Cyber insurance pays for the parts of an incident nobody budgets for: forensics, notification, business interruption, and legal defense. It also produces the most avoidable disputes in the whole insurance market, and almost all of them trace back to documentation rather than to the attack itself. Here is what insurers ask before they bind a policy, what they ask after a claim, and how to build the file that answers both.
This article is general information, not insurance or legal advice. Read your policy with your broker and counsel.
What Cyber Policies Cover
Coverage varies by carrier and form, but most policies group into a few categories:
- Forensics and incident response, often through a panel of approved firms.
- Notification and credit monitoring after a data breach.
- Business interruption, including extra expense to keep operating.
- Ransom and extortion, with conditions attached.
- Liability and defense for claims by clients, patients, or others.
Limits, sublimits, retentions, and exclusions do the real work. The two clauses worth reading before you sign are the notice requirement (how fast you must report an incident) and the panel clause (whether you must use the insurer’s forensics firm).
What Insurers Ask Before You Bind
Underwriters are asking one question: if this organization is attacked, will it be able to contain the damage and prove what it did? In practice, that becomes a checklist:
- MFA on email, remote access, and administrator accounts. This is the single most common condition.
- Backups: frequency, encryption, offline or immutable copies, and whether a restore has been tested.
- Endpoint protection or EDR on every device, with centralized visibility.
- Patch management, with a stated window for critical vulnerabilities.
- A written incident response plan, and a named person who runs it.
- Security awareness training with completion records and phishing simulation results.
- Vendor management: which third parties hold data, and what agreements cover them.
- Privileged access: who has admin rights, and how that is reviewed.
Answer these honestly. An application that overstates your controls is a dispute waiting to happen, because the policy can be rescinded for a material misstatement.
What They Ask After a Claim
Once an incident is reported, the insurer’s adjuster and their forensics firm want a chronology and evidence:
- Timeline: when the incident began, when it was detected, and when it was reported to them.
- Systems and data affected, including what left the network and how you know.
- Logs and evidence covering the period, preserved rather than overwritten.
- Proof that backups existed and worked, with restore records.
- Containment evidence: what was shut off, isolated, and rotated, and when.
- Invoices and costs as they accumulate, in the format the policy requires.
- Communications: internal decisions, client notices, and regulator filings.
Requests arrive early and under time pressure. Organizations that keep an incident log and an evidence register during the response satisfy them in hours instead of weeks. The sequence we recommend is in the first 72 hours after a cyber incident.
Why Claims Get Disputed
- Late notice. The policy sets a window measured in hours or days; waiting until the scope is clear is the most common mistake.
- No MFA where the application said there was. A material misstatement on the application is the worst outcome available.
- Unapproved vendors. Using your own forensics firm when the policy names a panel can reduce or void the forensics sublimit.
- Backups that were never tested. If the restore fails, business interruption grows and the insurer asks why the control was claimed.
- Destroyed evidence. Rebuilt systems with no preserved logs make the loss unprovable.
- Missing documentation. Policies, training records, and access reviews that cannot be produced are treated as controls that did not exist.
How to Build a Claim-Ready File
Keep one folder, offline and access-controlled, containing:
- The incident response plan with current contacts and the policy number. Start from the free template.
- An asset list that names owners and data types.
- Backup restore records with dates and durations from the last twelve months.
- Training completion records and the last phishing simulation results.
- Access review records for administrator accounts.
- Vendor contracts and security terms for anyone holding your data.
- An incident log template ready to fill in, with a column for timestamps and decisions.
Review it twice a year, at the same time you test the contact tree. It takes an hour and it is the difference between a paid claim and a negotiation.
Where to Start
Run the self-assessment to see which of the underwriting conditions you currently meet. If the answer is “most of them, on paper”, an independent assessment is what turns paper into evidence. Compliance and gap analysis covers the documentation side, and incident response is who you call when it is real.
The wider control set, including the insurer questions above, is in the small business cybersecurity guide. For the prior-year context, see why cyber insurance is a must-have.
Schedule a readiness consultation or call 703-486-0200.