If your credit union doesn't havecyber insurance, you're setting yourself up for a costly mistake.More than 75% of credit unions go without an essential piece ofprotection regarding their security, according to CUNA MutualGroup.

No matter how big or small your organization is, it is a targetfor cybercrimes. Nearly one-third of all cyberattacks in 2013targeted companies with fewer than 250 employees, according to the2014 Internet Security Report from Symantec.

The average cost to U.S. financial organizations for each lostor stolen record containing sensitive and confidential informationwas $236, according to Ponemon's “2014 Cost of a DataBreach” study.

Whether due to a vulnerability or to an employee losing a laptopor inadvertently clicking on a malicious link or attachment, atsome point, no matter how many layers of protection you have aroundyour network, your credit union is almost certain to bebreached.

Cyber insurance can reimburse you for much of the costs,including business interruption protection, hiring staff or avendor to clean up the breach, legal fees, public relations fees toprotect your credit union's reputation and notifying members thattheir private information may have been stolen.

If an attacker shuts down your network, your business could bedown for a while. Not only must you think about how that wouldaffect your members but also how it would affect your billing andpayments regarding other organizations you do business with.

There are about five or six dozen cyber insurance carriers butonly a few main players, says Bob Parisi, managing director atMARSH, one of the world's largest commercial insurance brokers.

Policies offer different benefits to suit your needs and budget,so speak with a couple of brokers to guide you and see which onecan offer the best plan for your credit union. Some carriersspecialize in serving specific industries while others serveorganizations based on size.

Parisi said underwriters take compliance and security policiesand practices into consideration before insuring any organization.He added that underwriters typically want to talk with anorganization to understand their security practices, but smallercompanies may only need to complete a short-form application toapply. An underwriter will likely ask about previous audits andsecurity events, and organizations should be able to share whatthey are doing about the vulnerabilities that have been discoveredin their networks.

Jay Isaacson, vice president of commercial products at CUNAMutual, said that having a Computer Security Incident ResponsePlan, table top plans, pen tests and other controls, such as beingcompliant with industry regulations, are all considered in theunderwriting process and can help a credit union obtain coverage atthe best possible rates.

Although cyber insurance has been around for more than a decade,Parisi said MARSH has seen aggressive growth in the past six monthssince the network breaches of major retail stores.

Last year, a series of cyberattacks repeatedly knocked majorU.S. banking websites offline. The Izz ad-din Al Qassam CyberFighters claimed credit for the distributed denial-of-serviceattacks that took down websites of more than a dozen U.S. banks andcredit unions for hours or days.

Although not highly publicized, smaller banks and credit unionsare just as susceptible to attacks as larger ones. Attackers targetsmaller and mid-tier banking institutions before trying them onlarger ones because the smaller ones are known for not having astight security and because the smaller ones are a good testingground before moving on to a larger one.

Jeff Multz isdirector of North America Midmarket Sales at Dell SecureWorks inAtlanta.