October Cybersecurity Awareness

October 15, 2026

Every October, businesses around the country participate in Cybersecurity Awareness Month. The goal is simple: help people recognize cyber risk and take everyday actions that strengthen protection for individuals and organizations alike. For business owners, this is especially important because when cyber incidents happen, they can quickly disrupt operations, damage customer trust, and create unexpected financial stress.

How do backups help a business recover from a cyberattack?

Regular backups help businesses restore critical files and systems after ransomware, accidental deletions, or equipment failures. Even strong cybersecurity practices cannot eliminate every risk, so a recovery plan is essential.

A practical backup approach includes:

• Backing up critical business data on a consistent schedule.
• Keeping protected copies separate from your primary systems, including offline or otherwise isolated backups.
• Encrypting backups and restricting access.
• Regularly testing whether files and systems can actually be restored.

The Cybersecurity and Infrastructure Security Agency’s ransomware guide recommends offline, encrypted backups and regular recovery testing.

For example, if ransomware locks your customer records and billing system, a usable backup can help restore operations. Ask your IT provider how much data you could lose between backups and how long recovery would take.

Why are software updates important for cybersecurity?

Software updates often fix security vulnerabilities that attackers can exploit. Keeping operating systems, browsers, business applications, and security tools current helps reduce exposure.

Business owners should work with their IT provider to:

• Establish a process for installing security updates promptly.
• Identify outdated software and devices that no longer receive security support.
• Use company-approved devices and security tools.
• Require employees to lock unattended devices and sign out of shared accounts.

Assign responsibility for updates so this important task does not fall between employees and outside vendors.

What should a business cyber incident response plan include?

A cyber incident response plan identifies who to contact, who makes decisions, and what steps to take when suspicious activity or a breach occurs. Even a small business benefits from having these responsibilities documented before an emergency.

Your plan should address:

• How employees report suspicious emails, account activity, or system problems.
• Who coordinates with your IT provider or security team.
• How to reach your cyber insurer’s incident reporting service.
• Who works with legal counsel to assess notification obligations.
• How you will communicate with employees, customers, and partners.
• How critical operations will continue while systems are unavailable.

Keep essential contact information accessible if your usual email or network is unavailable. Review and practice the plan periodically, using resources such as CISA’s ransomware response guidance.

What does cyber insurance cover?

Cyber insurance can help businesses manage certain financial losses and liabilities resulting from a cyber incident. Depending on the policy, coverage may address incident response, data restoration, business interruption, cyber extortion, and liability arising from a data breach.

Coverage is commonly grouped into two categories:

First-party coverage addresses certain losses and expenses your business directly experiences. These may include forensic investigation, customer notification, data restoration, lost business income, and crisis management services.

Third-party coverage addresses certain claims against your business. These may include privacy or network security liability, regulatory defense, and media liability.

The Federal Trade Commission’s cyber insurance guidance encourages businesses to discuss whether first-party coverage, third-party coverage, or both fit their needs. Coverage remains subject to the policy’s terms, conditions, exclusions, and limits.

For example, ransomware that interrupts operations can create different expenses than a breach exposing customer information. When reviewing coverage with your Robertson Ryan Insurance agent, discuss the systems and information your business relies on, the potential cost of downtime, and the services available after a covered incident.

Does cyber insurance cover phishing and fraudulent money transfers?

A phishing email can lead to different types of losses, so business owners should not assume every phishing-related incident is covered the same way.

An email that compromises customer information presents different coverage questions than one that tricks an employee into sending money to a fraudulent account. Ask your agent how your policies address social engineering and fraudulent funds transfers, including separate endorsements, sublimits, exclusions, and verification requirements.

Does cyber insurance replace cybersecurity measures?

Cyber insurance complements cybersecurity practices. It does not replace employee training, multifactor authentication, software updates, secure backups, or a response plan.

When reviewing insurance, ask about required security controls, incident reporting procedures, approved response providers, and any consent requirements before incurring expenses. Understanding these provisions before an incident helps you prepare.

Make October the start of stronger cyber preparedness

Use Cybersecurity Awareness Month to review three areas: your security practices, your incident response plan, and your cyber insurance.

Confirm who you would contact after an incident, how you would recover critical data, and how your coverage may respond to the resulting expenses. Your Robertson Ryan Insurance agent can help you review coverage questions and identify potential gaps based on how your business operates.

This article provides general information and does not replace advice from your IT provider, legal counsel, or licensed insurance agent. Insurance coverage depends on the applicable policy’s terms, conditions, exclusions, and limits.