Cyber policy wording review checklist

The schedule tells you the limit. The wording tells you whether you will get it. Many claim problems trace back to a condition nobody read: a missed deadline, a cost spent without consent, or a supplier report nobody asked for.

Read the wording with your broker before you sign, and again when you update your incident plan. This checklist shows where to look. For the common traps, see the exclusions that catch businesses out.

How the cover is triggered

• Find out whether cover is claims-made or discovery-based.Many policies use both: discovery for your own losses and claims-made for claims against you. This decides which policy year responds.
• Note the retroactive date.Many policies exclude liability claims for acts before this date. Ask for the earliest date you can get, and keep details of your past insurance.
• Check whose knowledge starts the notice clock.Many wordings start it when a named group, such as the CEO or the head of IT, learns of an incident. Put those names in your plan.
• Read the known circumstances exclusion.Many policies exclude anything a senior person knew about before the policy started. Disclose it in the application.

What you must do in an incident

• Write down the exact notification channel.It may be a 24/7 phone line, an app or an email address. Some wordings say that telling your broker is not notice.
• Note every deadline in the wording.Look for notice windows, emergency cost windows such as 48 or 72 hours, and reporting periods after expiry. Copy them into your incident plan.
• Check which costs need consent first.Many policies pay early response costs without consent only for a short window, and only with their own panel firms. After that, you need written approval.
• Read the ransom wording carefully.Many policies pay nothing toward a ransom paid or promised without the insurer's prior written agreement. Your plan should send that decision to the insurer.
• Check the rules on admitting fault and notifying customers.Many wordings need consent before you admit liability, settle a claim or send breach notices.
• Look for a duty to report to the police.Many policies require a law enforcement report for ransomware, extortion and cyber crime.

How much it pays

• List every sublimit next to the main limit.Look for ransomware, social engineering, supplier outages and unpatched software. When several apply, some wordings use the lowest.
• Find any coinsurance.Coinsurance means you pay a share of the loss. It often sits beside the ransomware or widespread event limits.
• Check the waiting period for income loss.Some policies leave the loss inside the waiting period unpaid. Others pay from the first hour once the outage outlasts it.
• Read how income loss is worked out.Many policies ask for accounts, invoices, payroll and forecasts. Make sure your finance team can produce them quickly.
• Check the supplier outage conditions.Some policies need a written root cause report from the provider before they pay.

What it leaves out

• Read the infrastructure and widespread event wording.Many policies exclude regional outages of the internet, power or telecoms. Some apply lower limits when one attack hits many firms.
• Check the war and state attack exclusion.Wordings differ a lot here. Ask your broker how yours treats an attack linked to a state.
• Look for contract, card and insider exclusions.Contract penalties, card chargebacks and theft by your own staff are often excluded or need separate cover.

Broker's tip

Turn the wording into a one-page card for your incident plan: who to call, how fast, what needs consent first, and which records to keep. Ask your broker to check the card against the wording, because rules vary from policy to policy. On the worst day, nobody has time to read a long policy, but everyone can follow a single page.