Reviews
Part of Cyber insurance splits into two halves most buyers never separate
5 points on cyber insurance rules that matter
Cyber insurance rules sit in three rulebooks: your data, your sector, the policy. This page names the offices that hold each one, not their contents.
What to take away
- Three rulebooks decide what a breach costs you, and no single office holds all three.
- State breach notification law follows the residence of each affected person, not your business address. The enforcing office is usually the attorney general.
- Sector rules come from named bodies. Health data runs through the HHS Office for Civil Rights, financial data through the FTC and banking regulators, card data through the networks and your acquiring bank.
- Your state insurance department licenses carriers and brokers. It does not rule on what your policy wording means.
- Typical state deadlines run 30 to 60 days from discovery. Regulator notice often starts at 500 or 1,000 affected residents. Confirm both, state by state.
The three rulebooks, and who holds each one
The phrase cyber insurance rules hides three sets of obligations. One covers your data. One covers your sector. One covers the contract you bought. Different bodies wrote each, and each has its own enforcement route.
- Data rulesstate breach notification statutes, usually enforced by the attorney general.
- Health datathe HIPAA rules, run by the HHS Office for Civil Rights, which keeps its own breach reporting portal.
- Financial datathe FTC Safeguards Rule for many non-bank lenders and advisers, state banking and securities regulators, and the SEC for public companies.
- Card datathe PCI DSS standard, written by the PCI Security Standards Council and enforced through your acquiring bank as a contract term.
- Policy rulesyour state department of insurance, headed by a commissioner, superintendent or director.
- Sanctionsthe Treasury's Office of Foreign Assets Control, relevant when a ransom is paid.
Find the office by state through the federal state attorney general directory. Most publish the notification duty and a reporting form on the same page.
Panel counsel at the insurer usually runs this analysis in the first days after an incident. What the insurer must approve before counsel is appointed is where the two halves of a cyber program divide.
What state laws actually require
The table gives typical ranges, not a citation for any one state. Check each row against the statute where your affected people live.
What state laws require
Typical requirement
- Deadline after discovery
- Without unreasonable delay, with 30 to 45 days as the common outside limit
- Who is told
- Affected residents and the state attorney general
- Consumer reporting agencies
- Notice when many residents of that state are affected
- What the notice says
- Date of the incident, data elements involved, a contact point
- Regulator format
- A published online form
Where states diverge
- Deadline after discovery
- A few states allow 60 days, and some set a shorter clock for agency notice
- Who is told
- Regulator notice sometimes starts only above 500 or 1,000 residents
- Consumer reporting agencies
- The trigger count and the timing differ
- What the notice says
- Some states require credit monitoring or a fixed heading
- Regulator format
- Some take email, others require a portal account
State breach notification laws vary
| What varies | |
|---|---|
| Personal information | What counts |
| Incident | What counts |
| Who must be told | Affected people |
| How quickly | Timing rules |
| Regulator notice | Whether required |
Definitions do most of the work. Most states count name plus Social Security number or driver's license number, and many add username or email plus password. A growing number add biometric data.
CISA publishes federal guidance on cyber threats and response. Little of it binds a private employer, yet underwriters read it and application questions repeat it. Those questions drive the price, as set out in how a cyber premium is built.
What a cyber policy covers, and what it leaves out
Typical cover: forensic investigation, breach counsel, notification and call center costs, credit monitoring, extortion payments where law allows, business interruption during the outage, data restoration, and defense of third-party claims.
Typical exclusions: fines that state law bars from insurance, incidents known before inception, and failure to keep the security controls the application promised. Unencrypted portable devices, reputational loss, and outages caused by a utility or cloud provider failing also drop out.
Funds transfer fraud and social engineering usually sit in a separate endorsement. The exclusions argued at claim time are collected in cyber insurance mistakes operators still make.
Example: one payroll processor, three states
This example is hypothetical, not a client file. A 40-person payroll processor holds health plan data for one client group, with affected people in Texas, Ohio and California.
- Texas residentsnotify the Texas attorney general. Texas allows consumer notice up to 60 days from discovery.
- Ohio residentsnotify the Ohio attorney general. Ohio sets a 45-day limit for consumer notice.
- California residentsnotify the California attorney general once 500 or more residents are affected. California sets no fixed day count and asks for notice without unreasonable delay.
- Health plan data: report to the HHS Office for Civil Rights within 60 days when 500 or more people are affected.
- Card datareport to the acquiring bank on the network timetable, a contract duty rather than a statute.
- The policythe Ohio Department of Insurance licenses the carrier, and surplus lines placements go through a licensed surplus lines broker in that state.
Six entries, six desks. Where those entries sit next to the renewals calendar is the subject of the renewal record guide.
Common questions
Is there one federal breach notification law for every business?
No general one. Federal rules cover named sectors, health and financial services among them. For most businesses the duty sits in state law, sometimes with a federal rule layered on top.
Does my policy satisfy my notification duties?
No. The policy pays for the response and the liability. The duty to notify, secure data and report to regulators stays with you.
Who do I complain to if the insurer mishandles a claim?
The consumer services division of your state department of insurance handles conduct such as delay or misstatement. A dispute about what the wording means goes to a lawyer who reads policies in your state.
What changes for a Canadian operation?
PIPEDA requires reporting to the Privacy Commissioner of Canada when a breach creates a real risk of significant harm. Alberta, British Columbia and Quebec add provincial rules. Federal insurers are supervised by OSFI.
