The Complete Guide to Cyber Insurance Limits in Louisiana

How Cyber Limits Are Structured

Aggregate Limit

The aggregate limit is the most the policy will pay for all covered claims during the policy period, usually one year. If you carry a $1 million aggregate and have a $600,000 claim in March, you have $400,000 left for the rest of the year.

Per-Claim Limit

Some policies also cap what they'll pay for any single claim. Often it matches the aggregate, but not always.

Sublimits

This is where policies with the same headline number start to look different. A $1 million policy might cap certain coverages much lower, such as:

• Social engineering or funds transfer fraud
• Cyber extortion and ransomware
• Business interruption from a vendor's outage
• Regulatory fines and penalties
• Payment card assessments

Sublimits usually sit inside the aggregate, so they reduce the total available rather than adding to it. Always ask for a list.

Defense Costs Inside or Outside the Limit

Many cyber policies pay legal defense costs from within the limit. Every dollar spent on attorneys means less available for a settlement. Some policies pay defense in addition to the limit. It's worth knowing which one you have.

Retentions and Waiting Periods

Retention (Deductible)

The retention is what you pay before coverage kicks in. Higher retentions lower your premium but raise your out-of-pocket cost when something happens. Some policies use different retentions for different coverages, such as a higher one for ransomware.

Waiting Period

Business interruption coverage usually requires your systems to be down for a set number of hours before lost income is covered. A shorter waiting period matters a lot for a restaurant on a Friday night or a medical office with a full schedule.

Coinsurance

Some policies require you to share a percentage of certain losses, most often ransomware. Read carefully, since it can meaningfully change what you'd collect.

Common Limit Levels for Small Businesses

Small businesses often look at limits in these ranges:

• $250,000 to $500,000: Very small operations with limited sensitive data and no contract requirements.
• $1 million: A common starting point for many small and midsize businesses, and a frequent contract minimum.
• $2 million to $5 million or more: Businesses holding large volumes of sensitive records, healthcare and professional firms, or companies with larger contract requirements.

These are starting points for a conversation, not recommendations. Your right number depends on your own exposure.

How to Size Your Limit

Work through these five questions:

1. How many records do you hold? Count current and past customers, patients, and employees whose personal information sits in your systems. Old records count too. Notification and monitoring costs scale with the number of people affected.
2. How long could you run without your systems? Estimate lost revenue per day if email, scheduling, billing, or point of sale went down for a week.
3. How much money moves by wire or ACH? If a fake invoice or spoofed email could redirect a large payment, your social engineering sublimit should reflect that.
4. What do your contracts require? Master service agreements with energy companies, hospital vendor contracts, government work, and commercial leases may require specific minimums and additional insured wording.
5. How much could you absorb yourself? This helps set your retention.

Louisiana Factors That Push Limits Higher

• Healthcare data. Practices across Acadiana and the Baton Rouge medical corridor hold records that carry federal HIPAA obligations on top of Louisiana notification requirements.
• Energy and industrial contracts. Service companies in Broussard, Houma, and along the river corridor often face vendor cyber requirements from larger operators.
• Storm disruption. A hurricane can knock your systems offline at the same time phishing attacks spike. Think about how long a recovery could really take.
• Notification requirements. Louisiana's breach notification law (La. R.S. 51:3071 et seq.) sets timelines that make response costs hard to avoid.

Claims-Made Policies and Retroactive Dates

Most cyber policies are claims-made, meaning the claim has to be reported during the policy period. A retroactive date may limit coverage for incidents that started before a certain date. Breaches often go unnoticed for months, so keeping continuous coverage and understanding your retro date matters.

When One Policy Isn't Enough

Larger exposures can be handled with excess cyber coverage that sits above your primary policy. This can be a practical way to meet higher contract requirements.

Review Your Limits Every Year

Your exposure changes when you add employees, adopt new software, open a new location, or sign a bigger contract. Revisit your limits at every renewal.

Let's Size It Together

Kastner Insurance Group can help you think through your exposure and compare limit options across carriers. Coverage, limits, and terms vary by carrier and policy. Call 337-291-0018 or contact us.

Next in the series: Key Questions About Cyber Insurance for Louisiana SMBs