Cyber Insurance Guide: Coverage, Requirements and Claims

Cyber insurance only pays out when the policy matches the loss and the security controls the organisation declared were actually in place on the day of the incident. Underwriters now ask detailed questions about multi-factor authentication, endpoint detection, backups, privileged accounts and patching, and the answers become part of the contract. A wrong answer, a missed notification deadline or an exclusion nobody read can leave a large loss uninsured. This guide is for security leaders, risk managers and practitioners who fill in the questionnaire, work with brokers and run the response when a claim is made. It covers cover types, underwriting requirements, exclusions including state-backed attack wording, the claims process and the legal position on ransom payments in the US and UK.

Key takeaways

• The questionnaire is a warranty in practice. The NCSC warns that if security measures are misrepresented "the insurer may not be obliged to pay any claims", so security teams, not only finance, must own the answers.
• Identity controls dominate underwriting. Ransomware supplemental applications ask about MFA on email, remote access, privileged accounts and the backup console, and about how local administrator, domain administrator and service accounts are managed.
• Read the exclusions before the limits. War and state-backed attack exclusions, required in Lloyd's standalone cyber policies since 31 March 2023, infrastructure outage exclusions and fraud carve-outs decide what a limit is worth.
• The claim starts in the first hour. Late notification and using response firms outside the insurer's panel without consent are common reasons for reduced recovery, so the incident response plan must include the insurer.
• Insurance does not make a ransom payment lawful. OFAC applies strict liability to payments to sanctioned parties, including where insurers and response firms facilitate them, and the ICO does not treat payment as mitigation.

What a cyber policy covers

Cyber policies combine first-party sections (the insured's own losses) and third-party sections (claims made against the insured). The NCSC describes typical cover as business interruption, response and recovery costs, legal and regulatory support, data breach claims from affected parties including defence and settlement, and in some policies computer-enabled fraud. Wordings differ, so treat the table as a checklist, not a description of every policy.

Before buying, check what existing property, business interruption, crime and professional indemnity policies already say about cyber events. The Bank of England PRA calls policies "that do not explicitly include or exclude coverage for cyber risk" non-affirmative, or silent, cyber, and its Supervisory Statement SS4/17 expects insurers to remove that ambiguity by "introducing robust wording exclusions", "attaching specific limits of cover" or pricing explicit cover. For buyers, the effect is that cyber losses are increasingly excluded from traditional policies.

Underwriting: the controls insurers ask about

The New York Department of Financial Services' Cyber Insurance Risk Framework (Insurance Circular Letter No. 2, 2021) tells insurers to "rigorously measure insured risk", which it says "commonly starts with gathering information regarding the institution's cybersecurity program through surveys and interviews". In practice that means a main application plus a ransomware supplemental application. Two published supplementals, Admiral Insurance Group form 182APP0323 and Corvus Insurance's ransomware supplemental, show the pattern.

Questions vary between carriers and change at renewal. Where a form asks for "all endpoints" and the honest answer is "most", do not round up. The NCSC also advises: "Do not limit yourself to meeting the minimum cyber security requirements specified by an insurer". Insurer minimums are an underwriting filter, not a security baseline. For the controls themselves, see the Ransomware Prevention Guide.

Where identity fits

Most underwriting questions that decline or load a risk are about identity, because stolen credentials and unprotected remote access are how many ransomware incidents begin. The Change Healthcare breach started with a remote access login without MFA, and the Colonial Pipeline attack with an unused VPN account. Both map directly to questionnaire items.

• MFA scope: answer for every path, not the main one. Legacy VPN profiles, break-glass accounts, contractor access and service desk tools are the usual gaps. Phishing-resistant methods strengthen the answer where the form asks for method. See the MFA Guide.
• Privileged accounts: insurers ask how many persistent admin accounts exist and whether they are vaulted. Just-in-time elevation reduces the count you have to declare. See the Privileged Access Management Guide.
• Service accounts: Corvus's form includes service accounts in its definition of privileged accounts. Interactive logon rights, non-expiring passwords and domain admin membership for service accounts are hard to defend on a signed application. See the Service Account Security Guide.
• Backup credentials: separate credentials and MFA on the backup console are asked for directly, because attackers who hold domain admin rights delete backups before encrypting.
• Leavers: Admiral's form asks about "rapid (immediate) account access termination procedures". A joiner-mover-leaver process with evidence answers it.

