Cyberpediaby Brain
ENDEFR

Cyber insurance

What cyber insurance assumes of employees and management: offline backups, multifactor authentication, first steps and reporting.

In 30 seconds

Where it happens
During a ransomware attack, a data leak or an attack that hits the company's systems, where the list of people to inform may include the cyber insurance company1.
What the attacker wants
Many ransomware variants look for accessible backups in order to delete or encrypt them1.
The reflex
Turn on two-factor authentication and do not leave a backup permanently plugged in, then follow the company's response plan if an incident occurs123.

What it is

Cyber insurance is a contract that a company takes out to deal with the aftermath of a cyberattack. For an employee, it usually stays invisible until an incident happens: the insurer may be among the people to notify, along with the IT department and the managers concerned1.

The sources cited here are public guides on security and incident handling. None of them describes the content of an insurance contract: not the cover (crisis costs, data restoration, business interruption losses, civil liability), not the exclusions, not the conditions set by any particular insurer. This entry therefore does not detail them. It presents what these sources say about the security measures an insurer may ask for and the steps to take during an incident. The actual conditions are found in the company's contract.

Straight answers

What does cyber insurance cover?

The sources cited here do not say. They only mention that a cyber insurance company exists among the stakeholders of an incident1. The exact scope, the ceilings and the exclusions depend on the contract. Management, or the person who negotiated it, is the only one who can state them.

What security measures do insurers require?

The sources do not set out a list of insurer requirements. They do describe measures that public bodies recommend: offline backups, multifactor authentication, an incident response plan135. Knowing which of these an insurer imposes on the company requires reading its contract.

Why must backups be offline?

Many ransomware variants look for accessible backups in order to delete or encrypt them1. A backup connected to the computer or to the company network can be destroyed by the malicious program, hence the advice to disconnect it or take it offline when it is not in use2.

What does multifactor authentication change?

It asks for at least two elements to prove one's identity: something you know, something you have or something you are3. Even if a password is stolen, the attacker does not have the second element3. Not all methods are equal: CISA writes that "any MFA is better than no MFA" and recommends aiming for phishing-resistant methods3. The UK NCSC also recommends techniques that protect better against phishing4.

1What it changes for employees1 min

The employee does not need to know the contract. They do have steps to follow, because part of security rests on them.

  • Turn on two-factor authentication as soon as it is offered on email and work services3.
  • Do not leave a backup disk plugged in permanently at one's workstation2.
  • Report any suspicious behavior, for example a phishing email: an awareness program must explain how to recognize and report it1.

The practical consequence of a failure to follow these steps for compensation is not documented in the sources cited here. It depends on the clauses of the contract.

2What it changes for managementManagement1 min

Management chooses the measures and keeps the plans up to date. The sources cited here ask several things of it.

  • Write, maintain and regularly exercise an incident response plan and a communication plan, including a paper copy and an offline version1.
  • Link this plan to business recovery, continuity and crisis management5.
  • Regularly test backups, including their restoration12.
  • If a provider manages the backups, set its security requirements by contract1.
  • Keep executives informed as the crisis unfolds, and the insurer may be among the stakeholders to inform1.

The NCSC writes that no security is perfect: "Incidents can and will happen"5. Only good preparation helps to handle them well5.

3What the text saysOfficial text1 min

None of the sources cited here is a law on cyber insurance. The legal texts they mention concern personal data.

The GDPR requires organizations to document personal data breaches internally and to notify the CNIL of those that present a risk to the rights and freedoms of individuals6. When the risk is high, the individuals concerned must also be informed6. The obligation to notify the CNIL is set out in Article 33 of the GDPR and applies to all data controllers. Article 34 requires informing individuals in case of high risk6.

Notification is made as soon as possible. If information is missing, it can be made in two stages: an initial notification within 72 hours if possible, then a supplementary notification. Beyond 72 hours, the reasons for the delay must be explained6.

The CNIL also states that, if the breach follows a cyberattack, it is advisable to file a complaint at the police station or gendarmerie and to keep the technical evidence available for investigators6. Backups fall under the same legal regimes as the original data, and, for personal data, civil or criminal liability may be incurred in case of proven failure2.

4Where implementation stands2 min

The sources cited here give no implementation status for a legal framework specific to cyber insurance in France, nor any obligation to take out a policy. What is established is the notification to the CNIL provided for by the GDPR6.

On the frameworks side, NIST presents its Cybersecurity Framework 2.0 as a document intended to reduce cybersecurity risks for industry, government and organizations7. The NCSC recalls the life cycle described by NIST: identify, protect, detect, respond, recover5. For the incident itself, the US source is addressed to IT professionals: it asks them to identify the affected systems and isolate them immediately, in a coordinated way, and to power a device off only if it cannot be disconnected from the network1. It advises communicating by telephone rather than through tools that may be monitored1. It also asks them to preserve volatile evidence (memory, security logs, firewall buffers) and to collect the relevant logs1. It provides for informing stakeholders, of which the insurer may be one, and for reporting the incident to US authorities (CISA, FBI)1. In practice, the company follows its own response plan. If personal data is affected, the notification to the CNIL must be sent as soon as possible, within 72 hours if possible6. During the investigation, it asks them to look for traces of precursor malware ("dropper"), because a ransomware attack can reveal an earlier, unresolved compromise of the network1. During recovery, it asks them to take care not to reinfect healthy systems1. Teams can also examine antivirus or EDR logs to spot other affected systems1.

Fact sheet

Identifier
CP-385
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-063
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. CISA, “#StopRansomware Guide | CISA”. https://www.cisa.gov/stopransomware/ransomware-guide (accessed 3 November 2026)
  2. Cybermalveillance.gouv.fr, “Pourquoi et comment bien gérer ses sauvegardes ?”, 13 November 2019. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/sauvegardes (accessed 3 November 2026)
  3. CISA, “More than a Password”. https://www.cisa.gov/MFA (accessed 3 November 2026)
  4. NCSC (UK), “Multi-factor authentication for your corporate online services”, 26 September 2024. https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services (accessed 3 November 2026)
  5. NCSC (UK), “Incident management”, 19 September 2019. https://www.ncsc.gov.uk/collection/incident-management (accessed 3 November 2026)
  6. CNIL, “Notifier une violation de données personnelles”, 24 May 2018. https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles (accessed 3 November 2026)
  7. NIST, “Cybersecurity Framework”. https://www.nist.gov/cyberframework (accessed 3 November 2026)

Cite this article

Brain, “Cyber insurance”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/

BibTeX 
@misc{brain_cp385_en_2026,
  author = {Brain},
  title = {Cyber insurance},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/cyber-insurance-requirements-claims/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence