Requirements · Cyber insurance
What happens when you make a cyber insurance claim
Last updated 25 October 2026 · 3 sources listed · Reading time about 3 minutes
Short answer
Claims depend on prompt notification, cooperation with the insurer and its appointed specialists, and keeping evidence. Policies are usually written on a claims-made basis with strict notice conditions. The insurer typically coordinates investigation, legal advice and recovery, then assesses what falls within cover. Read the claims conditions before an incident so you know whom to call and what not to do.
Who this is for: A business that has suffered or suspects a cyber incident and wants to understand the steps and obligations under a policy.
What to evaluate
Notification duty
Late notice can reduce or defeat a claim.
How to check: Find the reporting window and the contact route for out-of-hours incidents.
Consent for costs
Insurers may need to approve spending before it is incurred.
How to check: Ask what costs are pre-approved and which vendors can be engaged.
Evidence preservation
Logs and affected systems are needed to establish cause and loss.
How to check: Know who preserves evidence and how.
Cooperation clause
Failure to cooperate may jeopardise cover.
How to check: Read what information the insurer can ask for.
Loss quantification
Business interruption needs financial records to prove.
How to check: Identify the accounts and reports required.
Comparison
| Stage | What happens | What you should do |
|---|---|---|
| Notification | You report the incident to the insurer or hotline | Call promptly and record the time and person spoken to |
| Triage and response | Specialists contain and investigate the incident | Follow instructions and avoid unauthorised changes |
| Quantification | Losses and costs are documented | Provide financial records and invoices |
| Settlement | Insurer pays covered amounts or declines | Request a written explanation of any decision |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 5 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Notification duty | |||
| Consent for costs | |||
| Evidence preservation | |||
| Cooperation clause | |||
| Loss quantification | |||
| Total (max 15) | 0 | 0 | 0 |
Questions to ask before you commit
- Whom do I call first and is the line staffed outside business hours?
- Do I need approval before hiring forensic or legal help?
- What records will you need to assess business interruption?
- How soon after notification will a response team be assigned?
- What happens to payments I have already made before notifying?
- Which actions could prejudice cover, such as admitting liability?
- How can I appeal or complain if a claim is declined?
Typical trade-offs
Notify early on suspicion
- Upside
- Preserves cover and gives access to experts
- Downside
- May affect renewal terms even if the event proves minor
Use the insurer's panel
- Upside
- Pre-agreed rates and fast engagement
- Downside
- Less choice of provider
Handle a small incident internally
- Upside
- Avoids claims history
- Downside
- Risk of missing notice requirements if it escalates
Common mistakes
- Paying a ransom or hiring vendors before telling the insurer. Prior consent may be required.
- Wiping affected machines without preserving evidence.
- Admitting fault to customers or regulators without legal advice.
- Not documenting costs and downtime, which makes quantification harder.
Related questions
How quickly should I report a cyber incident to the insurer?
As soon as you reasonably suspect an incident that might lead to a claim, and certainly within the time set by the policy. Many policies are claims-made and require notice during the period, with some allowing reports of circumstances. Late notice can reduce or defeat recovery. Keep the hotline number outside your potentially compromised systems, and record when and how you made contact.
Will the insurer take control of the response?
Often the insurer or its broker connects you with a panel of forensic and legal specialists who lead the response under your direction, with costs agreed in advance. You remain responsible for business decisions. Conditions may require cooperation and consent before certain actions. Ask in advance how the process works and whether you can bring in your own provider, so decisions in a crisis are not improvised.
What evidence will I need for business interruption?
Insurers typically ask for accounts, sales records, payroll and cost reports that show the revenue you would have earned and the extra expenses incurred, along with a timeline of the outage. Keep contemporaneous records during recovery. The policy defines the measurement period and what counts as loss, so ask how calculations are made and whether an accountant is appointed to review them.
What if my claim is declined?
Request the decision and the specific policy clauses relied on in writing. Compare them with the wording and your records, then use the insurer's complaints procedure. If unresolved, many jurisdictions offer an independent ombudsman, regulator or dispute service, and some claims need legal advice. Keep deadlines in mind, as complaint rights and legal time limits may be short, and the rules vary by country.
Should I keep a copy of the policy outside my systems?
Yes. If an incident locks you out of email and file storage, you still need the policy number, the claims hotline and the notification terms. Keep a printed copy or a copy on a device that is separate from your main network, and share the emergency contacts with the people who would lead the response. Practising a short walk-through of the first calls reduces delay when a real event occurs and helps meet any notice deadlines in the wording.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- Cybersecurity and Infrastructure Security Agency — US Government, retrieved 27 October 2026
- Information for small and medium sized organisations — National Cyber Security Centre, retrieved 27 October 2026
- Insurance Information Institute — Insurance Information Institute, retrieved 27 October 2026
Related guides
How to choose · Cyber insurance
How to choose cyber insurance for a small business
Cyber policies typically combine first-party cover for your own losses, such as incident response, data restoration and business interruption, with third-party cover for claims from customers or regulators. Compare what triggers each section, the sub-limits and waiting periods, and what security controls the insurer expects. This is general information, not advice on what any business should buy.
Problems & fixes · Cyber insurance
Cyber insurance exclusions and common coverage gaps
Cyber policies commonly restrict cover for war and state-backed attacks, prior known incidents, failures to maintain stated security controls, infrastructure outages, betterment and some forms of fraud. Reading the exclusions and definitions matters more than the marketing summary. Ask how each exclusion works in practice and whether endorsements can narrow it.
Comparison · Cyber insurance
Cyber insurance versus investing in security controls
Insurance transfers some financial loss after an incident, while security controls lower the likelihood and impact. The two are complementary, and insurers often require certain controls as a condition of cover. A sensible comparison looks at which losses you could absorb, which you could not, and which controls reduce both risk and insurance friction. This is general information, not a recommendation.
Problems & fixes · Claims and brokers
What to do when an insurance claim is denied or delayed
Start by getting the decision in writing with the policy clauses relied on. Compare it with your policy wording and evidence, then use the insurer's internal complaints process. If unresolved, many jurisdictions provide an independent ombudsman or regulator route, with deadlines. Keep records of every call and document. This is general information, not legal advice about your claim.
Requirements · Claims and brokers
How to prepare and submit a strong insurance claim
A well-prepared claim reports the loss promptly, protects the property from further damage, records evidence and follows the policy's procedure. Check the wording for notification periods, proof requirements and settlement options. Keep copies of everything and note names, dates and reference numbers. This is general guidance and does not replace reading your own policy or seeking advice.
Problems & fixes · Car insurance
Why car insurance claims get rejected or reduced, and what to do
Motor claims are usually rejected or reduced because of non-disclosure at purchase, use outside the policy terms, unlisted drivers, late notification, exclusions such as unattended keys, or disputes over fault and value. A decision letter must state the reason. If you disagree, you can request a review, supply evidence, then escalate to the insurer's complaints process and an independent ombudsman or regulator in your jurisdiction.
Requirements · Life insurance
What to expect from life insurance medical underwriting
Underwriting is how an insurer assesses your health, lifestyle and occupation to set terms. Expect a questionnaire, possible requests for medical records, and sometimes a nurse visit or tests. Outcomes include standard terms, higher charges for risk factors, exclusions, postponement or decline. Honest, complete answers matter more than any single result, because disclosure errors can undermine later claims.