What should I check before buying cyber insurance?

Check cyber insurance by matching the actual policy to your data, systems, vendors and likely response needs. Review first-party losses and third-party claims separately. Then examine exclusions, retentions, sublimits, reporting conditions and who may authorize response work. Finally, test how you would fund the incident before any accepted claim is paid.

A large limit on a schedule can be reassuring while leaving the expense you are worried about subject to a much smaller limit—or outside the policy altogether. Start with what could happen to your operation, then find the wording that answers it.

Map the operation before shopping the limit

Identify the information you hold, systems you depend on and service providers that keep the work moving. Include relevant customer and employee data, outsourced systems and payment processes. Describe what would become difficult if each were unavailable or compromised.

The FTC's cyber-insurance guidance recommends discussing first-party and third-party needs with an insurance professional. It highlights data held by vendors as well as the business's own network. An insurance conversation should describe the actual arrangement, not only the number of laptops.

The NAIC's cybersecurity overview cautions that ordinary commercial property and general liability coverage often does not cover cyber risks and that cyber policies are customized. Examine existing coverage rather than assuming a familiar policy name settles the issue.

Keep the description current. A new customer portal, acquisition or outsourced provider can change the dependencies being insured. Record who tells the broker or insurer about a material change and which actual requirements apply.

Separate your losses from claims against you

First-party coverage concerns the business's own specified losses and response costs. Third-party coverage concerns specified claims brought against it. The FTC discusses examples such as data recovery and notification on one side, and claims or litigation costs on the other.

Ask what each relevant section actually provides. Does it pay for investigation, restoration, required communications or an interrupted operation? Does another section address a customer claim? Identify the trigger, definition and conditions for each rather than assuming one accepted incident makes every consequence payable.

Check an outage at a vendor separately from an intrusion into your own systems. Ask about the vendor and service that actually matter to your work, including any dependencies the coverage definition excludes. A cloud-provider name on an application is not a completed interpretation of the policy.

Also distinguish a transfer made after a deceptive instruction from damage to information or systems. If that scenario matters, ask for the specific coverage, conditions and limit. Do not assume either universal inclusion or universal exclusion from the word cyber.

Ask how defense costs use a third-party limit

For a third-party claim, ask who arranges the defense, how counsel is selected and which decisions require consent. Establish whether defense expenses reduce the same limit available for a settlement. The wording can change what an apparently large limit leaves for the remaining claim.

Use a separate fictional illustration, not an addition to the incident below. Assume an accepted third-party matter has $6,000 of defense costs and an $18,000 settlement. The supplied section has a $20,000 combined payment limit, includes defense inside it and has no retention or other reduction.

The total accepted need is $24,000. The insurer's payment is capped at $20,000, leaving $4,000 for the business. Under a different supplied arrangement that pays the same defense outside a $20,000 settlement limit, both $6,000 defense and $18,000 settlement fit, totaling $24,000 paid.

That comparison changes a specific coverage term; it does not say the more generous alternative is available or equally priced. It tells you what to ask. Keep the actual defense, settlement and payment-control provisions together rather than assuming the limit alone describes them.

Read the response arrangement as an operating plan

Find the actual reporting contact, required notice process and people authorized to act for the insured. Keep that information accessible if the ordinary network is unavailable. A hotline saved only inside the affected account may not be useful when needed.

Ask whether the insurer requires approval before specified spending and whether particular providers or panels must be used. Identify an appropriate route for urgent decisions. The company's authority to hire help and the insurer's agreement to fund that help are different matters.

The incident-cost guide helps track paid, committed and proposed work. The insurance record adds another status: which of those amounts has actually been accepted for payment under a relevant policy section.

Coordinate this with the business's incident-response plan and qualified advisers. A coverage question should not become an excuse to ignore a time-sensitive duty or improvise destructive technical work. This guide evaluates the insurance arrangement; it does not supply a breach-response procedure or decide notification duties.

Work through a specific original coverage case

Consider an entirely fictional business with a cyber policy. Its headline aggregate limit is $1 million, but the applicable incident-response section has a $10,000 insurer-payment sublimit. For one accepted incident, the supplied terms apply a $2,500 retention to eligible response expenses, then cap the insurer payment at $10,000.