Exclusions and conditions that decide a claim

Lloyd's Market Bulletin Y5381 (17 August 2022) requires standalone cyber-attack policies written at Lloyd's to carry a state backed cyber-attack exclusion "From 31 March 2023 at the inception or on renewal of each policy". The exclusion must exclude war losses where there is no separate war exclusion, exclude state backed attacks that "significantly impair the ability of a state to function" or its security capabilities, "be clear as to whether cover excludes computer systems that are located outside" the affected state, and "set out a robust basis by which the parties agree on how any state backed cyberattack will be attributed". Lloyd's said adopting any of the four LMA model clauses issued as LMA21-043-PD (commonly referenced as LMA 5564 to 5567, which differ mainly in how much cover is retained) meets the requirements. The US GAO reported in June 2022 that insurers were "excluding coverage for losses from cyber warfare and infrastructure outages".

Claims and the incident response panel

Most policies give the insured access to a panel: breach counsel (often called the breach coach in the US market), forensic firms, negotiators, PR and notification vendors. Panel firms are usually pre-approved at agreed rates, and costs from non-panel firms may need prior written consent. The Incident Response Guide covers the response itself. For the claim, the points that matter are:

• Notify early: the joint NCSC and insurer guidance says "If you have cyber insurance, you should report the attack to your insurer or broker", and many insurers run out-of-hours hotlines. Put the number and policy reference in the offline incident contact list.
• Pre-approve your retainer: if you already retain a forensic firm, get the insurer to approve it before an incident, not during one.
• Privilege: in common law jurisdictions breach counsel often engages the forensic firm so that reports may attract legal privilege. Agree the structure with counsel before the first report is written.
• Record decisions: the NCSC guidance asks victims to keep a log of actions and decisions offline. The same log supports the BI calculation and any dispute.
• Quantify BI with finance: lost revenue, extra expense and the waiting period are calculated from accounting records, so involve the finance team from day one.
• Consent before paying anything: extortion, settlements and non-panel spend almost always need insurer consent.

Ransom payment decisions

Whether a payment is covered and whether it is lawful are separate questions. OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (21 September 2021) addresses "financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response", states that "OFAC may impose civil penalties for sanctions violations based on strict liability", and reviews licence applications "on a case-by-case basis with a presumption of denial". It treats as significant mitigating factors a prompt, complete report to law enforcement, full cooperation, and "meaningful steps taken to reduce the risk of extortion by a sanctioned actor", such as "maintaining offline backups of data, developing incident response plans", training, updated anti-malware "and employing authentication protocols".

Two points from the NCSC guidance should anchor any board discussion: "you cannot trust a promise to delete it once a ransom is paid", and "Even where a decryption key is acquired, it's unlikely to result in an immediate return to business as usual". The Caesars Entertainment breach, where stolen loyalty data was followed by a ransom, is a useful case to walk through in a tabletop.

Choosing cover: decision guidance

• Limit: base it on modelled scenarios (a week of outage, a large data breach, a funds transfer fraud) rather than peer benchmarks. See the Cyber Risk Quantification Guide.
• Retention: a higher deductible lowers premium but must be funded from cash on the worst day. Check whether the BI waiting period is separate from the retention.
• Small organisations: package policies with a strong response panel are often worth more than a high limit, because the panel supplies expertise the business lacks. The NCSC notes that Cyber Essentials and Cyber Essentials Plus can lead to premium discounts and that the IASME Consortium offers cyber liability insurance to some Cyber Essentials holders.
• Large organisations: towers of primary and excess layers need aligned wordings, because a gap in one layer's war or outage exclusion breaks the tower. Contingent BI and supplier aggregation are the main negotiation points.
• Panel or own firm: use the panel where you have no retainer; negotiate your own firm onto the policy where you have one, and record the agreement in the policy schedule.
• Cyber or crime policy for fraud: if business email compromise is a top scenario, compare the cyber policy's social engineering sublimit with a standalone crime policy before assuming it is covered.

