Cyber Insurance: Executive Briefing for Boards

Boards often treat cyber insurance as the answer to cyber risk, then discover after an incident that the limit was too low, an exclusion applied or the controls declared at renewal were not actually in place. This briefing is for board members, chief executives, finance directors and risk committees who approve or oversee cyber insurance. It covers what a policy can and cannot do for the organisation, how to think about limits, the exclusions that decide large claims (including war and state-backed attack clauses), why the controls declared to insurers have become a governance matter, and the questions and red flags that tell directors whether the programme is sound. It stays at board level; the policy mechanics, underwriting questions and renewal process are covered in depth in the Cyber Insurance Guide.

The risk in one paragraph

Cyber insurance transfers part of the financial impact of an incident; it does not transfer the incident, the outage, the regulatory scrutiny or the reputational damage. The UK NCSC is explicit that insurance does not stop attacks or solve security problems and that fundamental safeguards should come first. A policy pays only within its limits and sub-limits, only for covered events, only after deductibles and waiting periods, and only if the insured told the truth about its security when it bought the cover; NCSC warns that false statements about security controls may allow insurers to refuse claims. The board's job is to decide how much of the organisation's cyber risk to retain and how much to transfer, to make sure the cover matches the scenarios that would really hurt, and to make sure the answers given to insurers are accurate and kept accurate.

Why this is a board-level issue now

Losses now exceed what most programmes would pay: Marks and Spencer estimated a £300 million reduction in profit before recoveries after its April 2025 attack. Jaguar Land Rover reported £196 million of incident costs in one quarter, the UK Cyber Monitoring Centre estimated the UK-wide cost at £1.9 billion, and TechCrunch reported that the company did not have cyber insurance. See the Marks and Spencer cyberattack and the Jaguar Land Rover cyberattack.
War and state-backed attack wording has changed: since 31 March 2023, Lloyd's has required standalone cyber-attack policies written in its market to exclude war and certain catastrophic state-backed cyber attacks, with a clear basis for attribution. These clauses decide whether the largest events are covered at all.
Old wordings were tested in court: in May 2023 the New Jersey Appellate Division upheld a ruling that a "hostile or warlike action" exclusion in Merck's property policies did not bar cover for the 2017 NotPetya attack, finding the exclusion required military action. Merck had claimed about $1.4 billion. Insurers responded with explicit cyber war language, which is why current policies read differently.
Ransom payments carry sanctions risk: the US Treasury's OFAC advisory of 21 September 2021 says facilitating a payment to a sanctioned party can breach sanctions on a strict liability basis, names cyber insurers among the firms at risk, and treats prompt reporting to law enforcement and strong security practices as significant mitigating factors.
Directors are expected to own cyber risk decisions: the UK government's Cyber Governance Code of Practice, published on 8 April 2025, is aimed at boards and directors. How much risk to transfer is one of those decisions. See the Board and Director Cyber Liability Guide.

What a policy can and cannot do

NCSC lists the support policies may provide: forensic, legal and public relations help, access to incident response firms, defence and settlement of data breach claims, and in some policies computer-enabled fraud. It also warns that some losses, such as business email compromise fraud, may not be covered.

Typically within scope (check your wording)	Often limited, sub-limited or excluded	Never transferable
Incident response costs: forensics, legal advice, notification, crisis communications	Business interruption beyond the waiting period and indemnity period	Accountability for the decisions taken
Business interruption after a waiting period	Dependent business interruption caused by a supplier or cloud provider outage	Loss of customer trust and market position
Data restoration	Social engineering and payment diversion fraud	Management time and distraction
Third-party liability for data breaches, including defence costs	Regulatory fines, where insurability depends on the jurisdiction	Criminal liability
Cyber extortion costs, subject to law and sanctions	War and state-backed attacks, failure of infrastructure, betterment of systems	Reputational harm to directors

The middle column is where boards are most often surprised. Each item should be a deliberate decision, not an accident of the wording.

