Everything to Know About Cyber Risk Insurance
.png)
DPO Consulting Joins Grant Thornton
Summary
Cyber insurance is a contract that absorbs the losses and costs generated by an IT incident, from the technical response through to the legal and commercial fallout. It does not replace security, it absorbs the residual cost when the controls in place proved insufficient.
Two French specifics change how a policy should be read, and they are missing from most content available online. The first is the obligation to file a complaint within 72 hours in order to trigger indemnification. The second is the uninsurability of administrative sanctions, which places GDPR fines outside the scope of any policy.
Cyber insurance is cover dedicated to risks affecting information systems and data. It generally combines three blocks, incident response costs, the losses suffered by the insured business itself, and liability towards third parties whose data or services were affected.
It differs from conventional professional indemnity on one decisive point. Professional indemnity compensates damage caused to third parties, it does not cover the company's own losses, technical forensics or the rebuilding of an information system. Dedicated cyber security insurance exists precisely for those items.
Covers vary between contracts but the structure is stable. Four blocks appear in almost every policy on the market. The table below sets out what is usually included and what to check before signing.
This first block funds the immediate response, forensic investigation, containment, restoration, legal support and crisis communication. It also covers notification to affected individuals where Article 34 of the GDPR requires it, an item that becomes very expensive once the number of people runs into tens of thousands.
This block addresses damage suffered by the insured, destruction or corruption of data, system rebuilds and expert fees. Ransom payment remains a permissible cover under French law, confirmed in principle by the law of 24 January 2023, but it is always optional and strictly conditioned. Cyber attack insurance that mentions ransom without spelling out those conditions deserves close reading.
Business interruption is often the heaviest item. The cover compensates lost margin during downtime, over an indemnity period defined in the contract and after a waiting period expressed in hours. That waiting period, commonly eight to twenty-four hours, decides whether a short outage is compensated at all.
This block funds the company's defence, including before a supervisory authority, procedural costs and any damages owed to third parties. Defence costs before the CNIL are insurable, the sanction handed down at the end of that process is not, a distinction developed further below.
Exclusions determine the real value of a contract. They bite less on exotic events than on ordinary ones, known and uncorrected security gaps above all. The table below lists the exclusions most often found in the French market.
Policies classically exclude acts of war and state action, failures of public infrastructure such as a widespread power outage, wear and obsolescence of systems, and purely intangible loss of value such as a share price fall. The cyber war clause has become a negotiation point, since its drafting varies sharply between insurers.
This is the exclusion that generates the most disputes. If the company declared at underwriting that it had multifactor authentication, tested backups or a patching policy, and the incident shows otherwise, the insurer can reduce or refuse cover. The risk declaration is binding, it is not an administrative formality.
Intentional or wilful misconduct by the insured is uninsurable under French law, in line with Article L. 113-1 of the insurance code. A malicious act by a director therefore leaves the company exposed. Internal fraud committed by an employee usually falls instead under a specific cover, bought separately.
Beyond named exclusions, three parameters cap the real recovery, the overall limit, the sub-limits per cover and the deductible. A policy showing a high headline limit can carry a very low sub-limit on business interruption or on ransom. Read the sub-limits before the headline limit, that is where effective cover is decided.
Covers fall into two families, those indemnifying the company's own damage and those covering its liability to third parties. Most contracts combine both, in very uneven proportions depending on whether they target a mid-sized business or a large group.
Cyber risk insurance addresses scenarios with proven frequency, not theoretical threats. Four families of incident account for most declared claims, ransomware, business email compromise, data breach and downtime caused by a supplier.
Supplier dependency deserves particular attention when sizing cyber risk insurance. An incident at a hosting provider or SaaS vendor can halt operations without any internal system being attacked. Cover for that scenario, known as contingent business interruption, is not automatic. Our guide to third-party risk management (TPRM) sets out the mapping to produce beforehand.
The most misunderstood point on this topic fits in one sentence, a CNIL fine is not insurable in France. The Autorité de contrôle prudentiel et de résolution stated in a communiqué of 18 March 2025 that public policy prevents fines of any nature, or any monetary sanction imposed by an administrative authority, from being covered by insurance, and that any contractual clause providing for it would be null and void, subject to assessment by the courts.
What a policy can absorb around a sanction remains substantial. Defence costs before the CNIL, legal support, technical investigation, notification to affected individuals and third-party compensation claims all sit within standard covers. The fine itself stays with the company.
A second French obligation shapes the relationship with the insurer. Article L. 12-10-1 of the insurance code, created by the law of 24 January 2023 and applicable since 24 April 2023, makes indemnification conditional on filing a complaint with the competent authorities within 72 hours of becoming aware of the attack. That clock runs alongside the Article 33 GDPR notification clock, it does not replace it. Our article on personal data breaches and CNIL notification requirements sets out the full sequence.
