Policy Wording and Guidance

Policy wording

Business interruption loss that the insured organization sustains as a result of a security breach or system failure that the insured first discovers during the policy period.

Policy guidance

Business Interruption Loss includes certain losses that are sustained as a result of the actual interruption of an Insured’s business operations caused by a covered cyber event.

Policy wording

Dependent business loss that the insured organization sustains as a result of a dependent security breach or a dependent system failure that the insured first discovers during the policy period.

Policy guidance

Dpendent Business Loss includes certain losses that are sustained as a result of the interruption of an Insured’s business operations caused by a dependent covered cyber event.

Policy wording

Data recovery costs that the insured organization incurs as a direct result of a security breach that the insured first discovers during the policy period.

Policy guidance

Data Recovery Costs includes certain costs incurred to restore software or electronic data impacted by a covered cyber event.

Policy wording

Cyber extortion loss that the insured organization incurs as a result of an extortion threat first made against the insured organization during the policy period.

Policy guidance

Policy wording

Income loss means an amount equal to:

1. net profit or loss before interest and tax that the insured organization would have earned or incurred; and
2. continuing normal operating expenses incurred by the insured organization (including payroll), but only to the extent that such operating expenses must necessarily continue during the period of restoration.

Policy guidance

Income loss involves the quantifiable financial impact to a business caused by a covered cyber event, focused on impact to revenues or sales. Income loss is often measured using outside forensic accounting experts, and the policy will cover the costs for certain of these amounts, up to a specified limit.

The starting point for measuring income loss is to assess what revenue was lost (and not made up) because of the interruption in operations caused by the covered cyber event. If you have all of the same revenue to cover your normal operating expenses, then there is no Income Loss under this definition – although there may be extra expense that was incurred to avoid an income loss or forensic expense or data recovery costs incurred in connection with a covered cyber event.

If there was a decrease in revenue during the period of restoration caused by a covered cyber event, the next step after quantifying that impact is to determine how the decrease in revenue affected the company’s bottom line. These impacts can manifest in two ways:

1. The company may lose a certain amount of net profit for each dollar of revenue lost.
2. If a company loses sales, in addition to losing profit for each sale, the company also may not receive revenue that is used to pay its fixed operating expenses that cannot be avoided (such as unavoidable payroll, rent, taxes, etc.).

While we aim to understand how your unique business works, our forensic accounting experts apply Generally Accepted Accounting Principles methodology to measure your potential loss.

Amounts that are not included in the income loss definition include:

• Expenses that are above-and-beyond normal operating expenses (although such amounts may be covered elsewhere under the policy, such as for extra expense or data recovery costs).
• Normal operating expenses that are not necessary to continue, such as for outsourced services that are not necessary to continue (such as cleaning expenses which are not required for an office that is temporarily shut down).
• Variable or non-continuing expenses, such as cost of goods sold or costs of supplies.
• Sales that are delayed but not lost.

Policy wording

Extra expense means reasonable and necessary expenses incurred by the insured organization during the period of restoration to minimize, reduce or avoid income loss, over and above those expenses the insured organization would have incurred had no security breach, system failure, dependent security breach or dependent system failure occurred.

Policy guidance

Extra expense includes certain amounts incurred to minimize, reduce or avoid income loss, provided that such amounts are over and above those expenses the insured organization would have incurred had no covered cyber event occurred, provided that those amounts are actually sustained during the period of restoration as a result of the actual interruption of the insured organization’s business operations caused by a covered cyber event.

Policy wording

Forensic expenses means reasonable and necessary expenses incurred by the insured organization to investigate the source or cause of a business interruption loss.

Policy guidance

Forensic expenses includes certain amounts incurred to investigate an interruption, provided that those amounts are actually sustained during the period of restoration as a result of the actual interruption of the insured organization’s business operations caused by a security breach or system failure.

Examples of forensic expenses include:

• Overtime (beyond normal overtime) paid to employees who work additional shifts to investigate a covered cyber event.
• Costs for an outside computer forensic consultant retained to focus on an outage, apart from the investigation work covered under the Breach Response Services coverage.