Study guide
17.3 Covering Cyber Losses
Chartered Property Casualty Underwriter CPCU
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CPCU Program Structure, Matriculation & Exam Policies
1.1 CPCU Designation Pathway & Program Requirements 1.2 CPCU Matriculation, Experience & the Ethics Commitment 1.3 Virtual Exam Format, Policies & Test-Taking Strategy
2 Chapter 2: CPCU 500 — Risk Foundations, Principles & Analysis
2.1 Building Your Foundation: The Role of Risk Management and Insurance 2.2 Risk Concepts & Classifications 2.3 Enterprise Risk Management & ISO 31000 2.4 The Risk Management Process: Identification & Analysis
3 Chapter 3: CPCU 500 — Risk Treatment, Critical Thinking & Leadership
3.1 Risk Control Techniques & Loss Mitigation 3.2 Risk Financing: Retention vs. Transfer 3.3 Leading with Critical Thinking 3.4 Communicating and Collaborating as a Leader 3.5 Strategic Decision-Making & Leadership in Risk Management
4 Chapter 4: CPCU 520 — Insurer Value Chain & Marketing Systems
4.1 The Insurer Value Chain & Cross-Functional Operations 4.2 Property-Casualty Distribution Systems & Channels 4.3 Market Segmentation, Research & Strategic Positioning
5 Chapter 5: CPCU 520 — Commercial & Personal Lines Underwriting
5.1 Line Underwriting vs. Staff Underwriting Operations 5.2 The Underwriting Process & Decision Analysis 5.3 Adding Value Through Personal Lines Underwriting 5.4 Underwriting Portfolio Management & Capacity
6 Chapter 6: CPCU 520 — Claims Handling & Reinsurance Operations
6.1 Claims Operations & The Claim Handling Process 6.2 Reinsurance Functions & Strategic Value 6.3 Reinsurance Types, Treaties & Calculation Mechanics
7 Chapter 7: CPCU 520 — Ratemaking & Actuarial Foundations
7.1 Actuarial Ratemaking Goals & Regulatory Standards 7.2 Ratemaking Methods & Rate Indication Calculations 7.3 Loss Reserving & Loss Development Triangle Analysis
8 Chapter 8: CPCU 530 — Legal Foundations & Insurance Contract Law
8.1 Understanding Legal Fundamentals in Insurance 8.2 General Contract Elements in Insurance Contexts 8.3 Distinctive Legal Characteristics of Insurance Contracts 8.4 Judicial Interpretation & Policy Ambiguity Doctrines
9 Chapter 9: CPCU 530 — Property Ownership, Torts & Liability Exposures
9.1 Determining Property Ownership and Responsibility 9.2 Negligence Principles & Elements of a Tort 9.3 Legal Defenses to Negligence & Tort Reform 9.4 Strict Liability, Vicarious Liability & Intentional Torts
10 Chapter 10: CPCU 530 — Agency Law, Intermediaries & Resolving Disputes
10.1 Agency Creation & The Scope of Producer Authority 10.2 Fiduciary & Contractual Duties in the Agency Relationship 10.3 Intermediary Legal Liability & Errors and Omissions (E&O) 10.4 Resolving Disputes: Negotiation, ADR, and Litigation
11 Chapter 11: CPCU 540 — Insurer Financial Statements & SAP vs. GAAP
11.1 Statutory Accounting Principles (SAP) vs. GAAP 11.2 The NAIC Annual Statement Balance Sheet & Surplus 11.3 Insurer Income Statement & Statement of Cash Flows
12 Chapter 12: CPCU 540 — Insurer Financial Analysis & Ratio Evaluation
12.1 Underwriting Profitability Metrics & Combined Ratio 12.2 Operating Performance Ratios & Overall Profitability 12.3 Solvency, Capacity & NAIC IRIS Financial Ratios
13 Chapter 13: CPCU 540 — Insurer Investment Management & Capital Strategy
13.1 Insurer Investment Portfolios & Asset-Liability Management 13.2 Insurer Capital Structure, Surplus Notes & Alternative Capital 13.3 The NAIC Risk-Based Capital (RBC) Framework
14 Chapter 14: CPCU 550 — Insurance Data Analytics & Predictive Modeling
14.1 The Expanding Universe of Insurance Data 14.2 Predictive Analytics & Machine Learning in Underwriting 14.3 Advanced Analytics in Claims Operations & Fraud Detection
15 Chapter 15: CPCU 550 — Technology, Cyber Risk & Data Ethics
15.1 InsurTech Innovations & Digital Transformation 15.2 Cyber Risk Management & Insurer Operational Resilience 15.3 Ethical Data Governance, Algorithmic Bias & Regulatory Compliance