How the first hours are handled determines how much is actually paid. Four stages structure a claim, and two of them are bound by a strict deadline. Teams improvising at this point lose cover through procedure alone.
Notify the insurer or broker on detection, before the incident has even been qualified. Most contracts impose a short notification deadline and the use of approved providers. File the criminal complaint within 72 hours, failing which indemnification can be refused under Article L. 12-10-1.
The investigation establishes the entry point, the extent of compromise and the data involved. Preserve logs and disk images before any restoration, because a system brought back too quickly destroys the evidence the insurer needs to assess the claim. A tested data breach response plan makes this reflex automatic.
Most policies require using providers on the insurer's panel, or obtaining prior agreement before engaging a third party. Engaging your own provider without approval risks the fees being refused. Our guide to cybersecurity incident response describes the roles to define before anything happens.
Business interruption has to be demonstrated, not declared. Management accounts, revenue history, evidence of lost orders and of additional costs incurred make up the file. Companies already holding those records are paid faster and more fully.
A useful policy is prepared before underwriting and maintained afterwards. Four practices separate a contract that pays from a contract that argues. All of them concern evidence, because evidence is what the insurer will examine.
A risk assessment serves twice, to prioritise controls and to complete the underwriting questionnaire accurately. An inaccurate declaration weakens the cover. Our cybersecurity risk assessment guide sets out the scoring method expected.
Multifactor authentication, patch management, segmentation, monitoring and awareness form the baseline insurers check. What counts is not having them, it is being able to prove they were in place on a given date. A written and applied cyber security policy is that proof.
Isolated and tested backups have become an underwriting criterion in their own right, because they directly reduce the cost of a ransomware event. A documented restore test twice a year carries more weight in a premium negotiation than any statement of intent.
Re-read the contract each year against how the business has actually changed, new online services, new critical suppliers, new data volumes. Limits set three years ago rarely match today's revenue. NIS2 also widens the set of entities carrying security obligations, which our article on ISO 27001, NIS2 and DORA covers in detail.
DPO Consulting is neither an insurer nor a broker. The support covers what insurers require and what a company must be able to prove, documented security controls, processing mapping, breach procedures and GDPR compliance. That work determines both access to cover and its price.
To establish your security position objectively before underwriting or renewal, start with security audit services. Where the insurer's questionnaire touches personal data, a GDPR compliance audit completes the file. You can also talk to an expert at DPO Consulting before answering an underwriting questionnaire.
Compare sub-limits and deductibles first, then the overall limit, then the assistance services. Check contingent business interruption cover, the waiting period on business interruption and the drafting of the cyber war clause. A cyber insurance quote is only comparable against identical covers and sub-limits.
Requirements for cyber security insurance converge on a baseline, multifactor authentication on remote access and privileged accounts, isolated and tested backups, patch management, log monitoring, staff awareness and an incident response plan. Some insurers additionally ask for a recent audit or penetration test.
The premium depends on revenue, sector, the volume and sensitivity of data processed, the maturity observed and the covers selected. It is built file by file. The same company profile can receive very different cyber insurance quote outcomes depending on the quality of evidence supplied at underwriting, which is what makes preparation pay.
A policy includes incident response costs, data restoration, business interruption, third-party liability, defence costs before authorities, and in some contracts cyber extortion. Assistance services and the panel of approved providers are an integral part of the contract.
Cyber attack insurance covers the consequences, investigation, rebuild, business interruption and negotiation. Payment of the ransom itself is an optional cover, whose insurability was confirmed in principle by the French law of 24 January 2023, subject to filing a complaint within 72 hours. Not every policy offers it.
Yes. Investigation costs, notification to affected individuals, legal support and third-party compensation claims fall within standard covers. The number of people affected is the main cost driver, which makes data minimisation directly profitable.
Not in France. The ACPR stated in March 2025 that public policy prevents a monetary sanction imposed by an administrative authority from being covered by insurance, and that a clause to the contrary would be void. Defence costs before the CNIL remain insurable, the fine does not.
The expected baseline covers multifactor authentication, isolated and tested backups, patch management, log monitoring, awareness training and an incident response plan. These have to be documented and dated, since an unsupported declaration exposes the company to reduced cover at claim time.
Yes, subject to the waiting period and indemnity period set in the contract. Compensation applies to lost margin, not to revenue. Contingent business interruption, where downtime comes from a supplier rather than your own systems, has to be checked separately.
For an organisation with no internal security team, the value lies as much in the services as in the pay-out. Immediate access to a crisis unit and to vetted responders is often worth more than the headline limit. The calculation rests on how many days of downtime the business can absorb, not on its size.
.png)
.svg)
.png)
%20(1).png)
