Filing a Cyber Insurance Claim: Steps and Evidence to Prepare

For an SMB filing a cyber insurance claim, start by checking the notification requirements, contacting the insurer or broker, and preserving incident evidence. Coverage depends on the policy, the facts of the incident and applicable law. Check that the security controls declared on your application match what was running when the incident happened.

Stages to plan for in a cyber insurance claim

Use the following stages as a planning checklist, then ask your broker to confirm the sequence and responsibilities under your policy. They are not a universal timetable. Policy terms and local law control the actual claim.

• Notification. You report the incident to your insurer or broker, using the contact method specified in your policy. Notification deadlines vary by policy, so confirm yours in writing rather than relying on memory during a crisis.

• Panel engagement. Check whether your policy requires approved forensic investigators, breach counsel or PR firms. Ask the insurer to confirm consent requirements before appointing an outside vendor; reimbursement may depend on that approval.

• Investigation. Ask the forensic team to establish what happened, when, and which data or systems were affected. Agree with the investigator and insurer which findings need to be documented.

• Proof of loss. Prepare documentation of relevant costs: incident response fees, legal fees, notification costs, business interruption, and any ransom or extortion payment if covered.

• Adjustment and settlement. Ask the adjuster how the loss will be assessed against the policy and when to expect a decision. Request written reasons for any disputed amount.

Include legal counsel and your broker in your notification plan. Confirm who can give instructions on coverage and legal obligations before an incident forces those decisions.

Evidence to prepare and confirm with your insurer

Check which losses your policy covers and whether your security declarations are accurate. Prepare the following records and confirm which ones your insurer requires:

• Proof that application-stated controls existed. If your application said MFA was enforced on remote access or admin accounts, the insurer may ask for configuration exports or logs showing that was true at the time of the incident, not just today.

• An incident timeline with supporting logs. Firewall, identity provider, EDR, and cloud audit logs that show detection time, containment steps, and scope of access. If logging retention is short, this evidence may simply not exist by the time it is requested.

• Cost documentation tied directly to the incident. Invoices from forensic firms, legal counsel, and notification vendors, itemized so the adjuster can map each cost to a covered policy section.

• Notification compliance records. Evidence that affected individuals or regulators were notified in line with applicable law. Notification obligations and deadlines differ by state and regulation, and ask your insurer which compliance records it requires.

When arranging incident response support, agree who will capture the timeline and evidence, how records will be protected, and what the insurer needs. Do not assume that every provider engagement includes insurance claim preparation.

Where payouts get delayed or denied

Review these four issues with your broker and legal adviser. They are policy questions to check, not a ranking of how often claims are disputed.

• Misrepresentation on the application. A mismatch between declared and actual controls can affect coverage. The UK NCSC guidance on cyber insurance warns that inaccurate security declarations can jeopardise a claim. Ask your adviser how your policy and local law treat a specific discrepancy.

• Late or incomplete notification. Check notice deadlines and whether written follow-up is required. Missing a requirement may affect coverage; the consequences depend on the policy and applicable law.

• Scope disagreements. The FTC cyber insurance guidance distinguishes your own recovery costs from liability to third parties. Confirm both parts of your cover. Ask the adjuster what financial records and calculation method are required for a business interruption claim.

• Policy exclusions. Ask your broker to explain the exclusions and limits in your actual wording, including any clauses concerning war, state-backed incidents, contractual liability or security requirements. Do not assume that every policy uses the same exclusions.

Keep a written record of the broker's answers and the relevant policy sections. Good documentation supports a claim, but it does not create coverage for an excluded loss.

What to do before you ever file a claim

Keep the security declarations in your policy application accurate as your systems change.

• Reconcile application answers against reality. Have your IT lead compare what was stated on the insurance application to current configuration at least annually, and before each renewal. If MFA coverage or patch cadence has drifted, remediate the gap and ask your insurer or broker how to report the changed circumstances.

• Confirm log retention matches evidentiary needs. Ask whoever owns your logging and SIEM setup how far back records go. Close retention gaps before an incident.

• Keep an incident response plan that assigns ownership. Someone, by name or role, needs to own notification timing, evidence capture, and panel vendor coordination. A virtual CISO engagement is one way to keep this current without a full-time hire.

• Loop in legal and your broker on day one of any suspected incident. They can confirm notification deadlines and panel requirements before decisions are made that could affect coverage.

When to act now, when to defer, and how to test it

Act now if you have never reviewed your policy's exclusions, or if you cannot confidently say your current controls match what is on your application. Defer only if you have recently renewed and verified alignment, and even then, revisit after any material infrastructure change such as a new cloud provider or a shift to remote work.

To test readiness, run a tabletop exercise: simulate a notification trigger and see how long it takes your team to produce a basic incident timeline and identify who would contact the broker. If nobody can answer who calls the insurer and when within the exercise, that is the failure mode to fix before a real incident forces the answer. Sheer Safe offers compliance support. Agree the scope before relying on any engagement for a specific notification or insurance requirement.

Use cyber insurance alongside an ongoing security programme. Preparation gives your team a documented process to follow; it does not guarantee payment or a faster settlement.

For an initial conversation about your security, start with our free security review. We can discuss your security controls and the evidence you retain. Your broker or legal adviser should interpret insurance coverage.