16 Chapter 16: CPCU 551 — Managing Commercial Property Risk
16.1 Assessing the Need for Commercial Property Products 16.2 Commercial Property: Building & Personal Property Coverage Form 16.3 Business Income & Extra Expense Coverage Mechanics 16.4 Tailoring Commercial Property Coverage 16.5 Closing Coverage Gaps: Equipment Breakdown, Crime, and Builders' Risk 16.6 Protecting Property in Transit: Inland and Ocean Marine 16.7 Thinking Critically About Commercial Property Loss Exposures
17 Chapter 17: CPCU 552 — Managing Commercial Liability Risk
17.1 Commercial General Liability (CGL) Coverage & Policy Analysis 17.2 Selecting Business Auto Coverage 17.3 Covering Cyber Losses 17.4 Managing Workplace Risks: Workers Compensation, Employers Liability, and EPLI 17.5 Filling Liability Coverage Gaps: Umbrella, Professional, D&O, and Environmental 17.6 Thinking Critically About Commercial Liability Loss Exposures
18 Chapter 18: CPCU 555 — Advancing Personal Insurance Products
18.1 Homeowners Policy Forms & Property-Liability Coverages 18.2 The Personal Auto Policy (PAP): Coverages & Conditions 18.3 Providing Unique Personal Coverages 18.4 Personal Umbrella Policies & Personal Risk Management 18.5 Recommending Personal Investment Strategies
19 Chapter 19: CPCU 556 — Building a Competitive Edge in Personal Lines
19.1 Marketing Personal Lines Products 19.2 Analyzing Personal Auto Risks 19.3 Assessing Residential Property Risks 19.4 Evaluating Unique Personal Exposures 19.5 Developing Personal Lines Underwriting Strategies 19.6 Differentiating Personal Lines Products
20 Chapter 20: Ethics 311 & the CPCU Code of Professional Conduct
20.1 Ethical Decision Making: Ethics 311 and a Four-Step Framework 20.2 The CPCU Code of Professional Conduct & the Nine Canons 20.3 Enforcing the Code: Advisory Opinions, Discipline, and Conflicts in Practice
17.3 Covering Cyber Losses
Key Takeaways Explain This Topic AI
Cyber exposures include data breaches, ransomware and extortion, business interruption from network outages, funds transfer fraud, and liability for privacy and security failures.
Standard commercial general liability and property forms generally exclude or limit cyber and data losses, so dedicated cyber coverage is needed.
First-party cyber coverages include breach response, data restoration, business interruption, and cyber extortion; third-party coverages include network security and privacy liability, media liability, and regulatory defense.
Most cyber policies are claims-made for liability sections and require insureds to use approved breach-response vendors and meet security controls such as multi-factor authentication.
Underwriters evaluate controls including MFA, backups, endpoint detection, patching, employee training, and incident response planning.
Last updated: September 2026
Covering Cyber Losses
Quick Answer: Cyber incidents create both first-party losses , such as breach response costs, data restoration, business interruption, and extortion payments, and third-party liability , such as lawsuits and regulatory actions over privacy or security failures. Traditional CGL and property forms generally exclude or limit these losses, so businesses buy dedicated cyber insurance . Coverage depends heavily on security controls , such as multi-factor authentication, backups, and incident response plans. Insurers use these controls in underwriting and sometimes impose them as conditions.
Why Cyber Needs Its Own Coverage
Electronic data is not tangible property under the ISO CGL definition of property damage, and the CGL contains exclusions for access or disclosure of confidential information and for electronic data.
Property forms cover physical damage and provide only small built-in limits for electronic data and interruption of computer operations.
