How to review a cyber insurance policy: application, business changes, three numbers

Put two documents on the desk: the application you signed last year, and a blank sheet. The review of a cyber policy is the act of re-answering every question on the first document onto the second, from evidence rather than from memory, and then reading what changed.

That is different from reviewing any other policy in your file, because in this line the application is not a formality. It is the description of your business that the insurer priced, and it is the description the insurer will hold you to. If it has drifted from the truth, the policy has drifted from you.

What to take away

Part one: the application, re-answered

Work through it question by question. For each control the form asked about, write down whether it is in place today, who confirmed that, and how.

Anything that was "yes" last year and is "not sure" this year is a finding. It may need fixing before renewal, and it may need telling the broker regardless, because the wording may treat a declared control as a condition.

Part two: what the business did this year

The exposure the premium was built on has a shape, set out input by input in how a cyber premium is built, and the shape moves.

Data. New categories of personal, financial, or health-related information; larger volumes; new states whose residents are represented. Each changes notification exposure, and the state attorney general publishes the requirement for people who live where you are.

Systems. New platforms, new integrations, systems retired, anything moved to or from a cloud provider.

Vendors. Anyone whose outage would stop you trading. The dependent business interruption provision only helps with vendors the wording contemplates, and the broker cannot ask about vendors you have not listed.

Contracts. Customers increasingly write security obligations and insurance requirements into their terms. Pull the ones signed this year and compare what they require with what the policy provides.

Incidents. Anything that happened, however small, including near misses and events reported to nobody. Prior-knowledge provisions make undisclosed circumstances a problem later.

Part three: the wording, three numbers

You are not rereading the whole policy. You are checking three things against the business you have just described.

The sub-limit table. For each head of cover, the ceiling that actually applies. If funds transfer fraud is now your largest realistic loss and its sub-limit is small, that is the renewal conversation.

The waiting period. How long an outage must last before interruption cover engages, set against how long you could actually trade on paper.

The retroactive date. How far back the policy reaches. It should not have moved forward at any renewal, and if you are considering a new insurer it should be matched in writing.

Alongside those, glance at what the wording says about consent and the panel, and at any exclusion that has been added by endorsement since last year. The mechanics of each are explained in the overview of the line.

Part four: the letter to the broker

Send the findings, not a question.

A licensed broker with those facts can say exactly what the market will do with them. A broker asked "is everything fine" can only say how they feel.

Your state insurance department is the body you ask about licensing for any proposed insurer and about complaints if a claim was handled badly. It does not rule on what a wording means.

The same discipline applied across the whole program, and the reason the declarations page outranks every summary of it, is in the renewal reading guide. Where trade shapes what the application asks, the reasoning is in the industry guide.

Common questions

How long should this take?

An afternoon the first year, because you are building the evidence trail. Less after that, because you are comparing against last year's sheet.

Who should re-answer the technical questions?

Whoever actually runs the systems, with the person who signs the application reading their answers. The signature is a representation by the business, so the business should know what it is representing.

What if a control was off for part of the year and is back on now?

Tell the broker, with dates. What the wording says about a lapse is the question, and it is better asked before a claim than during one.

Should I get more than one quote at renewal?

Yes, and compare them on the sub-limit table, the waiting period, and the retroactive date before the price. A cheaper quote that moves the retroactive date forward has excluded a period of your history.