In collaboration with Honra
Cyber insurance is the one security purchase most companies make without reading what they bought. The policy arrives through a broker, the premium is reasonable, the application takes an afternoon, and the document goes in a drawer until the day the systems stop working. That day, the policy decides whether the forensic firm, the lawyers, the notification letters, the lost revenue and the ransom negotiator are the insurer's expense or the company's. In this Legal Update, prepared with the technology consultancy Honra, we set out the ten questions to ask before buying or renewing a cyber policy, what the answers should look like, and the controls insurers will ask the company to prove.
1. What does the policy actually pay for?
Cyber policies have two halves. First-party coverage pays the company's own costs: the forensic investigation, legal advice, notifying affected people and regulators, credit monitoring, public relations, restoring data and systems, lost income while the business is down, and extortion payments. Third-party coverage pays what the company owes others: defense and settlements in lawsuits by customers or employees, regulatory investigations and penalties where the law allows them to be insured, and payment-card assessments after a card breach. Ask for a one-page schedule of coverages and limits, and read it against the company's actual risks. A company that stores no card data but runs its operations in the cloud needs a different policy from a retailer.
2. Is ransomware covered, and up to how much?
Most policies cover extortion, but many cap it with a "sublimit," a lower ceiling inside the overall limit, and all of them condition payment on the insurer's prior consent and a sanctions check, because paying a sanctioned attacker is a violation regardless of insurance.[1] Ask for the sublimit, the consent process, and who the insurer's negotiators are. For entities covered by Puerto Rico's Ley Núm. 40-2024, and for the vendors acting as their agents, the question has a different answer: the statute prohibits those entities, and their insurers and guarantors, from paying a ransom at all, so the coverage to look for is response and restoration, not payment.[2] We explained that prohibition in our Legal Update of October 23.
3. When does business interruption coverage start, and when does it end?
Business interruption coverage pays lost income and extra expense while systems are down, but it starts only after a "waiting period," which ranges from a few hours to a full day depending on the policy, and ends at the close of a "period of restoration" the policy defines. Ask how long each is, whether the coverage reaches an outage at a vendor or cloud provider ("dependent" or "contingent" business interruption), and whether it covers a system failure the company caused itself, such as a bad update, or only an attack.
4. Are wire fraud and fake invoices covered?
The most common loss for small and mid-sized companies is not a hack but a deception: an email that looks like a vendor's, asking that the next payment go to a new account. Many cyber policies exclude this "social engineering" or "funds transfer fraud" loss, or cap it at a small sublimit. The coverage often sits in a separate crime policy, or in an endorsement that must be requested. Ask where it is and how much it is.
5. What did we promise on the application?
The application is part of the policy. It asks whether the company uses multi-factor authentication, endpoint detection, offline backups and regular patching, and the answers are representations. An insurer that discovers after a claim that an answer was wrong can seek to rescind the policy, as one did in 2022 after an insured's application overstated its use of multi-factor authentication.[3] Have the person who actually knows the systems review every answer before the person who signs does, and keep the evidence that the answers were true.
The Five Controls Underwriters Ask You to Prove
The application questions are not a formality. The answers set the premium, decide whether the insurer will bind the policy at all, and, if wrong, can void it. Five controls appear on nearly every application.
Companies that cannot answer yes to all five should fix the gaps before the application, not describe them as planned. The underwriter will ask for evidence, and after an incident the insurer's forensic firm will find out.
6. Which exclusions could swallow the coverage?
Four deserve attention. War and hostile-act exclusions have been rewritten across the market since 2023 to reach attacks attributed to nation-states, after a court held that an older exclusion did not apply to the NotPetya attack.[4] "Failure to maintain" exclusions bar coverage if the company stops doing what it said it does on the application. Infrastructure exclusions remove outages of power, telecommunications or the internet. And prior-knowledge exclusions bar claims from incidents the company knew or should have known about before the policy began. Ask the broker to walk through each with a scenario.
7. Who do we have to call first, and can we choose our own lawyer?
Most policies require the company to use the insurer's panel of lawyers and forensic firms, or to obtain consent before hiring anyone else, and they will not pay for a firm hired without consent. Ask for the panel in advance, and if the company wants its own counsel, ask the broker to add it to the policy by endorsement before the policy is bound. Who hires the forensic firm also decides whether its report is protected in later litigation, which we explained in our Legal Update of October 26.
8. When must we notify the insurer, and what happens if we are late?
Policies require notice "as soon as practicable," and late notice is one of the most common grounds for denial. In Puerto Rico, where the Departamento de Asuntos del Consumidor must be notified within 10 days of detecting a breach and PRITS within 48 hours for government vendors, the insurer should hear about an incident on day one, before anyone is hired and before any letter goes out. Put the broker's and the insurer's after-hours numbers in the incident response plan, next to the forensic firm's. Our Legal Update of October 22 explains why those periods run from detection.
9. Are regulatory fines and card-brand assessments covered?
Regulatory coverage pays for responding to investigations by DACO, HHS, the FTC or a state attorney general, and for fines and penalties where the law allows them to be insured. Payment-card assessments after a card breach are a separate item. Both are often sublimited. Ask for the numbers, and whether defense costs erode the limit.
10. Is the insurer licensed here, and whose law governs a dispute?
Cyber coverage is often written by surplus lines insurers rather than insurers admitted by the Oficina del Comisionado de Seguros, and most policies contain choice-of-law and forum clauses that send a coverage dispute to another jurisdiction, sometimes to arbitration. Neither is disqualifying, but the company should know before a dispute arises who regulates its insurer and where a fight over coverage will be fought.
Before Renewal
If you have questions about the matters discussed in this Legal Update, please contact the Maceira Zayas lawyers with whom you regularly work.
Prepared in collaboration with Marc A. Maceira, President of Honra, a technology consultancy, and Senior Technology Advisor at Maceira Zayas.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas. It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.
Overview: Cyber insurance is the one security purchase most companies make without reading what they bought. Ten questions to ask before buying or renewing a policy, the five controls underwriters ask companies to prove, and the Puerto Rico rules that change the answers. Prepared in collaboration with Honra.
Meta description: Buying cyber insurance: ten questions on coverage, sublimits, exclusions and notice, the five controls underwriters check, and the Puerto Rico rules that change the answers.
Most companies buy cyber insurance the way they buy a car policy: by price, without reading it. The policy then decides, on the worst day, whether the forensic firm, the lawyers, the lost revenue and the ransom negotiator are the insurer's expense or the company's. In a new Legal Update prepared with Honra, Maceira Zayas sets out ten questions to ask before signing, the five controls underwriters will ask you to prove, and the Puerto Rico rules that change the answers. Part of our Cybersecurity Awareness Month series. Read more via the link in the comments.
First comment: https://www.mzls.com/insights/buying-cyber-insurance-ten-questions
When the designer delivers the PDF and Joseph has the download page, add one line above the endnotes: "A two-page checklist version of this Legal Update is available here," linked to the download. I left it out so nothing on the page points to something that doesn't exist yet.
