Renewal season arrives as a PDF, a deadline, and a broker asking for a signature by Friday. Most organizations skim the schedule of coverage, confirm the limits look roughly like last year's, and move on. That works fine until the morning a negotiator asks for a payment and someone has to work out whether the policy actually responds.
The current version of that moment is less forgiving than it used to be. Insurers are writing tighter language, attaching conditions that read like IT audit findings, and treating notification clocks as the place to draw a hard line. Coverage has not disappeared. What has changed is that the difference between a funded recovery and an expensive argument is now decided at renewal, in the questions you ask before you sign.
Treat a Renewal as a New Contract
Even a like-for-like renewal is a fresh policy. Endorsements get added, wording gets trimmed, and the definitions that decide everything often sit in an appendix nobody reads aloud. Review the renewal as if you were buying coverage for the first time, with one advantage: you already know what your environment looks like.
Pay particular attention to the underwriting questionnaire. In many policies, your answers are incorporated into the contract. If you attest to multi-factor authentication across remote access and an incident later shows a gap, you are not arguing about the incident anymore. You are arguing about the application.
The 12 Questions to Ask Before You Sign
Ask these in writing. Short verbal answers from a broker are useful context, not evidence.
- What counts as a ransomware event? Does coverage require encryption, or does data theft alone trigger it? Pure exfiltration with a leak threat is now a common demand, and some wordings still assume files were locked.
- Is data restoration covered, or only rebuilding? Ask whether restoring from backups, and the cost of the downtime involved, sits inside the same sublimit as rebuilding systems.
- Is the ransom itself covered, and under what conditions? Payment legality varies by jurisdiction and by who is behind the attack. Ask how the insurer handles sanctions screening and whether law enforcement involvement is a condition.
- How is business interruption calculated? Find the waiting period, the hourly or daily limit, and whether interruption during forensics counts when systems are technically back up but unusable.
- Whose incident response team do you have to use? Panel firms are usually pre-approved. If you want your own, ask what happens to those costs and who approves them, before you need either.
- Does the policy respond to extortion without encryption? Threats to leak data, to contact customers, or to report a regulatory breach are separate exposures from a locked server.
- Which third parties can claim against you, and are those claims covered? Customer contracts, vendor agreements and breach notification duties to business partners are frequent gaps.
- What is new in the exclusions? Put last year's policy and this year's side by side. Unpatched internet-facing systems, missing MFA, failed backups and nation-state attribution clauses are the usual additions.
- What are the notification deadlines, in hours? Ask separately about a claim and about a circumstance that may give rise to one. A suspicious Friday-night alert may already qualify.
- What records must you preserve, and how quickly? Logs, forensic images, and the timeline matter. Ask what happens if a system is wiped before the insurer's team arrives.
- What security improvements are required at renewal? EDR, offline backups, segmentation, privileged access reviews. Get the deadline and the proof of completion in writing.
- What must you not do without consent? Hiring counsel, engaging a negotiator, issuing public statements and paying a demand are common consent triggers. Get the pre-approval process documented.
Exclusions Do More Work Than Limits
A five-million-dollar limit means nothing if the path the intruders used is carved out. This is why the exclusion conversation deserves more time than the limit conversation. Read every exclusion as a scenario: if attackers get in through an unpatched appliance, we are on our own; if they get in through a phished contractor account on an MFA-covered system, we are covered.
Nation-state wording deserves its own question. Attribution takes weeks, and policies vary in how the exclusion is softened when an incident cannot be tied to a sovereign actor. Ask how the insurer applies the clause in practice, not how the clause reads in isolation.
Notification Is Not a Formality
Most disputes do not begin with a denial. They begin with late notice. Notification conditions usually cover both a claim and a circumstance that could give rise to one, which means an alert on Friday night may start the clock before anyone has confirmed encryption.
Two clocks, not one
The first clock is notice to the insurer. The second is cooperation: preserving evidence, using approved vendors, and not settling or paying without consent. Ask who internally is authorized to notify, whether notifying your broker counts as notifying the insurer, and what form the notice must take. Then make it possible for a tired person at two in the morning to do the right thing without reading the policy.
If the notification clause only works when your most experienced person is awake, it does not work.
Keep the Answers Where You Can Find Them
Store these four things offline, somewhere reachable when your document management system is not:
- The full policy and endorsements as issued, not the broker's summary.
- Written confirmation of the disputed points: notification hours, consent requirements, panel rules.
- An incident runbook with notification contacts, deadlines and approval limits.
- The list of scenarios your policy does not cover, shared with the security team so those become priority fixes.
The Week Before You Sign
Spend one hour on this and it pays for itself. Run a short tabletop with the policy open on the table: a fictional intrusion, a demand, and a decision about who calls whom. Call the claims hotline to confirm the number works. Name two people who can notify and one backup. Calendar the deadlines, the retroactive date and a mid-term review at six months, because your environment will change faster than the policy will. Ask your broker for a written comparison against last year's wording, and get the straight answer on anything that narrowed.
Finally, keep the professionals involved. Insurance wording is interpreted differently across countries and states, and coverage disputes turn on specific language rather than general expectations. A broker who handles cyber claims and a lawyer who reads policies for a living are worth the time before renewal, not after an incident.
Photo: Mikhail Nilov / Pexels
