Coverage explained
What a cyber policy covers, in plain language.
A cyber policy pays for some of the cost of an attack or a data breach, and for some of the claims that follow. What it pays for, how much and on what conditions is set by the wording.
This page is a general guide. Your own policy wording decides what is covered.
What a cyber policy usually covers
Most wordings group their cover into four parts. Names and limits differ from one insurer to the next.
Responding to an incident
- A response line and a coordinator for the first hours.
- Forensic and IT security experts to find the cause and stop it.
- Lawyers to advise on notifying regulators and affected people.
- Crisis communications to protect your reputation.
- Notifying affected people and offering credit or identity monitoring.
Your own losses
- Lost income while your systems are down.
- Lost income when a supplier you depend on is down.
- Restoring or recreating data and software.
- Extra costs to keep trading during the outage.
Crime and extortion
- Responding to an extortion demand, including ransomware.
- Money lost to fraudulent payment instructions or theft of funds.
- Charges run up when someone misuses your telephone system or cloud account.
Claims against you
- Claims by people whose data was exposed.
- Claims that your systems passed an attack to someone else.
- Regulatory investigations and, where the law allows it, fines.
- Claims about content you publish, such as defamation or infringement.
Words that change what you get
The terms that decide how much a policy pays, and when.
- Limit and sublimit
- The most the policy pays. A sublimit is a lower amount for one kind of loss, such as ransomware, inside the overall limit.
- Deductible
- The part of each loss you pay yourself. Some response costs carry no deductible.
- Waiting period or time franchise
- How long an outage must last before lost income is paid.
- Claims made and discovered
- Most cyber policies respond to events first discovered, and claims first made, during the policy period.
- Retroactive date
- Events that began before this date may not be covered, even if you find them later.
- Panel providers
- The response firms the insurer has approved. Some wordings only pay early response costs when you use them.
- Control group
- The senior people whose awareness of an incident starts the notification duty.
The gaps idea
A gap is an exposure your business has that the wording limits, excludes or makes conditional. Most gaps can be closed with a control. Some limits apply to every business, and it is better to know them before a claim.
Operational technology
Some application forms treat machinery and control systems connected to the internet as a reason to refer.
Unpatched software
Losses from a known weakness left unpatched for too long can fall under a lower limit.
Supplier outages
Lost income from a supplier’s outage may need a written root cause report from that supplier.
US and Canada revenue
Claims brought in the US or Canada can be limited or excluded.
Paying a ransom
Policies usually need the insurer’s written consent before any payment is made.
Late notification
Telling the insurer late can reduce what the policy pays.
Coverage workspace
How the Coverage workspace shows this
In PrismX, Coverage reads the wording for your submission, explains each clause, marks what matters to your business and lists the gaps with the controls behind them. Selections record the limit and terms you would like. They are a preference, not a quote.
PrismX does not give insurance advice and does not quote, sell or place insurance. Insurers decide eligibility, pricing, coverage and claims.
Understand your cover before you need it.
PrismX explains the wording for your submission and shows the gaps that matter to your business.