⚡ Quick Answer

Successfully navigating a cyber insurance claim requires prompt action (notify within 24-72 hours), thorough documentation (incident logs, financial records, technical evidence), and understanding of policy requirements (pre-approved vendors, waiting periods, sub-limits). Claims typically take 2-3 months for simple incidents and 6-12 months for complex ransomware or breach claims. Common denial reasons include late notification, using non-approved vendors, and misrepresentation on applications.

📌 Key Takeaways

Notify your insurer within 24-72 hours: Most policies have strict notification requirements; delay can void coverage entirely
Document everything in real-time: Maintain incident logs with timestamps, preserve all evidence, and track costs by category
Use pre-approved vendors: Many policies require or prefer specific forensic, legal, and breach response vendors
Understand your policy before you need it: Know your deductible, waiting period, sub-limits, and exclusions before an incident occurs
Don't admit fault or speculate: Provide factual information to adjusters and avoid recorded statements without preparation

Immediate Post-Incident Actions

The First 24 Hours

When you discover a potential incident, your immediate actions significantly impact both incident response and insurance claim success.

Step 1: Contain and Document

Don’t destroy evidence by wiping systems prematurely
Document everything with timestamps
Preserve logs from affected systems
Take photos/screenshots of affected systems

Step 2: Activate Incident Response Team

Incident commander takes charge
Assign roles for documentation, technical response, communications
Begin incident log with timeline

Step 3: Notify Insurance Carrier

Most policies require notification within 24-72 hours
Don’t wait until you know full scope
Provide initial details; update as you learn more
Ask about vendor pre-approval requirements

What to Tell Your Insurer

Initial Notification Information

Date and time of discovery
Type of incident (ransomware, breach, BEC, etc.)
Systems currently known to be affected
Whether threat is ongoing or contained
Contact for your incident response team

What NOT to Do

Don’t admit fault or speculate on cause
Don’t discuss coverage concerns with adjuster
Don’t agree to recorded statements without preparation
Don’t delay notification to “get more information”

Understanding Your Policy Before You Need It

Key Policy Terms to Know

Claims-Made vs. Occurrence

Claims-made: Must report during policy period
Occurrence: Incident occurred during policy period
Know which you have and implications

Retroactive Date

Incidents before this date not covered
Critical when switching carriers

Waiting Period

Business interruption coverage typically has 8-24 hour waiting period
Coverage begins after waiting period expires

Deductible/Retention

Amount you pay before insurance kicks in
May differ by coverage type

Pre-Approved Vendors

Many policies require or prefer:

Specific forensic investigation firms
Approved law firms
Pre-authorized breach response vendors

Using non-approved vendors may:

Result in lower reimbursement
Require additional justification
Delay claim processing

The Claims Process Timeline

Days 1-3: Initial Response

Insurance Carrier Actions

Assign claims adjuster
Acknowledge claim receipt
Provide claim number
Explain process and next steps

Your Actions

Continue incident response
Document all activities and costs
Preserve all evidence
Communicate with adjuster regularly

Days 4-14: Investigation

Carrier Investigation

Review policy coverage
Request additional documentation
Assess potential exposure
May assign forensic firm if not already engaged

Your Documentation Tasks

Complete incident timeline
Document all affected systems and data
Track all costs by category
Begin regulatory notification assessment

Weeks 2-8: Resolution

For Breach Claims

Complete forensic investigation
Determine notification requirements
Execute notification plan
Manage affected individuals

For Ransomware Claims

Negotiation (if applicable)
Payment (if approved)
System restoration
Business interruption calculation

Months 2-12: Claim Settlement

Final Documentation

Final cost summary
Proof of all expenses
Legal documentation
Regulatory filings

Settlement

Claim resolution
Payment processing
Deductible application
Reserve resolution

Documentation Requirements

Essential Documents to Maintain

Incident Documentation

Initial discovery report
Complete incident timeline
Affected systems inventory
Data impact assessment
Root cause analysis

Financial Documentation

All invoices related to incident
Payment records
Time records for internal staff
Lost revenue documentation
Extra expense records

Legal Documentation

Regulatory notifications
Customer communications
Legal bills and descriptions
Settlement documents

Technical Documentation

Forensic report
System logs
Network diagrams
Security configuration at time of incident

Documentation Best Practices

Real-Time Logging

Keep incident log updated in real-time
Include date, time, who, what, why
Don’t rely on memory later