Limits, retention and the scenarios that matter

A limit should come from modelled loss scenarios, not from last year's renewal or a peer comparison. NCSC advises assessing business interruption, response and recovery costs and dependencies between systems before buying. A practical approach for the board:

Pick three to five severe but plausible scenarios: for example, ransomware stopping core operations for three weeks, a large personal data theft, a critical supplier or cloud outage, and a payment diversion fraud.
Estimate the financial range for each: lost revenue and extra costs per day of outage, response and notification costs, liability and regulatory exposure. Quantification methods help here. See the Cyber Risk Quantification Executive Briefing.
Map each scenario to the policy: which coverage section responds, which sub-limit caps it, what waiting period and indemnity period apply, and which exclusion could defeat it.
Decide the retention: how much loss the balance sheet can absorb (the deductible and anything above the limit), and whether a higher limit, a captive or a different structure is worth the premium.
Record the decision: the board should be able to show it chose its level of risk transfer knowingly.

Exclusions and clauses that decide large claims

Clause	Why it matters	What the board should ask
War and state-backed cyber attack exclusion	Lloyd's bulletin Y5381 requires exclusion of war and of state-backed attacks that significantly impair a state's ability to function or its security capabilities, a clear position on systems outside the affected state, and a robust attribution basis	Which model clause do we have, how is attribution decided, and does it cover collateral damage from an attack aimed at someone else?
Infrastructure or utility failure	Outages of power, telecoms or internet infrastructure may be excluded	Would a major cloud or telecoms outage be covered?
Dependent business interruption	Loss caused by a supplier's incident may need specific cover	Which named or unnamed suppliers are covered, and at what sub-limit?
Prior known circumstances and retroactive date	Incidents that started before the policy period may be excluded	When does cover start, and what did we disclose about past incidents?
Failure to maintain declared controls	Some wordings make controls a condition of cover	Are any controls conditions precedent, and do we meet them everywhere?
Panel and consent requirements	Using non-panel firms or paying without consent may reduce recovery	Do our incident plan and retainers match the insurer's panel and consent rules?

Exclusion wording varies by insurer and market; this table is a prompt for questions, not a statement of what any policy says.

Declared controls are now a governance matter

Insurers ask detailed questions about security at every renewal, and NCSC notes policies are typically reassessed every 12 months, that insureds should keep security details accurate and notify insurers of changes, and that false statements may allow claims to be refused. That turns the proposal form into a board-relevant attestation. The questions concentrate on identity: multi-factor authentication for remote access, email and privileged accounts, privileged access management, endpoint detection, backups kept separate from the network, and patching. Two points directors should press on:

Coverage of the answer: "we have MFA" is only true if it covers every remote access route, every administrator and every third-party and service account that can log in remotely. Change Healthcare's attackers used a remote access login without MFA. See the Change Healthcare breach.
Ownership of the answer: someone accountable should sign off each answer with evidence, and changes during the year (an acquisition, a new remote access route, an exception) should be reported. See the Identity Controls for Cyber Insurance Questionnaires Guide.

Five questions for the board to ask

What scenarios is our limit based on? Show us the loss scenarios, the estimated range for each, and which part of the policy would pay and up to what sub-limit.
What would not be covered? Walk us through the war and state-backed attack clause, dependent business interruption, fraud and regulatory fines, and tell us how much of our worst scenario we retain.
Are our answers to the insurer true everywhere? Who signed off the proposal form, what evidence supports each control answer, and what has changed since?
Does our incident plan fit the policy? Are our retained response firms on the insurer's panel, who notifies the insurer and how fast, and what consent do we need before paying costs or engaging with an extortion demand?
How would we decide on a ransom demand? Who decides, how are sanctions checks done, when do we report to law enforcement, and what does the policy say? See the Ransomware Executive Briefing.

Red flags in management answers

"We're covered": nobody can state the limit, the main sub-limits or the war clause.
Limit unchanged for years: while revenue, digital dependency and incident costs have grown.
Proposal form completed by the broker or one person in IT: no evidence and no executive sign-off.
MFA "in place" with exceptions nobody mentions: legacy remote access, service accounts or contractors left out.
Incident plan written without the policy: response firms not on the panel, notification steps missing.
Insurance treated as the security budget: controls deferred because "the insurer will pay".

