What does cyber insurance cover? A plain-English guide

This guide is for finance directors, board members and security leaders who are deciding whether cyber insurance belongs in their risk plan, or who want to understand a policy they already hold. It explains, in general terms, the kinds of cover commonly found in cyber policies, the exclusions and conditions worth reading closely, and the questions to put to a broker or insurer.

One point runs through everything that follows. Cyber policies differ, and the policy wording decides what is covered. This guide describes categories of cover you will often see, not what any particular policy will pay. Only an authorised broker or insurer can explain how a specific policy applies to your organisation.

#What is cyber insurance?

Cyber insurance is a type of policy designed to help an organisation respond to and recover from cyber incidents such as ransomware, data breaches and system outages. It typically combines access to specialist response support with cover for certain financial losses and liabilities. What is included, and on what terms, depends entirely on the individual policy wording.

The National Cyber Security Centre (NCSC) is clear that insurance is not a substitute for security. Its cyber insurance guidance states that cyber insurance will not instantly solve all of your cyber security issues. Insurance is best treated as one part of how you manage cyber risk, alongside the controls that make an incident less likely and the plans that make recovery faster.

Before buying, the NCSC also suggests checking the policies you already hold. Property or business interruption policies may already cover some cyber-related losses, or may specifically exclude them. Your existing policy documents, or your broker, can confirm which. Doing this first helps you avoid gaps between policies and avoid paying twice for the same cover.

#What does cyber insurance typically cover?

Cyber policies often include three broad areas: support to respond to an incident, cover for your own financial losses, and cover for claims made against you by others. Some policies also extend to certain types of fraud. Each area has its own limits, conditions and exclusions, so check the wording for every section rather than the headline summary.

The categories below reflect the kinds of cover the NCSC describes in its guidance and that you will often see in policy documents. Use them as a map for reading a policy, not as a promise of what any policy contains.

#Incident response support

Policies often give access to specialist help when an incident happens. The NCSC lists support such as IT forensics, legal assistance, public relations and access to incident response teams. Check whether you must use the insurer's nominated firms, how you reach them out of hours, and whether using your own advisers is permitted or affects cover.

#Your own losses (first-party cover)

• Restoring systems and data: the cost of recovering, rebuilding or restoring affected systems and data. Check whether improvements beyond what you had before are included.
• Business interruption: loss of income or extra costs while operations are disrupted. Check how the loss is measured and whether a waiting period applies before cover starts.
• Legal and regulatory support: help with legal and regulatory matters after an incident, such as working out notification duties. Check what is included and what is not.
• Extortion: check whether, and on what terms, the policy addresses extortion demands such as ransomware, and what conditions apply before any decision is made.

#Claims against you (third-party cover)

Policies often include cover for defending and settling claims brought by customers or others affected by a breach of data your organisation holds. Check who counts as a third party, whether liabilities you have accepted under contracts with clients are included, and how defence costs interact with the overall limit.

#Fraud and other extensions

Some policies extend to computer-enabled fraud. The NCSC notes that some policies do not cover certain common losses, such as business email compromise fraud. If payment diversion is a concern for your finance team, ask specifically whether it is covered, under which section, and on what conditions.

#What is often excluded or limited?

Exclusions vary between policies, so the only reliable answer is in your own wording. The NCSC advises reading exclusions closely and asking specific questions, for example whether new types of attack would be covered, whether claims from third parties are included and what limits apply. Conditions about maintaining your security controls matter just as much.

Exclusions are not a sign that a policy is poor. They define the boundaries of cover, and every policy has them. The risk lies in discovering them for the first time during an incident. Read the exclusions and conditions with the same care as the cover sections, ideally with someone who understands both your technology and your contracts.

Questions worth putting to your broker or insurer, and checking against the wording, include:

• Is there a waiting period before business interruption cover begins, and how is lost income calculated?
• Are there sub-limits for particular types of loss that sit below the headline limit?
• How does the policy treat an incident that began before the policy started but was discovered later?
• Are there conditions requiring specific controls, such as multi-factor authentication or backups, to be in place?
• How are attacks attributed to states, or to acts of war, treated?
• Does the policy respond to an incident at a supplier or cloud provider that disrupts your operations?
• How are regulatory fines and penalties addressed, if at all?
• How quickly must you notify the insurer of an incident, or of a suspected incident?

#Why do the answers on your application matter?

Your application answers matter because the insurer relies on them to assess the risk and set terms. The NCSC warns that if you claim security measures are in place when they are not, the insurer may not be obliged to pay claims. Accurate, evidence-backed answers protect your organisation as much as the policy itself does.

Applications may ask about technical, procedural and human controls. The NCSC notes that policies are typically reassessed every year, and that you should tell your insurer when your circumstances change. A merger, a major new system, a change of key supplier or a lapse in an important control may all be worth raising with your broker.

Treat the application as a shared exercise between finance, IT, security and legal. The person signing it should be confident that each answer reflects how things actually work across the whole organisation, not only in the best-run parts. Our companion guide on getting ready for a cyber insurance application covers the controls you are likely to be asked about.

#How do you compare cyber insurance policies?

Compare cyber policies by reading the wording side by side against your own risks, not by comparing headline limits or premiums alone. Start with your most important systems and worst-case scenarios, then check how each policy would respond, which response services it includes and what conditions you must meet. An authorised broker can explain the differences.

The NCSC suggests starting with your own organisation rather than the policy. Identify your key assets and the scenarios that must not happen, then look at how a policy responds to those. It also suggests bringing together people with contract, technical and process expertise to understand what is being offered.

1. List your critical systems, data and services, and the incidents that would cause most harm.
2. For each scenario, find the section of each policy that would respond, and note limits, sub-limits and excesses.
3. Check the response services offered: who provides them, how you reach them and whether they are available at all hours.
4. Read the exclusions and conditions, especially any that depend on controls being in place.
5. Confirm how and how quickly you must notify the insurer of an incident.
6. Check how the policy sits alongside your property, business interruption and liability policies.
7. Ask the broker or insurer to explain anything unclear, in writing.

#Is cyber insurance worth it for your organisation?

Whether cyber insurance is worthwhile depends on your risks, your existing cover, your ability to absorb losses and your appetite for risk. It is a business decision for your board and finance team, informed by an authorised broker or insurer who can explain specific policies. Insurance can support recovery, but it does not replace good security.

Questions that help a board reach its own view include: how long could we operate without our core systems; how would we fund the immediate cost of an investigation and recovery; do we have specialist response capability in-house; and what do our contracts require of us after a breach? The NCSC notes that services bundled with policies, such as consultancy and resilience planning, can help where in-house skills are limited.

#What to do next

Next, gather your existing policies, map your worst-case scenarios and review your security controls honestly. Then speak to an authorised broker or insurer, who can explain specific policies and how the wording applies to you. Business Cyber Check can introduce your organisation to up to 3 authorised insurers or brokers to start that conversation.

• Collect current property, business interruption and liability policies, and note any cyber cover or exclusions.
• Agree your critical systems and the incidents that would cause most harm.
• Review your key controls so that application answers are accurate.
• Check that any firm you speak to is authorised, using the FCA Financial Services Register.
• Decide who in your organisation will read and challenge the policy wording.

Business Cyber Check does not quote, advise on or recommend insurance policies, and cannot say what any policy will pay. We introduce organisations to up to 3 authorised insurers or brokers, who can explain specific policies and their wording.

#Frequently asked questions