Contingent business interruption (CBI)

Contingent business interruption (CBI), which US cyber forms also call dependent business interruption, covers the insured's lost income when the loss that shuts it down happens not on its own premises but at a third party it depends on: a supplier, a subcontractor, a service provider, sometimes a major customer. A company can grind to a halt with no damage of its own because one link in its chain broke, and that is the case this cover picks up. The calculation is the same as for direct BI: gross profit lost during the outage plus extra expense, after the waiting period and within a separate sublimit. What sets it apart from ordinary BI is the trigger. In property, CBI coverage generally requires physical damage at the supplier of a kind the policy would insure at the insured's own site, and wordings split named suppliers, scheduled on the policy, from unnamed suppliers, covered for a lower limit. In cyber it carries far more weight. Businesses rely on a handful of digital providers, hosting firms, cloud platforms, vendors of widely used software, and an attack or outage at one of them can stop thousands of customers at once; the faulty CrowdStrike update of July 19, 2024 knocked out about 8.5 million Windows devices. Cyber wordings therefore separate IT providers from other suppliers, and a non-malicious outage (system failure) is covered only if the wording names it. CBI is one of the main accumulation channels. A shared supplier goes down, and insureds with nothing else in common all claim at once. Insureds want the cover for that reason, and insurers fear it for the same one, because they struggle to say which critical suppliers their book depends on. In reinsurance, CBI is what drives the cloud outage scenarios in accumulation models.