Corporations should also use this opportunity to review their insurance coverage of losses due to cyber incidents, especially since the SEC has identified the extent and amount of insurance coverage as a risk factor to be considered in assessing whether to report.