Lesson 5.48: Cyber insurance: what the policy really says
Cyber insurance can pay for forensics, lawyers, notification, business interruption and sometimes extortion, but only under the conditions in the policy. Insurers base the contract on the security questionnaire you filled in, so a wrong 'yes' can void cover just when you need it. Policies also have notice deadlines, rules about which response firms you may use and exclusions, such as war and state-backed attacks, after Lloyd's of London required such exclusions in standalone cyber policies from 2023. In the lab you check Northwind's answers against reality and read the clauses that matter during an incident.
16 min
You will learn to
- Explain what cyber insurance can and can't do
- Check questionnaire answers against evidence
- Find notice, panel and exclusion clauses
- Explain misrepresentation risk
- Prepare corrections before renewal
Key terms
- Proposal form
- The insurer's security questionnaire; its answers become part of the contract.
- Misrepresentation
- An incorrect material answer that can let the insurer refuse a claim or void the policy.
- Panel vendor
- A response firm (forensics, legal, PR) pre-approved by the insurer.
- War / state-backed exclusion
- Wording excluding losses from war and certain state-backed cyber operations.
- Notice period
- How quickly the insured must tell the insurer about an incident.
← Backups the business can rely on · All lessons · Changing passwords →