Crisis communication costs

Crisis communication costs are the cyber policy cover that pays for the public relations (PR) agency, crisis communication advisers and social media monitoring brought in after an incident or reputational event. In March 2019, Norsk Hydro, hit by the LockerGoga ransomware, put the cost of the first week of disruption at 300 to 350 million Norwegian kroner (NOK), then raised its first-quarter estimate to as much as NOK 450 million. The group spoke publicly about the attack from the first days, and the modeling firm RMS (Risk Management Solutions) cited that transparency as an example. Cyber policies have a name for this work: crisis management, public relations or crisis communication costs. They cover the fees of the PR agency and the crisis communication adviser, drafting press releases and customer messages, social media monitoring, and sometimes paid space for a public notice. The trigger is drafted in one of two ways. Some wordings require a covered event, a data breach or a network security failure; others accept an “adverse media event,” a damaging publication or a credible threat of one, with no covered loss behind it. The cover usually pays under a sublimit carved out of the incident response limit, and for a capped period after discovery. Aggregation works against the insured: every euro spent on the agency is a euro missing later for forensics and notification. At claim time, the hard line is the boundary with reputational harm cover. Crisis communication costs exist to contain the damage and are proven by invoice; the margin lost because customers walk away belongs to a separate insuring agreement, with its own indemnity period and forensic accounting. The underwriter also looks at who picks the agency, a panel vendor or a free choice subject to prior consent, because the accepted day rate depends on it. One caveat: attorney fees for dealing with the regulator often fall under regulatory investigation cover, outside this item.