Cyber insurance readiness: what underwriters ask and why the clock matters

Cyber insurance is often described as cover for hacking. It is more accurately cover for the cost of responding to an incident - forensics, legal advice, notification, restoration, business interruption and third-party claims - most of which arrives in the first fortnight and none of which was budgeted for.

The regulatory clock

India's national computer emergency response team requires entities to report qualifying cybersecurity incidents within six hours of noticing or becoming aware of them. That is among the shortest mandatory reporting windows anywhere, and it means the response has to begin before the organisation has fully understood what happened.

Where the incident involves personal data, obligations under the data protection framework apply in addition - notification to the regulator and to affected individuals without delay. These duties sit alongside each other; satisfying one does not discharge the other.

Six hours is not long enough to decide who to call. It is only long enough to call the people you decided on earlier.

What the cover does

First-party costs: forensic investigation, legal advice, notification to affected individuals, credit monitoring, public relations, data restoration and system recovery, and business interruption while systems are down. Extortion cover for ransomware, including negotiation specialists.

Third-party liability: claims by customers, partners or others whose data was compromised, and defence costs for regulatory proceedings. Some policies cover certain administrative penalties where insurable by law, which varies and should be checked rather than assumed.

What underwriters now expect to see

Multi-factor authentication on email, remote access and privileged accounts. This has become close to a precondition rather than a discount item. Endpoint detection and response across the estate. Offline or immutable backups, tested by actual restoration rather than by the backup job reporting success.

A patch management process with defined timelines. Network segmentation so that one compromised machine does not reach everything. Security awareness training with phishing simulation. A written incident response plan naming individuals and external contacts.

Vendor due diligence, which is increasingly where the exposure sits. A large share of incidents reach organisations through a supplier or a service provider rather than directly.

Where claims get complicated

Late notification. Cyber policies typically carry strict notice provisions and an incident discovered on Monday and notified the following month is a problem. Misrepresentation on the proposal form - describing controls that were planned rather than implemented - is the other common difficulty.

Social engineering and funds transfer fraud are frequently sub-limited or excluded from the base wording and need to be specifically added. Given how common invoice fraud has become, this is worth checking on any existing policy.

Practical preparation

Write the incident response plan and store it somewhere reachable when the network is not - printed, or on a phone. Put the insurer's cyber hotline in it. Know in advance which forensic and legal firms your policy will accept, because using a provider outside the panel without consent can affect recovery.

Then rehearse it. The gap between a company that has run a tabletop exercise and one that has not is measured in exactly the hours the regulation gives you.