--- id: CP-385 slug: cyber-insurance-requirements-claims lang: en title: Cyber insurance description: "What cyber insurance assumes of employees and management: offline backups, multifactor authentication, first steps and reporting." canonical_url: https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/ markdown_url: https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Cyber insurance", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/ (CC BY 4.0) wing: 6 theme: safeguard_data reflex: cr-063 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/ fr: https://startbrain.io/cyberpedia/fr/articles/assurance-cyber-prerequis-sinistre/ de: https://startbrain.io/cyberpedia/de/articles/cyberversicherung-voraussetzungen-schadenfall/ es: https://startbrain.io/cyberpedia/es/articles/seguro-ciber-requisitos-siniestro/ sources: - "n": 1 title: "#StopRansomware Guide | CISA" publisher: CISA url: https://www.cisa.gov/stopransomware/ransomware-guide accessed: "2026-11-03" - "n": 2 title: Pourquoi et comment bien gérer ses sauvegardes ? publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/sauvegardes published: "2019-11-13" accessed: "2026-11-03" - "n": 3 title: More than a Password publisher: CISA url: https://www.cisa.gov/MFA accessed: "2026-11-03" - "n": 4 title: Multi-factor authentication for your corporate online services publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services published: "2024-09-26" accessed: "2026-11-03" - "n": 5 title: Incident management publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/incident-management published: "2019-09-19" accessed: "2026-11-03" - "n": 6 title: Notifier une violation de données personnelles publisher: CNIL url: https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles published: "2018-05-24" accessed: "2026-11-03" - "n": 7 title: Cybersecurity Framework publisher: NIST url: https://www.nist.gov/cyberframework accessed: "2026-11-03" --- # Cyber insurance Cyber insurance is a contract that a company takes out to deal with the aftermath of a cyberattack. For an employee, it usually stays invisible until an incident happens: the insurer may be among the people to notify, along with the IT department and the managers concerned [1]. The sources cited here are public guides on security and incident handling. None of them describes the content of an insurance contract: not the cover (crisis costs, data restoration, business interruption losses, civil liability), not the exclusions, not the conditions set by any particular insurer. This entry therefore does not detail them. It presents what these sources say about the security measures an insurer may ask for and the steps to take during an incident. The actual conditions are found in the company's contract. ## In 30 seconds - Where it happens: during a ransomware attack, a data leak or an attack that hits the company's systems, where the list of people to inform may include the cyber insurance company [1]. - What the attacker wants: many ransomware variants look for accessible backups in order to delete or encrypt them [1]. - The reflex: turn on two-factor authentication and do not leave a backup permanently plugged in, then follow the company's response plan if an incident occurs [1][2][3]. ## Straight answers ### What does cyber insurance cover? The sources cited here do not say. They only mention that a cyber insurance company exists among the stakeholders of an incident [1]. The exact scope, the ceilings and the exclusions depend on the contract. Management, or the person who negotiated it, is the only one who can state them. ### What security measures do insurers require? The sources do not set out a list of insurer requirements. They do describe measures that public bodies recommend: offline backups, multifactor authentication, an incident response plan [1][3][5]. Knowing which of these an insurer imposes on the company requires reading its contract. ### Why must backups be offline? Many ransomware variants look for accessible backups in order to delete or encrypt them [1]. A backup connected to the computer or to the company network can be destroyed by the malicious program, hence the advice to disconnect it or take it offline when it is not in use [2]. ### What does multifactor authentication change? It asks for at least two elements to prove one's identity: something you know, something you have or something you are [3]. Even if a password is stolen, the attacker does not have the second element [3]. Not all methods are equal: CISA writes that "any MFA is better than no MFA" and recommends aiming for phishing-resistant methods [3]. The UK NCSC also recommends techniques that protect better against phishing [4]. ## What it changes for employees The employee does not need to know the contract. They do have steps to follow, because part of security rests on them. - Turn on two-factor authentication as soon as it is offered on email and work services [3]. - Do not leave a backup