Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. The recommended chain puts counsel before the technical investigator. What does that order decide, and why is it settled in the first two hours?
The status of the investigation report: commissioned by the company, it is a company document, disclosable later; commissioned by counsel to prepare the defense, it benefits from a protection that varies by jurisdiction but exists
The technical report will state, with the precision that is its virtue, everything that had not been done. Its status is fixed when it is commissioned and can never be recovered. The answer on fees invents a coverage condition: investigation costs fall within the cover whoever commissions them, it is their PROTECTION that changes. The one on admissibility attributes to the authority a formal requirement it does not have, and even inverts the stake, since the risk is that the report be too readily available. The one on site attendance describes a real concern, preserving traces, and assigns it to the wrong person: the investigator preserves traces, not counsel, and the module says elsewhere what a restoration run without prior investigation costs.
Glossary entry · police-stand-alone2. At three in the morning an insured calls the managed services provider that has run its IT for six years, which is not on the insurer's list. What exactly is the problem?
Most policies reimburse an off-list provider only after prior agreement, sometimes at list rates, and that agreement is not given retroactively: what is incurred before will be argued over
The reflex to call whoever you know is human and professional, and not unreasonable; what costs is the timing, not the choice. The two extreme answers err in opposite directions, which is what makes them instructive. The one forfeiting the whole cover hardens a reimbursement rule into a forfeiture, which it is not. The one seeing only a rate question treats as indicative a list that also carries the quality of the teams and the legal chain the insurer has organized. The one referring back to the outsourcing contract moves the question outside the policy, when it sits entirely inside it: the insurer is the one who will or will not reimburse, and will say so depending on whether it was asked before or after.
Glossary entry · declaration-de-risque3. A company whose servers were encrypted rebuilds them while segmenting its network, changing its backups and imposing an authentication it had put off for two years. How is that treated?
The insurer pays restoration and not modernization, and the split is made AS the rebuild proceeds: made at claim time, it produces a painful argument over one global invoice
A company never rebuilds its servers identically, and that upgrade spend is legitimate without being covered. The useful point is not the rule, which everyone accepts once stated, it is WHEN it is applied. The answer covering everything that contributes to restarting keeps a causation test that is true elsewhere and would here have the insurer fund the catch-up of a project put off for two years. The one covering nothing excludes too broadly, restoration being indeed paid. The one invoking increased costs of working calls on a cover that exists and aims to MAINTAIN activity during the interruption, not to rebuild the system better than before.
Glossary entry · principe-indemnitaire4. An insurer insists that an emergency number be called immediately. A technical team sees an administrative burden. Who is right, and what is unusual about it?
The insurer, and the case is unusual: every hour between discovery and intervention increases encryption, exfiltration and interruption, so its interest and the insured's align perfectly
In insurance, prompt notification is usually a contractual requirement from which the insured draws no direct benefit, and that is what breeds weariness in the teams. Here it is a cost factor, and telling technicians so works better than reminding them of a clause. The answer invoking proportional reduction reaches the right camp by the wrong route, and the route matters: it presents the call as a sanctioned obligation, which confirms the technical team in its reading. The one seeing only a formality ignores what the hours produce. The one ranking technical work first and insurance second describes the order sites adopt spontaneously, and it is precisely that order that costs: the practiced intervention is part of the technical response, it does not come after.
Glossary entry · bonne-foi5. Among the decisions the module says to prepare in advance, which carries a physical constraint the others do not?
The document saying who calls, in what order and with which numbers must live SOMEWHERE OTHER than on the network, failing which it is encrypted along with everything else at the exact moment it is needed
A crisis plan stored on the network share is unavailable during the crisis it prepares for, and that circularity is what makes the point concrete rather than solemn. The three other answers describe sound administrative steps, none of which carries that constraint. The signed schedule invents an enforceability condition. Annual review of the sub-limit is a genuine underwriting question, settled in negotiation rather than in a response plan. Filing the name of the authorized person turns an internal preparation, knowing who decides, into an external formality, and would have a caller turned away on the night someone must pick up.
Glossary entry · franchise-temporelle