Cyber insurance coverage and limitations: a practical reading guide

Understand the document set

Ask for the complete proposed policy, including declarations and endorsements. A brochure can help you find a product, but the issued contract establishes the protections purchased. Create an index so a colleague can locate the wording during a stressful event.

For each concern, record the relevant insuring agreement and the questions you want answered. Avoid writing “covered” beside a scenario until your broker has explained the applicable language and assumptions. An understandable explanation should identify both the possible protection and the conditions that could limit it.

Separate your costs from someone else’s claim

First-party concerns involve your organization’s own expenses or financial losses. Third-party concerns involve demands made against the organization. A single incident can raise both. Our suggested worksheet gives incident investigation, data restoration, interrupted operations, customer demands, and regulatory response their own rows.

This separation helps prevent a mistaken comparison between two policies that display the same overall limit. Ask which row each coverage section addresses and whether the section was actually purchased. Leave a visible space for unanswered questions rather than treating missing information as protection.

An illustrative policy example

The Travelers US specimen CYB-16001 Rev. 06-20 contains distinct protections and definitions, including dependent business interruption and betterment. It also includes a war exclusion and limits and retention provisions. These examples demonstrate the need to trace the full wording; they do not establish what another policy offers.

In this specimen, betterment is tied to a security breach and defined conditions. It should not be read as a promise to finance routine modernization. Sample forms may differ by jurisdiction and edition, and an endorsement can materially change their operation.

Map the amount you would still retain

Ask your broker to walk through a hypothetical loss using the actual proposed numbers. Label the example as illustrative and avoid presenting it as a claims decision. The aim is to understand how different contract features interact.

• Which retention or deductible applies to each cost category?
• Does a waiting period apply before interruption losses count?
• Are defense expenses within the limit, and are some limits shared?
• Do sublimits, restoration periods, or other provisions cap a specific exposure?
• What documentation would the insurer need to assess the loss?

Read provider and exclusion language carefully

List the outside systems that keep revenue flowing. Then ask how the policy defines an eligible provider and the event required for a provider-related loss. A business may be unable to operate for reasons that do not meet that wording.

NYDFS’s 2021 framework discusses systemic loss and the need to make cyber coverage clear in policies that might otherwise be silent. Our practical recommendation is to ask explicitly about widespread service failures, infrastructure, war, and other exclusions relevant to your operations. Their application requires the actual wording and facts.

Use the same method for quantum scenarios

A potential future decryption event adds technical and timing questions, but it does not replace this reading process. Ask what evidence would establish unauthorized access, when the relevant trigger would occur, and how reporting conditions interact with delayed discovery.

Have the broker document unresolved points and explain whether proposed amendments are available. Coverage questions involving interpretation or applicable law may require qualified counsel. This US-oriented guide supplies a review method, not an opinion on a particular claim. Keep the current contract and response contacts where authorized colleagues can reach them if normal systems fail.