Notifying your insurer after an incident checklist

Late notice is one of the most avoidable reasons a cyber claim runs into trouble. Policies ask you to notify the insurer as soon as practicable, and some make written notice a condition of cover. Delay can reduce what the insurer pays, especially when the delay made the loss bigger.

The rules differ by policy. Who counts as knowing, which channel counts as notice and what you must include all vary. Use this checklist to set up your process before an incident, and to follow it during one.

Before an incident: set up the route

• Find the notification clause in your policyIt says when to notify, how and what to include. Look for the words "condition precedent", which mean you must meet that rule for the insurer to pay.
• Name the people whose awareness starts the clockMany policies define a control group or senior officers, such as the CEO, CFO, in-house lawyer, risk manager, CIO or data protection officer. Keep the list current.
• Save the response line, notice address and policy numberStore them where the control group can reach them offline. Install the insurer's response app too, if one is offered.
• Confirm which channels count as noticeSome policies accept a call to the response line or a notice through the app. A message to your broker alone may fall short, so check your wording.
• Write notification into your incident planSay who calls, within what time and with what information. Rehearse it in a tabletop exercise once a year.

When something happens: notify promptly

• Notify on a suspected incidentMany policies start the clock when an incident is reasonably suspected, before you have proof. Waiting for certainty can make your notice late.
• Use the channel your policy namesCall the response line or send written notice to the address in your schedule. Then tell your broker as well.
• Follow a phone call with written noticeSome wordings require notice in writing. An email after the call also gives you a record.
• Record the date, time and reference numberNote who you spoke to and what they asked you to do. This record proves when you gave notice.
• Report a circumstance before any claim existsMany policies let you notify a circumstance that might lead to a claim. A later claim can then attach to the current policy period.

What to put in the notice

• Describe the time, place and nature of the incidentSay what happened, which systems it touched and what you know so far. Mark the unknowns clearly.
• Explain how you first became awareName who found it and when. This sets the start of the policy clocks.
• Name any affected or claiming partiesInclude customers, partners or regulators involved, with their contact details.
• Give an early view of the size of the lossA rough range helps the insurer plan the response. Update it as the facts change.
• Attach every letter, demand or regulator noticeForward each new document as soon as it arrives. Many policies require this for every claim.

After notice: protect the claim

• Follow the insurer's directions and answer on timeMany policies require you to co-operate and give information promptly. Keep a log of every request and your answer.
• Get written consent before costs or settlementsMost policies forbid admitting liability, settling or spending without consent. Put each request in writing.
• Watch the reporting deadlines around expiry and renewalSome policies require notice within a set number of days after the policy ends, such as 30 or 60. Check your extended reporting period as well.
• Declare the incident on your next applicationUnderwriters ask about past incidents. A notified incident belongs on the renewal form.

Broker's tip

When in doubt, notify. An early call about something that turns out to be minor usually costs little, and a late call about something serious is much harder to put right. Notifying is a separate step from making a claim, and on many policies the first call also brings expert advice. Ask your broker to walk your control group through the notification clause once a year, so everyone knows the route before they need it.