Every answer and its explanation appears here once you have finished the path. Each one then links to the matching glossary entry, where the concept is set out in full with its worked example.
1. The word liability here covers two exposures with almost nothing in common. Beyond their calendars, what makes their coexistence delicate?
What the insured says to one can be used by the other: the civil side and the authority's proceedings run in parallel, and coordinating the two fronts is a job in itself
Two parallel proceedings on the same facts produce statements that travel, and that is what makes coordination a workstream rather than a precaution. The answer on separate limits describes an architecture that exists in some policies and says nothing about the underlying difficulty. The one having the regulatory side stay the civil side invents a procedural link and reassures wrongly: the two advance together, and that is precisely the problem. The one moving the regulatory side outside the policy misjudges scope, assistance costs and advice being covered by most contracts, and it deprives the insured of the coordination it most needs.
Glossary entry · rc-pro2. On the civil side, the loss of one person whose address and phone number leaked is small and sometimes hard to establish. Where does the stake come from?
From the number: multiplied by thirty thousand, a modest unit loss becomes serious, and it attracts collective action mechanisms that vary greatly between countries
The civil side is an arithmetic problem before it is a legal one, and that is what makes it hard to reserve: the amount depends on a collective mechanism whose shape changes between countries. The one invoking a presumed loss for identity theft hardens an argument that is pleaded rather than imposed. The one renewing the loss each year invents a periodicity, and it is attractive because it captures a sound intuition, data circulates for a long time. The one invoking joint liability moves the subject to liability for subcontractors, which is a real question and a different one: here the stake is the number of claimants, not the number of debtors.
Glossary entry · exfiltration-donnees3. A policy covers regulatory fines "to the extent permitted by law". What should be understood, and when is the question settled?
That the clause defers the question without settling it: insurability depends on the applicable law and varies between countries, and the check belongs before the loss rather than at settlement
A clause referring to the law says nothing until that law has been read, and the insured relying on this line may find it covers nothing where it operates. The three other readings all try to make the formula say what it does not. The one seeing a favorable presumption reverses the burden: the formula subordinates, it does not grant. The one limiting it to non-criminal fines introduces a distinction the text does not draw, even if it often matches the outcome. The one seeing a discretion turns a reference to the law into a power of the insurer, which is wrong and discourages the only useful step: checking, for one's own jurisdiction, what the law permits.
Glossary entry · clause-exclusion-sanctions4. For many service companies, which exposure exceeds that toward thousands of individuals, and why is it almost never quantified before the loss?
The indemnity clauses signed toward its own business customers, often uncapped or highly capped, triggering in cascade: they are measured by rereading one's OWN contracts, an exercise nobody does beforehand
The heaviest exposure is the one taken on oneself, one signature at a time, in commercial contracts negotiated by people not thinking about encryption. It appears in no insurance questionnaire because it lives not in the policy but in the sales contracts. Service level penalties are real and generally capped at a fraction of the price, an entirely different order. Recovery by property insurers describes a subrogation that exists and presupposes those insurers have paid, which remains secondary. Employee claims are a genuine and modest exposure, of the same kind as the individuals already counted.
Glossary entry · subrogation5. The module insists on naming what the policy does not repair. Why is that candor better than silence?
Because customers who do not return, reputation, management time and valuation are neither indemnified nor marginal: letting people believe a cyber loss ends with a check sets up a disappointment costlier than the admission
A limit stated plainly can be worked with, a limit left unsaid is discovered at the worst moment. The answer on the questionnaire turns a disclosure into an extension of cover, which it never is. The one on reputation restoration names a cover that genuinely exists, and the module cites it: it pays for a campaign, not for revenue, and believing it covers these items is exactly the illusion the candor must dispel. The one placing them in the residual business interruption period conflates two close things: customers lost during the indemnity period are covered, customers who will never come back are not, and the boundary is the end of that period.
Glossary entry · principe-indemnitaire