[ben509]

Sometimes it can be covered by business owner's policy[1], but there are specifc policies covering cyber extortion, e.g. [2] [3]. As you suggested, they are generally paired with risk management.

[1]: https://www.investopedia.com/terms/business-owners-policy.as...

[2]: https://www.thebalancesmb.com/insuring-against-ransomware-an...

[3]: https://www.robertsonryan.com/2021/05/18/ransomware-insuranc...