Cyber- Insurance & Some Crucial Time Elements

Another thing to keep in mind is that all–or virtually all–cyber insurance policies are so-called “claims made” policies.  They fall into the pattern of D&O and professional malpractice policies to be found in the so-called “real world.”   What is important is that all so-called “claims made” policies may have three very significant time elements in addition to policy limits.

In both “worlds,” the phrase “claims made” is often a misleading metaphor.  A more general characteristic, which changes the policy radically, and which an insured needs to watch out for is a two or three-component “claims made” period; significantly the components are all different.
 
The first one requires that the relevant covered “wrongful act” be performed during a specified length of time; often this is during the policy period; though sometimes, by agreement and an additional fee, it can be provided during a retroactive extension period; the existence of this period will usually be found on the dec sheet, though it can be found in an endorsement, for example, if it is purchased after the original purchase of the basic policy. Under some circumstances, this component can cover some sections of a liability claim. 
 
The second one is the actual “claims made” component; this is a covered claim made against the policyholder; consequently, it is to be found in liability policies, not first party-policies, so far as I know.  The specified time for when a covered claim may be made can be extended both backward and forward in time. 
 
The third component is the “claim reporting” requirement.  This is the time period during which the insured must report a claim to the insurer including any claim made against it during the specified periods.  Cyber policies are new, and there is virtually no authority as to their potentially controversial meanings. From the point of view of coverage analysis, this is a new and relatively uncharted ocean. Conjecture and even guesswork are required. 

 
 In addition, it usually must also be done within a reasonable period of time, and this is described as “as soon as practicable.”  If one were to look at phrases that are paradigmatically vague, this is one of them. It certainly does now and will in the future generate lots of controversies.
 
Again, like the other components, this requirement is for liability policies. It too can be extended. These time limits can be ironclad. 
 
To be a covered claim, the following must be considered: (1) whether the insured received service of a lawsuit claim is required within a specified period of time; (2) whether the insured has received a demand or announcement letter (but not the lawsuit yet), and (3) whether the insurer has a reasonable belief that (1) or (2) might well happen.  #(1) is invariably a necessary condition for coverage; #(2) is usually to be found in policies, and #(3) is also to be found in policies. 
 
The insurance purchasing department of the insured company should make sure that those who handle risk management know this, and that all relevant management personnel is made aware of the pertinent provisions of these contract requirements. It does not matter whether they are actually there. Relevant personnel should watch all problematic acts or omissions in the company for signals of potential coverage problems. 

The above discussion has concerned the time requirements required by the insurance contracts. Naturally, first-party policies have some similar requirements. Often the word “claim” is used in this context.  It has a different meaning.  In this context, a claim concerns the damage or potential damage to which the insured itself has or will be subjected. Its causes may involve the conduct of the insured, the conduct of others, damages caused (or to be caused by nature), simply adverse luck, or a combination of some or all of these. Of course, these claims must be made within specified time periods, often the policy limits and they can include damage already occurred, or the reasonable concern that damages might occur in the future as a result of actions, omissions, or events that have occurred.