Cyber Insurance Claims: What Happens After You Notify Your Insurer

Many cyber insurance claims are reduced or delayed not because the policy excludes the loss, but because the insured cannot prove what happened, when it knew, what it spent and why. Once the hotline call is made, the incident runs on two tracks at once: the technical response and a commercial claim with its own deadlines, consents, evidence standards and adjusters. This guide covers that second track, from first notice through coverage position, cost approval, business interruption calculation, settlement and dispute. It is for security, risk and finance teams who will run a claim. Buying cover, underwriting questionnaires and exclusions are covered in the Cyber Insurance Guide; this page assumes the policy is already in place.

Source note: legal and regulatory points below are summarised from the UK legislation, NAIC model law, NCSC, OFAC and court documents listed in the references, as checked in November 2026. Policy wordings vary. Confirm against the official text before relying on it.

Key takeaways

• Notice is a contractual act, not a courtesy. Most cyber policies require notice of a claim or circumstance "as soon as practicable" or within a stated period, and many run on a claims-made basis, so a late or informal notice can move the loss outside the policy.
• Consent comes before spend. Panel firms, non-panel vendors, extortion payments and third-party settlements usually need the insurer's prior written consent, and costs incurred without it are the most common item an adjuster challenges.
• The coverage letter frames everything that follows. Expect an acknowledgement, then a coverage position that may reserve rights on exclusions, declared controls or prior knowledge; answer it in writing with evidence rather than in calls.
• Business interruption is an accounting exercise. The waiting period, indemnity period and loss calculation are argued from finance records, so finance must be in the response team from the first day.
• Evidence built for the claim also serves regulators and litigation. One decision log, one cost ledger and one forensic timeline, kept with privilege in mind, avoids three conflicting versions of the truth.

The claim lifecycle at a glance

Wordings differ, but this sequence holds for most standalone cyber policies.

First notice: the hour that sets the claim

The joint NCSC, ABI, BIBA and IUA guidance on ransomware incidents (May 2024) says plainly that if you have cyber insurance "you should report the attack to your insurer or broker", and notes that there will be a number to call, or an app, available out of hours. The NCSC's cyber insurance guidance adds that insurers may provide forensic, legal and public relations support and may put the organisation in touch with a cyber incident response company. The practical rule is to call before engaging anyone you intend to claim for.

• Who calls: name a primary and a deputy in the incident response plan. The caller needs the policy number, the insurer's claims reference format and authority to accept panel appointments.
• What to say: facts only. Time of first indicator, time of confirmation, systems affected, whether data may have left, whether there is an extortion demand. Do not speculate on cause or on a declared control that may have failed.
• Written notice: follow the call with a written notice to the address in the policy, even if the hotline says it is not needed. Keep proof of delivery. Where a broker is involved, send to both and confirm the broker has passed it on.
• Circumstances, not only claims: many policies let you notify a circumstance that may give rise to a claim (for example a suspicious login with no confirmed loss). Doing so can attach a later claim to the current policy year. Ask your broker how your wording treats it before the incident, not during it.
• Other policies: check whether crime, property, directors and officers, or professional indemnity policies also need notice. The Merck NotPetya dispute, where the New Jersey Appellate Division held in May 2023 that a "Hostile/Warlike Action" exclusion in property policies did not apply, shows that large cyber losses can also be claimed under policies that are not labelled cyber.

Put the hotline number, policy number and broker contact in the offline contact list described in the Incident Response Plan Template. During a ransomware incident, email and the document store may be unavailable.

Panel firms, consent and cost control

Most policies include a panel of pre-approved breach counsel, forensic investigators, negotiators, public relations firms and notification vendors at agreed rates. Using them is rarely compulsory in law, but the policy may only pay for non-panel firms with prior written consent, or only at panel rates.