What good looks like

A board-approved statement of how much cyber risk is retained and how much is transferred, reviewed annually.
Limits and sub-limits tied to documented loss scenarios and quantification.
A clause-by-clause summary of exclusions and conditions, including the war clause, presented to the risk committee before renewal.
Proposal form answers owned by named executives, supported by evidence, with in-year changes reported to the insurer.
An incident response plan aligned to panel, notification and consent requirements, rehearsed with the broker or insurer contact included. See the Cyber Incident Readiness Executive Briefing.
Controls maintained because they reduce risk, not only because the insurer asks.

Where to invest first

Scenario-based limit review: modest effort, and the basis for every other decision.
Proposal form assurance: verify every control answer, starting with MFA coverage and privileged access, because a misstatement can cost the whole claim.
Close the gaps insurers ask about: MFA on every remote access route and privileged account, governance of service and third-party accounts, and backups separated from the network. These reduce premium pressure and real risk at the same time.
Align the incident plan to the policy: panel firms, notification, consent and ransom decision process.
Review dependency cover: supplier and cloud outages are a growing share of loss.

Metrics to track

Metric	What it tells the board
Limit as a share of the estimated loss for the worst modelled scenario	How much of a severe event is retained
Proposal form answers with documented evidence and an executive owner	Risk of a claim dispute over misstatement
Remote access routes, privileged accounts and service accounts without MFA or equivalent controls	Gap between declared and actual controls
Time to notify the insurer in the last exercise or incident	Whether notification conditions would be met
Premium, deductible and limit trend over three renewals	Market view of the organisation's risk
Open exceptions to controls named in the policy	Exposure to a condition-of-cover dispute

A 90-day plan

Days 1 to 30: broker and management present the current programme to the risk committee: limits, sub-limits, deductibles, the war clause and other key exclusions; management lists the controls declared at the last renewal and their owners.
Days 31 to 60: verify each declared control with evidence and fix or disclose gaps; model three to five loss scenarios and map them to the policy; align the incident response plan with panel and notification requirements.
Days 61 to 90: the board approves its risk retention position and renewal strategy; add the insurance metrics to the regular risk report; schedule an exercise that includes the insurer notification and ransom decision steps. See the Board Cyber Risk Reporting Guide.

Common failure patterns

Buying a number, not a scenario: the limit is set by budget or peers and covers a fraction of a realistic outage.
Exclusions read after the incident: the war, infrastructure or dependent business interruption clause is discovered during the claim.
Inaccurate declarations: a control answered "yes" that was partial, giving the insurer grounds to dispute or reduce the claim.
Uninsured by default: cover lapsed, was never bought, or was assumed to sit inside another policy that in fact excludes cyber. NCSC advises checking whether existing business interruption or property policies cover or exclude cyber losses.
Payment decisions made under pressure: extortion handled without sanctions checks, law enforcement contact or insurer consent.

Lessons from incidents

The 2025 UK retail and manufacturing attacks show how far real losses can exceed typical limits: Marks and Spencer's estimate was £300 million before recoveries, and Jaguar Land Rover's quarterly costs alone were £196 million, with a £1.5 billion government loan guarantee announced to support the company and its supply chain. The NotPetya litigation shows the other side: when wording is unclear, recovery can take years in court. Boards should take both lessons: size the programme on realistic scenarios and read the exclusions before they are needed.

Practitioner checklist

Document three to five severe loss scenarios and map each to the policy sections, sub-limits and exclusions.
Present a clause summary, including the war and state-backed attack exclusion, to the risk committee before renewal.
Assign an executive owner and evidence to every control answer in the proposal form.
Report material control changes to the insurer during the policy year.
Align incident response retainers with the insurer's panel and consent rules.
Add insurer notification and a ransom decision process with sanctions checks to the incident plan.
Check other policies for cyber cover or cyber exclusions.
Track and report the metrics above at least before every renewal.

Standards and references

How NHI Mgmt Group can help

We provide independent identity and non-human identity risk assessments and board briefings, including evidence for the MFA, privileged access and service account controls that insurers ask about. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.

Cyber Insurance Executive Briefing: What Boards Need to Know and Ask