Cyber insurance for CISOs: what the policy actually does

TL;DR: Cyber insurance is risk transfer with strings: it converts an uncertain catastrophic cost into a known premium, but the application is a warranty, the exclusions are load-bearing, and the claim process has rules that bind your incident response. The CISO's job is to know the policy before the incident — because during one, it quietly becomes the operating manual.

What does the coverage actually consist of?

Two halves. First-party: the insurer pays your own costs — breach counsel, forensics, notification and credit monitoring, data restoration, business-interruption losses, and, where lawful and covered, extortion-related costs. Third-party: defense and liability for claims by others — customers, partners, and regulatory proceedings, subject to what regulators in each jurisdiction allow to be insured. The practical fine print: sub-limits (the ransomware sub-limit is often a fraction of the headline), waiting periods on business interruption, and panel requirements — many policies require using the insurer's approved IR firms and counsel, which is why the retainer you signed independently needs to be on their panel or pre-approved.

Why did underwriting get hard?

Loss ratios. Ransomware turned cyber into a paying line of business for claimants, and insurers responded the only way they can: control requirements. Modern applications ask pointed questions — MFA on email, remote access, and privileged accounts; EDR coverage; offline or immutable backups; patch cadence; IR plan testing. Two consequences for CISOs. First, the application is a warranty: an inaccurate "yes" on MFA coverage can surface at claim time as grounds to contest. Answer precisely, with denominators. Second, insurers became an unlikely ally: "the carrier requires it" now funds controls that internal argument couldn't — a lever worth using deliberately.

Which exclusions bite?

The recurring ones: war and state-backed activity (heavily litigated after NotPetya-era claims; modern policies use more precise nation-state language — read yours), failure to maintain stated controls, prior known incidents, sanctions-related payment prohibitions, and infrastructure/utility failures. None of these is a reason to skip coverage; all are reasons the CISO, not just procurement, reads the policy.

How should the CISO operationalize the policy?

Four practices. Pre-incident: put the carrier's claim hotline, panel list, and notice deadlines into the IR plan itself; late notice is a self-inflicted coverage problem. During: call the carrier early — engaging non-panel responders without approval can turn covered costs into uncovered ones. Annually: re-answer the application questions honestly with the current environment and reconcile drift before renewal, not at claim time. Strategically: treat the premium as one of the three prices of every major risk (reduce, transfer, accept) in the budget conversation. Insurance doesn't reduce the likelihood of a bad day; it changes who funds it — and only if the paperwork was honest and the process followed.