Crime forms cover certain fraudulent transfers but not breach response or liability.
Cyber insurance was built to fill these gaps.
Common Cyber Coverages
Category Coverage What it pays
First-party Breach response Forensics, legal advice, notification, call centers, credit monitoring, public relations
First-party Data restoration Restoring or recreating corrupted or destroyed data and software
First-party Business interruption Lost income and extra expense from a network outage; some policies extend to dependent (vendor) systems
- First-party Cyber extortion Response costs and, where legal, ransom payments
- First-party Funds transfer / social engineering Loss from fraudulent transfers (often sublimited)
- Third-party Network security and privacy liability Defense and damages when a breach harms others
- Third-party Media liability Defamation or infringement in digital content
Third-party Regulatory defense and penalties Defense of regulatory investigations and fines where insurable by law
- Third-party PCI-DSS assessments Fines and assessments from payment card brands after a card data breach
- Key Policy Features and Conditions
- Claims-made trigger for liability sections, usually with a retroactive date and an extended reporting option
Incident response panels: Insureds are often required or encouraged to use approved breach coaches, forensic firms, and notification vendors
- Waiting periods for business interruption (a set number of hours before coverage begins)
- Sublimits for social engineering, extortion, and dependent business interruption
Exclusions commonly include war (with careful definitions for state-sponsored attacks), failure of core infrastructure, prior known incidents, and bodily injury or property damage
Conditions tied to security controls: Misrepresenting controls such as MFA on the application can jeopardize coverage
Underwriting a Cyber Risk
Underwriters focus on controls that most reduce ransomware and breach losses:
- Multi-factor authentication (MFA) on email, remote access, and privileged accounts
- Secure, tested backups kept offline or immutable
- Endpoint detection and response (EDR) tools
- Patch management for known vulnerabilities
- Employee training on phishing and social engineering
- Incident response plan , tested with tabletop exercises
- Vendor risk management for third parties with network access
Data volume, industry (such as health care, retail, or financial services), revenue, and past incidents also affect pricing and capacity.
"Silent Cyber"
Silent (non-affirmative) cyber refers to cyber losses that might be covered unintentionally under traditional policies that neither clearly include nor exclude them. Insurers and reinsurers have added clarifying exclusions and affirmative grants to property, liability, and other forms so that cyber exposure is priced where it is intended to be covered.
- Risk Management Beyond Insurance
- Risk control: MFA, EDR, segmentation, backups, least-privilege access, training
Contractual transfer: Vendor contracts that allocate breach responsibility and require vendors to carry cyber insurance
- Retention: Deductibles or self-insured retentions sized to the insured's financial strength
- Worked Scenario: Ransomware at a Distributor
A distributor's systems are encrypted. Operations stop for six days, and customer data is stolen. Under a cyber policy:
Breach response pays forensics, legal counsel, and notification to affected customers.
Business interruption pays lost income after the waiting period.
Data restoration pays to rebuild systems.
Cyber extortion responds if a payment is lawful and approved.
Privacy liability defends later lawsuits from customers whose data was exposed.
If the application stated MFA was in place for remote access and it was not, the insurer may contest coverage. That is why accurate applications matter.
First-Party or Third-Party? A Quick Test
- Situation First-party or third-party Typical coverage
- Hiring a forensic firm to find how attackers entered First-party Breach response
- Lost profits while systems are encrypted First-party Business interruption (after the waiting period)
- Restoring corrupted databases First-party Data restoration
- Customers sue for exposure of their personal data Third-party Network security and privacy liability
- A state attorney general investigates the breach Third-party Regulatory defense (penalties where insurable)
- Card brands assess fines after a payment card breach Third-party PCI-DSS assessment coverage
- Common Traps
Assuming the CGL covers data breaches: Electronic data is not tangible property, and the CGL excludes access or disclosure of confidential information.
Overlooking waiting periods and sublimits: Business interruption, extortion, and social engineering often have their own terms.
Misstating controls on the application: Inaccurate answers about MFA or backups can jeopardize coverage.
Choosing vendors without consent: Many policies require using approved response vendors or getting insurer consent first.