Invoices are where adjusters spend most of their time. Ask every vendor for itemised time entries tied to the approved scope, with a separate line for work outside it. A daily or weekly cost ledger, structured like the Incident Cost Tracking Template, lets you request budget increases before the cap is hit rather than after.

The coverage position and reservation of rights

After notice the insurer acknowledges the claim and, once it has enough facts, states its coverage position. In many markets this arrives as a letter that accepts some sections, declines others and reserves rights on points still being investigated. A reservation of rights is not a refusal: it preserves the insurer's ability to rely on a term later while it continues to pay or investigate.

• Read it against the schedule: check each section cited, the limit and sublimit, the retention and the waiting period. Errors in a coverage letter happen and are easier to correct early.
• Typical reserved points: prior acts or retroactive date, whether a declared control was in place, war or infrastructure exclusions, and whether costs were reasonable and consented.
• Respond in writing: answer each point with evidence: configuration exports, coverage reports, the forensic timeline. Verbal reassurances on a call do not change a written position.
• Declared controls under UK law: section 11 of the Insurance Act 2015 stops an insurer relying on non-compliance with a term where the insured shows the non-compliance "could not have increased the risk of the loss which actually occurred in the circumstances in which it occurred". It does not apply to terms defining the risk as a whole, and non-consumer policies can contract out in some cases, so take advice on your wording.
• Misstated controls: the NCSC warns that where security measures were claimed but not in place "the insurer may not be obliged to pay any claims". If the forensic work reveals that an application answer was wrong, involve counsel and the broker before responding.

Evidence: building one claim file

The claim, regulator notifications and litigation draw on the same facts, so keep one controlled set of records.

Forensic images and logs taken for the claim should follow the same handling as any other evidence. See the Evidence Handling and Chain of Custody Guide.

Privilege and the forensic report

In common law jurisdictions breach counsel often engages the forensic firm so that its work may attract legal privilege. That protection is not automatic. In In re Capital One Consumer Data Security Breach Litigation, the US District Court for the Eastern District of Virginia upheld in June 2020 an order that the forensic report was not protected work product. Capital One already had a contract with the same firm covering essentially the same scope, and the report had been shared with around 50 employees, the board, four regulators and its accountant. For the claim, this means agreeing early with counsel and the insurer which report goes to the adjuster, whether a separate factual summary is produced, and who may circulate it. See the Legal Privilege in Incident Response Guide.

Business interruption: how the loss is calculated

Business interruption (BI) is often the largest and most disputed part of a cyber claim. The policy pays for loss during the indemnity period after a waiting period (sometimes called a time retention), commonly expressed in hours. Insurers often appoint a forensic accountant; larger insureds frequently appoint their own.

1. Define the interruption: when did the covered outage start for each revenue-generating system, and when was it restored to normal operation? Partial degradation can count if evidenced.
2. Apply the waiting period: check whether it runs from discovery, from the start of the outage, or per affected system, and whether it is separate from the monetary retention.
3. Build the "but for" baseline: what revenue and margin would have been earned without the incident, using sales history, seasonality, orders and forecasts prepared before the event.
4. Measure actual results: revenue and costs during the indemnity period, including sales recovered later (which may reduce the loss).
5. Add extra expense: overtime, temporary staff, outsourcing, emergency cloud capacity, expedited shipping, incurred to reduce the loss.
6. Subtract saved costs: expenses that stopped because the business was down.
7. Reconcile: present a schedule with every figure traceable to a ledger or system report.

Contingent or dependent BI, where a supplier's outage stops your business, needs evidence from the supplier too. Ask suppliers for outage confirmation letters early. A pre-incident Business Impact Analysis Template with revenue per hour for each critical service shortens this work considerably.

Claims handling standards and timescales

Insurers are bound by rules on how they handle claims, which help the insured hold the process to a reasonable pace.

These rules set a floor, not a timetable. A complex ransomware claim with a large BI element can take many months to settle. Ask for interim payments against agreed heads of loss (for example response costs already approved) rather than waiting for the whole claim to be quantified.

