Guide
Cyber Insurance in Singapore: an employer’s buying guide
· Last reviewed 17 October 2026
Cyber Insurance should be reviewed alongside the business’s security controls and incident-response plan. Compare which events trigger cover, which response services are included, what expenses and liabilities are insured, and which exclusions or conditions apply. A policy is not a substitute for security or a guarantee that every cyber loss is reimbursed.
What kinds of cover might be included?
AIG’s CyberEdge page describes cyber-risk cover and response support, including specified network-interruption losses. This is one official product example, not a universal list of benefits. Ask the proposed insurer to identify the selected modules, triggers, limits and service arrangements in writing.
SourcesAIG Singapore
What should the business map before asking for a quote?
| Area | Information to prepare |
|---|---|
| Operations | Critical systems and what stops when they are unavailable |
| Data | Types of information held and where it is processed |
| Dependencies | Cloud, IT and other providers important to operations |
| Controls | Accurate answers to the insurer’s security questionnaire |
| History | Relevant incidents, claims and known issues requested by the insurer |
| Response | Who can contact the insurer and authorised specialists during an incident |
Which policy questions matter most?
- What events trigger incident-response services and who can authorise them?
- Which costs, third-party liabilities and interruptions are included?
- What waiting periods, sub-limits, excesses or aggregate limits apply?
- How are external service-provider incidents treated?
- Which controls must be maintained, and what happens if they change?
- What exclusions and consent requirements apply to proposed response actions?
How should the security questionnaire be completed?
Have the relevant IT or security owner verify each answer and keep supporting records. Do not answer yes to a control simply because a service provider says it is planned. If the scope is unclear, ask the insurer what systems and users the question covers.
Illustrative example: multi-factor authentication is enabled for office email but not for remote administration. Describe the actual implementation and seek clarification rather than treating one enabled system as proof that all access is protected.
How does the policy connect to an incident plan?
Keep the insurer’s incident contact and authorisation requirements available outside the systems that may fail. Define who can call, who coordinates IT, who handles communications and who reviews legal or regulatory obligations. A policy decision and a notification obligation are different questions.
Do not send sensitive incident evidence to unrelated recipients while seeking support. Use the agreed response channel and preserve relevant records. This guide does not determine whether a particular event is reportable or whether a claim will be accepted.
Why is this relevant to an employee-benefits programme?
Benefits administration can involve identity and medical information. Review access, transfers and provider responsibilities as part of the operating process. Insurance may be one part of risk management, but data minimisation and clear ownership still need practical implementation.
What a data breach means for a small business
Under the PDPA, a data breach that is likely to cause significant harm to individuals, or is of significant scale, must be reported to the PDPC no later than three calendar days after you assess that it is notifiable.
Cyber policies differ in what they pay. First-party cover pays your own losses, such as lost revenue and the cost of restoring data. Third-party cover, often called cyber liability, pays claims from people whose data was breached. If you hold customer data, check that the policy you compare includes both.
SourcesPersonal Data Protection CommissionPersonal Data Protection CommissionMonetary Authority of Singapore
Questions
Does cyber insurance guarantee payment after ransomware?
No. The actual event, selected cover, exclusions, conditions and applicable law need review. Do not infer payment from the product category.
Can cyber insurance replace backups and access controls?
No. Maintain an appropriate security and recovery programme and answer the insurer’s control questions accurately.
Sources for this page
- Cyber Insurance: CyberEdge
Relevant section: Coverage and incident response
Official product example. Other cyber contracts may differ; no universal cover or payment promise is inferred.
- A bold approach to cyber risk management (speech)
Relevant section: First-party and third-party cyber cover
Speech dated 16 May 2016 describing first-party and third-party cyber insurance.
- Data protection obligations
Relevant section: Data breach notification obligation
Page dated 3 April 2023. Breaches likely to cause significant harm or of significant scale must be notified.
- Required to notify the PDPC
Relevant section: Notification timeline
Page dated 1 September 2026. Notifiable breaches must be reported no later than three calendar days after the assessment.