work matters too. The federal Cybersecurity and Infrastructure Security Agency’s cyber guidance for small businesses starts from a blunt premise: “Small businesses often do not have the resources to defend against devastating cyber threats like ransomware.” It recommends an incident response plan (“The IRP is your action plan before, during and after a security incident.”), multifactor sign-in (“Any form of MFA is better than no MFA.”), and backups you actually test: “It’s critical to regularly test partial and full restores.” For crews on the road: “Given how many laptops are lost or stolen each year, it’s important to ensure that your laptop fleet is protected.”
Cyber is not the policy for a bad recommendation; that is professional liability for flooring contractors, which also explains claims-made timing. The flooring contractor insurance hub shows how a cyber policy fits beside the rest of the program. If you take card deposits, email invoices or keep customer files in the cloud, tell us how your office handles them.