TL;DR
Successfully navigating a cyber insurance claim requires prompt action, thorough documentation, and understanding of policy requirements. This guide walks through the entire claims process from incident detection through resolution.
Immediate Post-Incident Actions
The First 24 Hours
When you discover a potential incident, your immediate actions significantly impact both incident response and insurance claim success.
Step 1: Contain and Document
- Don’t destroy evidence by wiping systems prematurely
- Document everything with timestamps
- Preserve logs from affected systems
- Take photos/screenshots of affected systems
Step 2: Activate Incident Response Team
- Incident commander takes charge
- Assign roles for documentation, technical response, communications
- Begin incident log with timeline
Step 3: Notify Insurance Carrier
- Most policies require notification within 24-72 hours
- Don’t wait until you know full scope
- Provide initial details; update as you learn more
- Ask about vendor pre-approval requirements
What to Tell Your Insurer
Initial Notification Information
- Date and time of discovery
- Type of incident (ransomware, breach, BEC, etc.)
- Systems currently known to be affected
- Whether threat is ongoing or contained
- Contact for your incident response team
What NOT to Do
- Don’t admit fault or speculate on cause
- Don’t discuss coverage concerns with adjuster
- Don’t agree to recorded statements without preparation
- Don’t delay notification to “get more information”
Understanding Your Policy Before You Need It
Key Policy Terms to Know
Claims-Made vs. Occurrence
- Claims-made: Must report during policy period
- Occurrence: Incident occurred during policy period
- Know which you have and implications
Retroactive Date
- Incidents before this date not covered
- Critical when switching carriers
Waiting Period
- Business interruption coverage typically has 8-24 hour waiting period
- Coverage begins after waiting period expires
Deductible/Retention
- Amount you pay before insurance kicks in
- May differ by coverage type
Pre-Approved Vendors
Many policies require or prefer:
- Specific forensic investigation firms
- Approved law firms
- Pre-authorized breach response vendors
Using non-approved vendors may:
- Result in lower reimbursement
- Require additional justification
- Delay claim processing
The Claims Process Timeline
Days 1-3: Initial Response
Insurance Carrier Actions
- Assign claims adjuster
- Acknowledge claim receipt
- Provide claim number
- Explain process and next steps
Your Actions
- Continue incident response
- Document all activities and costs
- Preserve all evidence
- Communicate with adjuster regularly
Days 4-14: Investigation
Carrier Investigation
- Review policy coverage
- Request additional documentation
- Assess potential exposure
- May assign forensic firm if not already engaged
Your Documentation Tasks
- Complete incident timeline
- Document all affected systems and data
- Track all costs by category
- Begin regulatory notification assessment
Weeks 2-8: Resolution
For Breach Claims
- Complete forensic investigation
- Determine notification requirements
- Execute notification plan
- Manage affected individuals
For Ransomware Claims
- Negotiation (if applicable)
- Payment (if approved)
- System restoration
- Business interruption calculation
Months 2-12: Claim Settlement
Final Documentation
- Final cost summary
- Proof of all expenses
- Legal documentation
- Regulatory filings
Settlement
- Claim resolution
- Payment processing
- Deductible application
- Reserve resolution
Documentation Requirements
Essential Documents to Maintain
Incident Documentation
- Initial discovery report
- Complete incident timeline
- Affected systems inventory
- Data impact assessment
- Root cause analysis
Financial Documentation
- All invoices related to incident
- Payment records
- Time records for internal staff
- Lost revenue documentation
- Extra expense records
Legal Documentation
- Regulatory notifications
- Customer communications
- Legal bills and descriptions
- Settlement documents
Technical Documentation
- Forensic report
- System logs
- Network diagrams
- Security configuration at time of incident
Documentation Best Practices
Real-Time Logging
- Keep incident log updated in real-time
- Include date, time, who, what, why
- Don’t rely on memory later
Cost Tracking
- Create incident cost code in accounting
- Tag all related expenses
- Track both external costs and internal time
Communications Log
- Log all carrier communications
- Save all emails
- Note phone conversations with date/time
Common Reasons for Claim Denial
Policy Coverage Issues
Exclusions Applied
- War/nation-state exclusion
- Unpatched vulnerability exclusion
- Failure to maintain required security
- Prior acts not covered
How to Avoid
- Understand exclusions before incident
- Document security practices
- Maintain patch management records
- Keep evidence of security controls
Procedural Issues
Late Notification
- Most policies have strict notification requirements
- Delay can void coverage entirely
Using Non-Approved Vendors
- Some policies require pre-approved vendors
- Using others may result in partial or no coverage
Misrepresentation in Application
- Inaccurate security posture claims
- Undisclosed prior incidents
- Misleading information about systems
Coverage Limit Issues
Sub-Limits Exceeded
- Ransomware sub-limit lower than ransom demand
- Social engineering cap insufficient
- Business interruption calculation disputes
Aggregate Limit Exhausted
- Multiple incidents consume total limit
- Later incidents not fully covered
Maximizing Your Claim
Working with the Adjuster
Be Responsive
- Provide requested information promptly
- Keep adjuster informed of developments
- Don’t let requests languish
Be Organized
- Provide documentation in requested format
- Create summary documents
- Make it easy to understand your claim
Be Professional
- Don’t be adversarial
- Ask questions about process
- Keep communications documented
Handling Disputes
If Claim is Denied or Reduced
- Request written explanation with policy citation
- Review denial with broker and counsel
- Gather supporting documentation
- Consider appeal process
- Document all communications
Common Dispute Points
- Business interruption calculation
- Whether incident meets coverage trigger
- Application of exclusions
- Valuation of costs
After the Claim
Lessons Learned
Post-Claim Review
- What went well in claims process?
- What could be improved?
- Policy coverage gaps identified?
- Documentation improvements needed?
Policy Renewal Considerations
Impact on Premium
- Claims typically increase premium
- Consider premium increase vs. not claiming smaller losses
Coverage Adjustments
- Address gaps discovered during claim
- Consider limit increases
- Review deductible adequacy
Preparing for Future Claims
Pre-Incident Preparation
Maintain Current Documentation
- Security policies and procedures
- Incident response plan
- Vendor contact list
- System inventory
Regular Reviews
- Annual policy review with broker
- Security documentation updates
- Incident response plan testing
Vendor Relationships
- Pre-approve forensic firms
- Establish legal relationships
- Know your notification obligations
Next Steps
Use our cyber insurance calculator to ensure you have adequate coverage limits. Review your current policy’s claims process and pre-approved vendor requirements before you need them.
FAQ
How quickly must I notify my insurer after an incident?
Most policies require notification within 24-72 hours of discovery. Don’t wait until you know the full scope—notify immediately with initial details and update as you learn more.
Can I use my own forensic investigator?
Check your policy first. Many carriers require or prefer pre-approved vendors. Using non-approved vendors may result in lower reimbursement or delayed claim processing.
What if my claim is denied?
Request a written explanation with policy citation, review with your broker and counsel, gather supporting documentation, and consider the formal appeal process. Document all communications.
How long does a typical cyber claim take?
Simple claims: 2-3 months. Complex ransomware or breach claims: 6-12 months. Business interruption calculations often extend timelines significantly.