Cost Tracking

Create incident cost code in accounting
Tag all related expenses
Track both external costs and internal time

Communications Log

Log all carrier communications
Save all emails
Note phone conversations with date/time

Common Reasons for Claim Denial

Policy Coverage Issues

Exclusions Applied

War/nation-state exclusion
Unpatched vulnerability exclusion
Failure to maintain required security
Prior acts not covered

How to Avoid

Understand exclusions before incident
Document security practices
Maintain patch management records
Keep evidence of security controls

Procedural Issues

Late Notification

Most policies have strict notification requirements
Delay can void coverage entirely

Using Non-Approved Vendors

Some policies require pre-approved vendors
Using others may result in partial or no coverage

Misrepresentation in Application

Inaccurate security posture claims
Undisclosed prior incidents
Misleading information about systems

Coverage Limit Issues

Sub-Limits Exceeded

Ransomware sub-limit lower than ransom demand
Social engineering cap insufficient
Business interruption calculation disputes

Aggregate Limit Exhausted

Multiple incidents consume total limit
Later incidents not fully covered

Maximizing Your Claim

Working with the Adjuster

Be Responsive

Provide requested information promptly
Keep adjuster informed of developments
Don’t let requests languish

Be Organized

Provide documentation in requested format
Create summary documents
Make it easy to understand your claim

Be Professional

Don’t be adversarial
Ask questions about process
Keep communications documented

Handling Disputes

If Claim is Denied or Reduced

Request written explanation with policy citation
Review denial with broker and counsel
Gather supporting documentation
Consider appeal process
Document all communications

Common Dispute Points

Business interruption calculation
Whether incident meets coverage trigger
Application of exclusions
Valuation of costs

After the Claim

Lessons Learned

Post-Claim Review

What went well in claims process?
What could be improved?
Policy coverage gaps identified?
Documentation improvements needed?

Policy Renewal Considerations

Impact on Premium

Claims typically increase premium
Consider premium increase vs. not claiming smaller losses

Coverage Adjustments

Address gaps discovered during claim
Consider limit increases
Review deductible adequacy

Preparing for Future Claims

Pre-Incident Preparation

Maintain Current Documentation

Security policies and procedures
Incident response plan
Vendor contact list
System inventory

Regular Reviews

Annual policy review with broker
Security documentation updates
Incident response plan testing

Vendor Relationships

Pre-approve forensic firms
Establish legal relationships
Know your notification obligations

Next Steps

Use our cyber insurance calculator to ensure you have adequate coverage limits. Review your current policy’s claims process and pre-approved vendor requirements before you need them.

자주 묻는 질문 (FAQ)

How quickly must I notify my insurer after an incident?

Most policies require notification within 24-72 hours of discovery. Don’t wait until you know the full scope—notify immediately with initial details and update as you learn more.

Can I use my own forensic investigator?

Check your policy first. Many carriers require or prefer pre-approved vendors. Using non-approved vendors may result in lower reimbursement or delayed claim processing.

What if my claim is denied?

Request a written explanation with policy citation, review with your broker and counsel, gather supporting documentation, and consider the formal appeal process. Document all communications.

How long does a typical cyber claim take?

Simple claims: 2-3 months. Complex ransomware or breach claims: 6-12 months. Business interruption calculations often extend timelines significantly.

Can I negotiate the claim amount?

Yes. Initial offers are not final. Present additional documentation, expert opinions, and detailed cost breakdowns to support a higher valuation. Work with your broker and attorney to challenge undervalued claims.

What documentation do I need for a cyber insurance claim?

Essential documents include: initial discovery report, complete incident timeline, affected systems inventory, financial records (invoices, payment records, lost revenue documentation), forensic report, regulatory notifications, and all carrier communications.

What are the most common reasons for claim denial?

Top reasons include: (1) late notification beyond policy requirements, (2) using non-approved vendors, (3) misrepresentation on the application, (4) exclusions for war/nation-state attacks or unpatched vulnerabilities, and (5) sub-limits exceeded for ransomware or social engineering.

Does my cyber insurance cover incidents at cloud vendors?

Most policies cover your losses from vendor incidents, but review specifically for: contingent business interruption coverage, your notification obligations, and defense costs for downstream liability. See our Cloud Service Provider Risk Assessment for vendor risk management guidance.

What happens to my premium after filing a claim?

Expect a premium increase at renewal, typically 10-30% depending on claim size and frequency. For smaller claims, consider whether the premium increase over several years outweighs the claim benefit.