Running the renewal: a phased approach

The NCSC notes that "Most cyber insurance policies are re-assessed every 12 months". Treat renewal as a control assurance exercise with a fixed calendar.

1. Six months before renewal: collect last year's application and supplementals, list every answer, and assign each one an owner in security or IT.
2. Five months: test each answer against evidence: MFA policy exports, EDR coverage, vault reports, restore test results. Record exceptions honestly.
3. Four months: fix the gaps that underwriters weigh most (MFA on remote access and privileged accounts, EDR on servers, immutable or offline backups). Pilot changes in report-only or audit mode first, then enforce, and keep the previous configuration exported so you can roll back a policy that locks users out.
4. Three months: run a tabletop with the insurer's hotline, panel counsel and finance, including a ransom decision under OFAC and UK sanctions rules.
5. Two months: review the draft wording with the broker: exclusions, panel, consent clauses, sublimits and war wording.
6. Submission: the CISO and risk owner sign off the application together; keep the signed copy and the evidence pack.
7. During the policy year: tell the insurer about material changes (acquisitions, a declared control being removed) as the policy requires.

Detection and measurement

Monitor the declared controls continuously, because the questionnaire describes a state that must hold all year. Useful sources are IdP sign-in logs for MFA bypasses and excluded accounts, PAM session and checkout logs, EDR health and tamper alerts, and backup job and immutability lock reports. Metrics that show the programme works:

• Declared control drift: number of questionnaire answers that no longer match evidence at quarterly review (target zero).
• MFA coverage: percentage of remote access, email and privileged accounts enforced, with named exceptions.
• Persistent privileged accounts: count of standing admin and over-privileged service accounts, trending down.
• EDR coverage: percentage of servers and endpoints reporting in the last 24 hours.
• Restore success: date and result of the last full restore test of a critical system.
• Time to notify insurer: measured in exercises and real incidents against the policy's requirement.

Common failure patterns

• Finance fills in the form: answers are copied from last year without checking. The first time anyone tests them is during a claim.
• MFA "everywhere" except the account that mattered: a legacy remote access account or a contractor profile without MFA, as in the Change Healthcare breach.
• Calling the wrong firm first: a non-panel provider is engaged in the first hours and the insurer later disputes its fees.
• Backups on the same domain: backup servers joined to the production domain with no separate credentials, so domain admin compromise reaches them.
• Assuming fraud is covered: business email compromise losses fall outside a low social engineering sublimit or are excluded altogether.
• Paying before screening: a payment is made under time pressure before sanctions checks and insurer consent, creating sanctions exposure and a coverage dispute.

Framework mapping

Practitioner checklist

• Make security the owner of every technical answer on the application and supplementals, with evidence filed for each.
• Enforce MFA on email, every remote access path, privileged accounts and the backup console, and list exceptions honestly.
• Reduce and vault standing admin and service accounts before renewal.
• Keep at least one immutable or offline backup copy with separate credentials, and test a full restore.
• Read the war, infrastructure outage, prior acts and control condition wording, and record the broker's explanation.
• Put the insurer hotline, policy number and panel contacts in the offline incident contact list.
• Get your retained response firms approved by the insurer in advance.
• Write a ransom decision procedure covering sanctions screening, law enforcement reporting and insurer consent.
• Exercise a ransomware claim end to end once a year with finance and counsel.

Standards and references

• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
• NCSC: Guidance for organisations considering payment in ransomware incidents
• NCSC: Cyber insurance guidance
• Lloyd's: Market Bulletin Y5381, State backed cyber-attack exclusions
• Bank of England PRA: SS4/17 Cyber insurance underwriting risk
• NYDFS: Insurance Circular Letter No. 2 (2021), Cyber Insurance Risk Framework
• ICO: ICO and NCSC stand together against ransomware payments being made
• US GAO: Cyber Insurance, Action Needed to Assess Potential Federal Response to Catastrophic Attacks

Related NHI Mgmt Group resources: Ransomware Prevention Guide · Incident Response Guide · Privileged Access Management Guide · MFA Guide · Cyber Risk Quantification Guide. This guide summarises cyber insurance cover, underwriting requirements and published regulator and market guidance on exclusions and ransom payments, and is not legal or financial advice.