Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management

Edge Ask The Experts

9/23/2019
01:30 PM
Edge Editors
Edge Editors
Ask the Experts
3 comments
Comment Now
50%
50%

How Can I Ensure Cyber Insurers Will Pay My Claim?

To get the best out of your policy, do more than just sign on the dotted line.

Question: I bought cyber insurance, but I still worry. If I experience a breach or other security incident, how will the cyber insurance company be likely to weasel out of paying my claim? 

Jeff Wichman, practice director, enterprise incident management at Optiv: In most cases, your cyber insurance company isn’t going to weasel out of paying a claim. My advice is to be prepared! 

Your provider is going to have a specific process/requirement for engaging with them and outside resources for an incident. Follow that process, and take these steps to be better prepared: 

  • Validate with your provider that your preferred partner is approved as either an on-panel or off-panel firm you can work with.
  • Update your incident response plan to include when and how to engage with your claim process. Now is the time to start building that into your documents.
  • Test, test, test your incident response processes using an applicable scenario-based exercise with your trusted third party. This can help you identify gaps in your efforts.

Do you have questions you'd like answered? Send them to [email protected].

Related Content:

 

The Edge is Dark Reading's home for features, threat data and in-depth perspectives on cybersecurity. View Full Bio

Comment  | 
Print  | 
More Insights
Webcasts
More Webcasts
White Papers
More White Papers
Reports
More Reports
Comments
Newest First  |  Oldest First  |  Threaded View
Richard F.
50%
50%
Richard F.,
 User Rank: Apprentice
3/10/2020 | 1:31:40 PM
Cyber Insurance Uncertainties and Concealed Traps
Cyber insurance is fraught with serious problems.  There is no standard coverage language in the policies.  Buyers are required to understand arcane terms, sublimits and exclusions. Of course, you have actually read and fully understand every word and comma of your potential policy????? 

Worse, the policies have numerous concealed traps.  Many policies require expensive arbitration of coverage disputes.  Even if your states' law prohibits arbitration of insurance disputes, federal courts, law and treaties can override the McCarran-Furguson Act and force Buyers to have claims decided by foreign arbitrators in London, Geneva, Paris or Hamilton. If the Buyer is lucky, the surprise required arbitration may be in New York. All of those venues are at the expense of an already damaged company needing prompt payment.

Some insurers try to force insurance industry dominated arbitrators onto Insureds by policy provisions requiring specific arbitration administrators, of course to "ensure "quality" Neutrals." Those include by reference use of their associated over-restrictive, incestuous "repeat player" favoring arbitrator panels. 

Different federal circuits and state courts have interpreted the same language differently. Provisions that have been interpreted by courts as granting coverage in some circuits and states exclude coverage for the same risks in other circuits and states.   

It is critical that Buyers obtain expert advice from lawyers and brokers.  Or risk joining Mondelez and other companies fighting to obtain the coverage they thought they had purchased.

Richard Faulkner, J.D., LL.M., F.C.I.Arb.
mcavanaugh1
50%
50%
mcavanaugh1,
 User Rank: Strategist
10/15/2019 | 7:57:37 AM
Re: Cyber Insurance claim
To confirm, most of the claims declined and firms that are suing their insurer attempted to file a claim under a non-cyber policy.  Mondelez is the case most reference however they tried to get coverage under their Property Insurance policy after refusing to purchase a Cyber policy for years.  Also, the declination was under the War Exclusion.

There is a lot of misconception as to what is covered, is not coverage, how it is covered, and what needs to be done to obtain coverage. This is partly the fault of the insurance industry as each Cyber policy is different with varying coverage, underwriting, and requirements. Most long-standing insurance companies writing Cyber Insurance do not require constant updating or any sort of updating outside of what an insured puts on an application.  The most important factor is to work with an agent/broker/carrier that is knowledgable in this space and up to date on the emerging risks to ensure that a policy is placed with the best carrier for the specific company.  There is no "best policy" or "best carrier" in the marketplace only the best carrier for the specific insured.
renglish98
50%
50%
renglish98,
 User Rank: Apprentice
9/26/2019 | 9:21:25 AM
Cyber Insurance claim
The answer is not as striaghtforward as one would think. After notPetya, several firms had to sue their insurers who refused to pay the cyber claim as they argued that it was a state-sponsored attack and exempted via a force majeur clause.

Similarly, customers need to be constantly patching and remediating vulnerabiliies to demonstrate they are performing 'due care' and not unreasonably exposing their firm to cyber risk, which could be a claim denial justification.
Name That Toon: Holy Cow!
Flash Poll