Cyber Insurance and Incident Response: What to Do Before You Claim

Cyber insurance can be the difference between a bad week and a business-ending event. But a policy only pays out if you use it correctly, and the mistakes that reduce or void a claim are almost always made in the first few hours of an incident, by people acting fast and in good faith. Knowing your policy before you need it is one of the cheapest forms of protection there is.

This guide explains what to do, and what to avoid, so that your cyber insurance actually helps when the time comes. It is a companion to our full cyber incident response plan guide and pairs with our cyber insurance readiness guide.

Read your policy before there is an incident

The single most useful thing you can do is understand your policy while everything is calm. Cyber policies vary enormously, and several common terms directly affect how you should respond:

• Many policies require you to notify their incident line early, sometimes within a set number of hours of becoming aware.
• Many require you to use their approved responders (an incident-response panel), and engaging your own help first can reduce or invalidate cover.
• Some have conditions about preserving evidence, not paying a ransom without consent, or not admitting liability publicly.

Write the incident line number and policy number on your offline emergency contact sheet, so it is to hand when your systems are not.

What to do in the first hours

• Start your incident log immediately. Insurers expect a clear, timestamped record of what happened and what you did.
• Check your policy’s notification requirement and, if it applies, call the insurer’s incident line early, often before engaging anyone else.
• Follow their instructions on which responders to use.
• Preserve evidence rather than wiping or “cleaning” systems, because it supports both recovery and the claim.
• Do not open communication with an attacker, or make any payment, without your insurer’s involvement where the policy requires it.
• Avoid public statements that admit liability before you understand what happened.

What insurers expect you to have in place

Increasingly, insurers do not just pay out, they expect you to have basic controls in place as a condition of cover, and they may ask about them at claim time. Common expectations include multi-factor authentication on key accounts, tested backups, endpoint security, a patching process, and staff awareness. If you attested to having these when you took out the policy, make sure you actually do. A gap between what you declared and what you had can become a problem when you claim. Our cyber insurance readiness guide covers what insurers typically look for.

Keep the evidence a claim needs

A claim is supported by evidence: your incident log, what was affected, what it cost, and what you did to contain and recover. The free Cyber Incident Response Toolkit includes an incident log and evidence register that make this straightforward, and our guide to preserving evidence explains the basics. Good records help you recover faster and claim more smoothly.

Frequently asked questions

Related reading: the full Cyber Incident Response Plan guide, the Cyber Insurance Readiness Guide, and the free Cyber Incident Response Toolkit.