Where identity fits

Identity evidence decides many coverage questions. Reservation letters often ask whether multi-factor authentication was enforced on the path the attacker used, whether privileged and service accounts were managed as declared, and whether backup consoles had separate credentials. Export sign-in logs, conditional access policies, privileged account inventories and vault reports in the first days, because rebuilds and credential resets change them. For the questionnaire answers these exports are tested against, see the Identity Controls for Cyber Insurance Questionnaires Guide.

Disputes and how to avoid them

• Escalate in steps: claims handler, then claims manager, then a meeting with broker and counsel present. Check the wording's dispute resolution clause, which may require mediation or arbitration before court.
• Use the broker: the broker acts for the insured; involve them on every material letter.
• Recovery against third parties: after paying, the insurer may pursue a responsible supplier through subrogation. Do not sign waivers or settlements with suppliers without checking the policy.

Detection and measurement

Measure claim readiness in exercises and real incidents:

• Time to notify insurer: minutes from incident declaration to hotline call, and hours to written notice.
• Non-consented spend: value of costs incurred before insurer approval, as a share of total claimed (target near zero).
• Invoice rejection rate: share of vendor invoice value queried or reduced by the adjuster.
• Evidence capture time: hours until configuration and coverage exports for declared controls are preserved.
• BI baseline readiness: share of critical services with a documented revenue-per-hour figure.

Common failure patterns

• Calling the old forensic firm first: a retained firm is engaged before the insurer is told, and its fees are later reduced to panel rates or questioned.
• Losing the evidence of declared controls: systems are rebuilt and credentials reset before anyone exports the configuration that proves MFA or EDR was in place.
• Finance joins late: no one recorded outage times per service or saved pre-incident forecasts, so the BI baseline is argued from memory.
• Forensic report circulated widely: the full report is sent to staff, auditors and regulators without counsel's input, weakening any privilege claim, as in the Capital One ruling.
• Forgotten policies: crime, property or directors and officers policies are not notified, and their notice periods expire.

Framework mapping

See the NIST SP 800-61 Incident Response Guide.

Practitioner checklist

• Put the insurer hotline, policy number, broker and panel contacts in the offline incident contact list, with a named caller and deputy.
• Agree with the broker before any incident how your policy treats notice of circumstances and which retained firms are approved.
• Give the first call facts only and follow it with written notice to the policy address, keeping proof of delivery.
• Notify every potentially responding policy: cyber, crime, property, directors and officers, professional indemnity.
• Get written consent and a scope for each vendor before work starts, and track spend against caps weekly.
• Export configuration and coverage evidence for every declared control in the first days, before rebuilds.
• Agree with counsel who commissions the forensic report and who receives it, including the adjuster.
• Bring finance in on day one to record outage times per service and preserve pre-incident forecasts.
• Answer every coverage letter in writing with evidence, and ask for interim payments on undisputed heads of loss.
• Exercise a claim annually with the hotline, broker, counsel and finance alongside the technical tabletop.

Standards and references

• UK legislation: Insurance Act 2015, section 13A, Implied term about payment of claims
• UK legislation: Insurance Act 2015, section 11, Terms not relevant to the actual loss
• NAIC: Unfair Claims Settlement Practices Act (Model 900)
• NCSC: Guidance for organisations considering payment in ransomware incidents
• NCSC: Cyber insurance guidance
• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
• NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• US District Court, E.D. Virginia: In re Capital One Consumer Data Security Breach Litigation, Memorandum Opinion and Order

Related NHI Mgmt Group resources: Cyber Insurance Guide · Incident Response Guide · Ransomware Negotiation Guide · Legal Privilege in Incident Response Guide · Identity Controls for Cyber Insurance Questionnaires Guide. This guide summarises the cyber insurance claims process and published law and guidance on claims handling, and is not legal or financial advice.