disk plugged in permanently at one's workstation [2]. - Report any suspicious behavior, for example a phishing email: an awareness program must explain how to recognize and report it [1]. The practical consequence of a failure to follow these steps for compensation is not documented in the sources cited here. It depends on the clauses of the contract. ## What it changes for management Management chooses the measures and keeps the plans up to date. The sources cited here ask several things of it. - Write, maintain and regularly exercise an incident response plan and a communication plan, including a paper copy and an offline version [1]. - Link this plan to business recovery, continuity and crisis management [5]. - Regularly test backups, including their restoration [1][2]. - If a provider manages the backups, set its security requirements by contract [1]. - Keep executives informed as the crisis unfolds, and the insurer may be among the stakeholders to inform [1]. The NCSC writes that no security is perfect: "Incidents can and will happen" [5]. Only good preparation helps to handle them well [5]. ## What the text says None of the sources cited here is a law on cyber insurance. The legal texts they mention concern personal data. The GDPR requires organizations to document personal data breaches internally and to notify the CNIL of those that present a risk to the rights and freedoms of individuals [6]. When the risk is high, the individuals concerned must also be informed [6]. The obligation to notify the CNIL is set out in Article 33 of the GDPR and applies to all data controllers. Article 34 requires informing individuals in case of high risk [6]. Notification is made as soon as possible. If information is missing, it can be made in two stages: an initial notification within 72 hours if possible, then a supplementary notification. Beyond 72 hours, the reasons for the delay must be explained [6]. The CNIL also states that, if the breach follows a cyberattack, it is advisable to file a complaint at the police station or gendarmerie and to keep the technical evidence available for investigators [6]. Backups fall under the same legal regimes as the original data, and, for personal data, civil or criminal liability may be incurred in case of proven failure [2]. ## Where implementation stands The sources cited here give no implementation status for a legal framework specific to cyber insurance in France, nor any obligation to take out a policy. What is established is the notification to the CNIL provided for by the GDPR [6]. On the frameworks side, NIST presents its Cybersecurity Framework 2.0 as a document intended to reduce cybersecurity risks for industry, government and organizations [7]. The NCSC recalls the life cycle described by NIST: identify, protect, detect, respond, recover [5]. For the incident itself, the US source is addressed to IT professionals: it asks them to identify the affected systems and isolate them immediately, in a coordinated way, and to power a device off only if it cannot be disconnected from the network [1]. It advises communicating by telephone rather than through tools that may be monitored [1]. It also asks them to preserve volatile evidence (memory, security logs, firewall buffers) and to collect the relevant logs [1]. It provides for informing stakeholders, of which the insurer may be one, and for reporting the incident to US authorities (CISA, FBI) [1]. In practice, the company follows its own response plan. If personal data is affected, the notification to the CNIL must be sent as soon as possible, within 72 hours if possible [6]. During the investigation, it asks them to look for traces of precursor malware ("dropper"), because a ransomware attack can reveal an earlier, unresolved compromise of the network [1]. During recovery, it asks them to take care not to reinfect healthy systems [1]. Teams can also examine antivirus or EDR logs to spot other affected systems [1]. ## Sources 1. CISA, "#StopRansomware Guide | CISA". https://www.cisa.gov/stopransomware/ransomware-guide (accessed 3 November 2026) 2. Cybermalveillance.gouv.fr, "Pourquoi et comment bien gérer ses sauvegardes ?", 13 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/sauvegardes (accessed 3 November 2026) 3. CISA, "More than a Password". https://www.cisa.gov/MFA (accessed 3 November 2026) 4. NCSC (UK), "Multi-factor authentication for your corporate online services", 26 September 2024. https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services (accessed 3 November 2026) 5. NCSC (UK), "Incident management", 19 September 2019. https://www.ncsc.gov.uk/collection/incident-management (accessed 3 November 2026) 6. CNIL, "Notifier une violation de données personnelles", 24 May 2018. https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles (accessed 3 November 2026) 7. NIST, "Cybersecurity Framework". https://www.nist.gov/cyberframework (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.