Does a restaurant need cyber insurance?
If the point-of-sale system is how the restaurant takes payment, usually yes. A standard property policy and a general liability policy generally do not respond to a breach of the POS system, so the cost of one sits outside both. Attackers now go after the POS vendor rather than the restaurant, so one breach at the vendor can reach every restaurant on that system. A standalone cyber policy for a single location ran about $1,200 to $2,800 a year in mid-2026.
Why the point-of-sale system is the target
Attackers go after the POS vendor rather than the restaurant, because one breach at the vendor reaches every restaurant on that system. That is why a cyber application now asks three things: which POS vendor the business uses, whether the POS network is separated from the guest wifi and the office computers, and whether the business meets the card industry's security standard. An underwriter reads those three before the premium is set.
What the other policies do
A standard property policy is written for physical damage to physical things: fire, wind, water, a break-in. A general liability policy is written for injury or damage to people outside the business. A breach of card data is neither, and both policies generally do not respond to it. A cyber policy is written for that event: finding out what happened, notifying the people whose card data was taken, the costs the card networks pass back, and, on many policies, the sales lost while the system is down.
Like equipment breakdown and spoilage, cyber is a coverage that is on the declarations by name or is not there at all: Does insurance cover a walk-in cooler failure? The rest of that list is in The coverages restaurants forget.
What it costs
A standalone cyber policy for a single location ran about $1,200 to $2,800 a year in mid-2026, and cyber was one of the lines that came down in price this year, by about 3 percent across the market. On a group, one policy is written for every company at once, and the three questions above are what the underwriter prices from. Next to the rest of a restaurant program, it is one of the smaller lines.
What to ask
The first question is whether cyber has ever come up at a renewal. After that: does anyone on the insurance side know which POS vendor the group uses? Is there a cyber policy, and does it name every company? What does it pay if the system is down for a weekend? If the breach starts at the vendor rather than in the restaurant, is the restaurant still the one paying for the notices?
A group that has had the conversation and decided against the policy is in a different place from one that was never asked. The employment practices line has the same first question: When does a restaurant need EPLI?