A cyber incident can quickly become a business crisis, disrupting operations, creating financial losses and raising complex questions about insurance coverage and recovery. In this webinar, professionals representing the broker, insurer, forensic accounting and coverage counsel perspectives discussed how organizations can prepare for and navigate the cyber claims process. 

1. Act Early and Bring the Right Team Together 

The first hours after a cyber incident can shape both the response and the insurance claim. The panel emphasized notifying the insurer and broker early, even when the organization does not yet have complete information. Early communication can help align the appropriate resources, clarify policy requirements and reduce the need to backtrack later. 

• Build insurer and broker notification into the incident response plan. 

• Confirm approved panel vendors and consent requirements before an event. 

• Establish one internal point of contact to streamline communications. 

2. Know What Your Cyber Policy Actually Covers 

Cyber policies are not standardized, and coverage can vary considerably among insurers. A policy should be reviewed in the context of the organization’s operations, technology dependencies and potential losses. The discussion highlighted notice obligations, vendor requirements, sublimits and waiting periods as areas that can create friction during a claim. 

Organizations should revisit coverage after placement or renewal, especially when changing insurers, and refresh their incident response plans to reflect current policy terms and vendor resources. 

3. Cyber Business Interruption Is More Than System Downtime 

In a cyber event, systems may be restored before the business fully recovers. Organizations may still face backlogs, delayed billing, interrupted production or service limitations. A strong business interruption claim therefore requires a clear connection between the technology disruption, operational effects and financial results. 

• Track when critical systems return and when normal operations resume. 

• Distinguish revenue that is permanently lost from revenue that may be deferred or recovered later. 

• Document extra expenses incurred to reduce or avoid further loss. 

4. Third-Party Dependencies Deserve Attention 

An organization can experience a significant loss even when the cyber incident occurs at a technology provider, supplier or other critical third party. The panel discussed the growing importance of dependent business interruption coverage and the need to understand how a policy defines covered providers, triggering events and applicable waiting periods. 

Preparing Before an Incident 

The central takeaway was that preparation can make the claims process more coordinated and effective. Organizations should review their cyber policy, update and test incident response plans, understand the insurer’s process, identify key response partners and prepare finance and operations teams to document a potential loss.

Featured Speakers:

• Peter Halprin, Haynes Boone
• Valentino Papa, RCM&D
• Matt Murphy, ANV/AmTrust Cyber
• John Petzold, Insurance Claims and Recovery