The accepted response scope costs $16,000: forty forensic-provider hours at $200 cost $8,000; fifty restoration-provider hours at $100 cost $5,000; and the notification-related scope costs $3,000.

That last $3,000 includes four appropriate legal-review hours at $250, twenty paid coordination hours at $50 and $1,000 of complete service charges. All rates include the relevant employer or provider charges in this limited scope. The required people and hours are available; no unpaid work makes the case fit.

All relevant policy conditions and required approvals for these specified expenses are assumed satisfied, and the insurer accepts them. That is a supplied fictional result, not a report of an actual incident, advice received or claim determination.

Apply the retention and sublimit in order

Subtract the $2,500 retention from the accepted $16,000 expenses, leaving $13,500. The $10,000 payment sublimit then reduces the insurer's payment to $10,000.

The business bears $6,000 of those eligible expenses: $2,500 retention plus $3,500 above the response sublimit. Looking only at the retention would understate what it must retain in this case.

Scroll horizontally if needed. This is an original hypothetical contract with its calculation order stated explicitly.

The $1 million headline does not override the supplied $10,000 section limit. An actual policy might apply its limits or retention differently. Recover the actual order and shared limits instead of borrowing this example's formula.

Keep excluded and unresolved items separate

The same fictional incident includes a $10,000 fraudulent transfer. The supplied policy expressly excludes that transfer loss. It is not part of the $16,000 accepted response expense and receives no insurance payment in this case.

The business also estimates $5,000 of interrupted income, but the relevant coverage, calculation and acceptance remain unresolved. That estimate is not added to the accepted award or treated as a bill already paid. It needs its own evidence and review.

The known incident cash outflows are therefore $26,000: $16,000 response payments plus the $10,000 transfer. Subtracting the accepted $10,000 claim leaves $16,000 of net cash outflow for those items.

The pending income question remains separate. Adding it as another $5,000 cash payment would confuse missing receipts with spending. Declaring it reimbursed would invent an acceptance that has not occurred.

The revenue, profit and cash-flow guide helps keep those categories distinct. For insurance, each category also needs its actual coverage basis and status.

Fund the period before reimbursement

The fictional business has $30,000 assigned to this bounded incident, separately from ordinary operating commitments. Its annual premium has already been paid from a separate insurance budget; it is not included in these incident payments.

The $10,000 transfer leaves $20,000. Paying all $16,000 response invoices before reimbursement leaves $4,000. The accepted $10,000 claim later clears, bringing the assigned fund to $14,000.

That sequence is funded on the supplied facts. The final $16,000 reduction from the original $30,000 matches the retained incident cash outflow. It does not establish that the business has recovered all income or that later claims will not arise.

With only $20,000 assigned instead, the transfer would leave $10,000 for $16,000 of response work: a $6,000 pre-reimbursement gap. The later award would not pay the earlier invoices on time. Investigate an actual approved payment or funding arrangement rather than assuming insurance money arrives whenever the spreadsheet needs it.

Review the application and continuing conditions

Give accurate answers about the business, security arrangements, providers and prior events. Identify who verifies technical statements before someone signs an application. Do not describe a control as operating merely because a vendor offers it or a project plans to implement it.

Ask the insurance professional to explain the consequences of the representations and conditions in the actual documents. If a statement is unclear, obtain the relevant technical facts and qualified explanation before relying on it. This guide does not determine the legal effect of an application error.

Keep renewal and change requirements with the responsible people. The person buying the insurance may not be the person who changes access controls or selects a new data provider. The process needs a way to connect those decisions.

Make the policy review produce a usable record

1. Describe the data, systems and vendor dependencies actually used.
2. Map important events to the relevant first-party or third-party sections.
3. Identify exclusions, retentions, sublimits and shared limits.
4. Confirm notice, approval and response-provider arrangements.
5. Test a specific incident without treating every loss as covered.
6. Fund the period before any accepted reimbursement arrives.
7. Verify application statements and ongoing conditions.
8. Give the response team the current contacts and policy record.

Finish with precise open questions. “Does our named provider's outage fit this section?” gives someone work to complete. “We have cyber cover” leaves the answer hidden until a difficult day.