You have a cyber insurance policy, and something just happened.

Find the notice terms first

1. Get the full policy and its declarations page, not only the certificate.
2. Find the section on notice or reporting. It names who receives a notice and how: a hotline, a claims email address, a portal, or a mailing address.
3. Check whether the policy says notice to your broker counts as notice to the insurer. A law firm’s guide on notice disputes warns that notice to a broker alone may not count unless the policy says so, and that notice generally has to come from the policyholder directly.
4. Look for the deadline. Some policies set a specific number of days. Many say “prompt” or “as soon as practicable,” and the same guide recommends reporting promptly whatever the wording.

What the first notice says

The first notice describes the matter with what is known at that moment, enough for the insurer to start its own work. It does not need a finished investigation. That law firm’s guide says the description should be reasonable, based on what you know, and that first-party coverage is often triggered by discovery or awareness of an incident.

Write down, before you call, what you know and when you learned it: who noticed first, what they saw, which computers or accounts, and any message or note involved. Keep the notice itself as a record: the date, who received it, and what you sent.

If you do not yet know whether the cause is a stolen password, a forged message, or a locked computer, say that. “We are still determining the cause” is an accurate first notice, and it can be updated as the facts come in.

Before you hire or pay anyone

The same guide notes that legal fees incurred before notice may not be covered, or may not count toward the retention, which is the amount you pay before coverage begins. Policies also differ on forensic firms, negotiators, and other vendors. Look in yours for any language about approved vendors, prior consent, or payments you make on your own, and read it before you sign with anyone or answer the attackers.

CISA’s ransomware guidance lists your cyber insurance company among the stakeholders to engage. It is one of the first calls, not a step at the end.

Claims-made policies and late notice

Many cyber policies are claims-made, meaning they cover claims first made during the policy period. The law firm guide reports that courts treat late notice differently: some require the insurer to show it was harmed by the delay, and others enforce claims-made notice terms strictly. That is a question for your attorney or your broker, and it is one more reason the notice goes out early.

What the technical work and the claim have in common

A claim is usually a record of what happened and what it cost. The FTC’s breach guide says not to destroy forensic evidence during investigation and remediation, and to document the investigation, including interviews with the people who found the problem. Reinstalling a computer before anyone has taken a copy of it can remove the record the insurer and the investigators will ask for. The page on keeping evidence covers what to hold off on.

The insurer may also have its own requirements about who does the technical work. Ask before you start, not after.

Keep your own copies of anything the insurer sends you or asks you to sign, along with the name of each person you spoke to. Claims often turn on who was told what, and when.

The one line to keep

The policy decides what the insurer will pay for, and its notice terms are easiest to meet when someone reads them on the first day.

Related

• Who to Tell After a Security Incident, and in What Order
• Keeping Evidence Before You Clean Up a Computer
• Ransom Note on the Screen: What the FBI Says About Paying
• Cyber Insurance Application Questions You Can’t Answer

Sources

• Reed Smith: Best practices for avoiding notification disputes in cyber liability (and other) insurance policies
• CISA: I’ve Been Hit by Ransomware
• FTC: Data Breach Response, A Guide for Business