Business interruption, and the meter that starts without damage

Cyber business interruption resembles property business interruption and does not obey the same rules, which produces the market's costliest disagreements. In property insurance, interruption presupposes physical damage: a fire, a flood, something visible that dates the event and bounds the rebuild. In cyber, there is nothing to see. The servers are intact, the building is standing, and the company is not producing. The trigger is not damage but a system interruption, and that difference governs the starting point, the duration and the proof.

The first mechanism to master is the waiting period, counted in hours and not in days. A cyber policy ordinarily provides that cover responds only after eight, twelve or twenty-four hours of continuous interruption, and that time deductible bites far harder than it looks: most incidents resolve below it, and those that exceed it exceed it by a lot. It is not a pricing detail, it is what decides whether the vast majority of losses enter the cover or not. Reading it precisely, in hours and in method of computation, is the first step for underwriter and insured alike.

Then comes the indemnity period, and that is where most files are decided. It ends not when systems restart but when activity returns to the level it would have had without the loss, within a maximum duration set in the contract. The distinction is decisive because an IT recovery almost always precedes a commercial recovery by several weeks: the systems are running, the customers have not come back, and lost orders are not all recovered. A contract capping the indemnity period at technical restoration covers half the real prejudice.

Partial recovery complicates the calculation and is better handled with figures than with principles. Production back to forty percent after six days is not a recovery: it is a sixty percent loss still running. The indemnity is computed on the gross margin the company would have earned, less what it actually earned, period by period, which assumes cost accounting able to say what a normal month would have been. The companies that come through these losses well are those producing a weekly table from the first week, rather than a global estimate in the third month.

One must then know that cover often extends beyond the insured's own systems, and that this extension is the one that moves most. An outage at a cloud provider, a host or a payroll bureau interrupts the insured's activity without any of its own systems being touched. Policies handle this through contingent business interruption cover, with its own sub-limits, its own waiting period, and often a requirement that the suppliers concerned be named. An insured that has not listed its host discovers at the loss that the cover it believed general was a named one.

Proof, finally, is where these files are lost, and it is assembled during the incident and not after. One must be able to establish the exact moment the interruption began, which assumes technical logs that encryption sometimes makes unreachable; the real activity level day by day during recovery; and what normal activity would have been, which assumes documented seasonality. A company that kept no timestamped record of its restart ends up negotiating on impressions, against an insurer that paid a team to keep a log.

The method comes to three requirements, all preceding the loss. Read the waiting period in hours and check that it does not exclude the most probable class of incident. Check that the indemnity period runs to the return to expected activity and not to technical restoration. And name the suppliers whose outage would stop the business, knowing that list is the cover itself. During the loss, one discipline only: a weekly table of activity levels, kept from day one, worth more than any later expert report.