--- title: "Cyber liability insurance | CARMA" description: "Cyber insurance can respond to certain data, ransomware, privacy, and network events, subject to the policy and the facts of the loss. A useful submission..." canonical: "https://www.carma365.com/cannabis-insurance/cyber-liability/" --- Insurance by coverage # Cyber liability insurance for cannabis businesses Cyber insurance can respond to certain data, ransomware, privacy, and network events, subject to the policy and the facts of the loss. A useful submission identifies the systems, information, vendors, and controls that a cannabis business relies on. Prepared by [CARMA Insurance](/about/) Reading time 1 min read Content updated August 12, 2026 Carma Insurance LLC [Business entity NPN 21134854](/licensing-disclosures/) Related CARMA expertise [Zimraan Shikari, Director, Underwriting](/experts/zimraan-shikari/) [How we publish guidance](/editorial-standards/) [Discuss a cyber account](https://broker-forms-sandbox.pages.dev/application)[Start QuickQuote](https://broker-forms-sandbox.pages.dev/quoter-v2/)[Speak with the CARMA team](/contact/) Coverage and availability depend on the account, state, insurer and underwriting review. General information and nonbinding indications do not bind insurance; the applicable binder, policy, endorsements and law govern coverage. Important insurance information This guide is general information and does not determine coverage or legal requirements for your business. Policy terms, exclusions, conditions and available options vary. Contact the appropriate licensed insurance representative about your account, request confirmation of any coverage placed, and review the applicable insurance documents. An application, inquiry or nonbinding indication does not by itself bind or change insurance. Account brief ## What to clarify before discussing this account **Clarify** Which systems would interrupt sales or operations if they became unavailable? **Confirm** What customer, employee, payment, or regulated information does the business retain? **Prepare** System and vendor list, including point-of-sale, inventory, payment, and payroll providers [Discuss a cyber account](https://broker-forms-sandbox.pages.dev/application) On this page 5 sections On this page [Identify the systems and data at risk](#identify-the-systems-and-data-at-risk)[Show how access and recovery are managed](#show-how-access-and-recovery-are-managed)[State questions](#state-questions)[Underwriting focus](#underwriting-focus)[What to send CARMA](#what-to-send) ## Identify the systems and data at risk List point-of-sale, inventory, payroll, payment, customer, employee, and operational systems. Explain what information the business stores, where it resides, and which outside vendors can access it. ## Show how access and recovery are managed Describe authentication, backups, software updates, employee access, payment controls, incident response, and any prior cyber or privacy event. Note which safeguards are operated by a vendor and which remain the insured's responsibility. ## Cyber questions to resolve before submission - Which systems would interrupt sales or operations if they became unavailable? - What customer, employee, payment, or regulated information does the business retain? - How are access, backups, vendor permissions, and incident response tested? ## What CARMA wants the submission to explain These details help the team understand the account and identify the next useful question. They do not establish eligibility or available terms. - Identify the point-of-sale, inventory, payment, payroll, customer, and operational systems the business relies on. - Describe the information retained, vendor access, authentication, backups, updates, and incident response. - Explain prior privacy, ransomware, funds-transfer, or system events and the corrective action taken. ## Records for a cyber review - System and vendor list, including point-of-sale, inventory, payment, and payroll providers - Summary of data handled, access controls, backups, and incident-response procedures - Prior cyber, privacy, funds-transfer, or ransomware events and current coverage details ## Can CARMA consider this account? CARMA confirms program fit, licensing, state availability, coverage options, and market interest for each account. This guide does not promise eligibility, terms, pricing, or placement. Important insurance and legal information CARMA's website provides general information only. It is not insurance, legal, tax, regulatory, underwriting, safety, risk-management, or claims advice. Nothing on this site is a quote, binder, policy, coverage determination, legal opinion, or promise of eligibility, availability, pricing, terms, limits, or placement. Only an issued policy and its endorsements can provide coverage, and their actual terms, conditions, limitations, and exclusions control. Sending information, following a link, or speaking with CARMA does not bind coverage, change a policy, or create authority to act for an insurer unless an authorized party confirms that authority in writing. Do not rely on this website to report a claim, request a policy change, satisfy a notice requirement, or meet a deadline. Use the instructions in the applicable policy or written communication. Laws, licensing, appetite, carrier participation, and external sources can change, so confirm time-sensitive matters with CARMA, the controlling source, and qualified advisers. [Read the complete website disclaimer](/legal-disclaimer/). [Back to top](#main-content) Continue researching ## Put this subject in the context of the full account. Account-specific review ## Bring CARMA the account. Retail agents, wholesale brokers, and business owners can start with the details they have. [Discuss a cyber account](https://broker-forms-sandbox.pages.dev/application)[Start a business insurance conversation](/contact/)