Your Cyber Response Team Starts at Insurance Renewal
This is the first in a three-part series on aligning cyber insurance coverage with incident response planning before a crisis occurs. Part 1 focuses on securing approval for trusted counsel and vendors, with upcoming installments addressing other key coverage and response issues, including emerging AI-related risks.
Why Renewal Is the Moment to Decide
The time to decide who will answer the phone during a data breach, ransomware attack, or other cyber incident is before it happens, and one of the best opportunities to make that decision is during policy renewal.
Once an incident is underway, many cyber policies give the carrier significant say over which lawyers, forensic firms, and other vendors it will pay. Organizations that learn during the first hours of a crisis that their preferred providers are not approved may face a difficult choice: switch to unfamiliar panel providers or continue with trusted advisors and risk that some costs will not be reimbursed.
Renewal is when brokers and insureds have the best opportunity to address those issues before they become urgent.
How Panel Requirements Typically Work
Cyber policies often include provisions that affect which providers an insured may use and what the carrier will reimburse. These may include:
- Consent requirements for counsel and vendors;
- Pre-approved panels of breach counsel, forensic investigators, notification vendors, crisis communications firms, and other providers;
- Negotiated rate schedules that may limit reimbursement for non-panel providers; and
- Notice requirements that can affect coverage for costs incurred before the carrier is notified.
These provisions vary by carrier and policy, but they are often more negotiable before coverage is bound than they are after an incident begins.
Why Provider Choice Matters
Panel firms and vendors may be highly capable, but many organizations also have strong reasons for wanting to use advisors they already know.
Regular outside counsel may understand the organization’s systems, contracts, regulators, prior incidents, and internal decision-makers. That institutional knowledge can be especially valuable during the first hours of a response.
Organizations may also have invested significant time in incident response plans, tabletop exercises, and retainer arrangements with specific counsel or forensic firms. If those providers are not approved under the policy, the organization may discover that its insurance coverage and incident response plan point in different directions.
Even when a preferred provider is approved, the carrier may reimburse only up to panel rates, leaving the insured responsible for the difference.
What to Raise at Renewal
Before coverage is bound, organizations should identify the counsel and vendors they would want to use during an incident and raise those providers with their broker early in the renewal process.
Consider asking:
- Can our preferred counsel and vendors be pre-approved in writing?
- At what rates will their work be reimbursed?
- Are there any limitations we should understand before an incident occurs?
Where possible, approval should be reflected in the policy or an endorsement rather than left to informal assurances.
The Bottom Line
Cyber insurance renewal is an opportunity to make sure the people named in your incident response plan are also people your policy will allow you to use. Addressing provider approval and reimbursement terms before an incident can help avoid unnecessary disruption when the organization is already under pressure.
Smith Anderson’s privacy and cybersecurity attorneys regularly help clients review policy terms, prepare for renewal discussions, and coordinate with brokers and carriers on counsel and vendor approval. For questions about these issues, please contact Hunter Bruton, David Senter, or your Smith Anderson attorney.
In Part 2, we will look at additional ways to align cyber insurance coverage with your incident response plan before a crisis occurs.
Professionals
Attorney
Attorney
