When should you contact cyber insurance?

Notify before you pick a panel vendor

Audience: a founder, CTO, CISO, or incident commander who has a cyber policy and is mid-incident. The who-to-call page on this site is the contact map. This page is the insurance-notice step on that map: when to call the carrier, why the call often comes before you retain DFIR or outside counsel, and what they will ask. The contact-breach-counsel page on this site is the privilege-and-engagement checklist. The what-is-dfir page on this site is the DFIR explainer. A dedicated 'when you need DFIR' guide is not on this site yet; until it is, that role stays in prose.

The operational rule is: notice the insurer before you engage panel vendors. Many cyber policies treat prompt notice as a condition of coverage, and many require you to use a pre-approved panel for forensics, counsel, notification, and crisis communications — or to get written consent before you retain anyone else. NAIC Receivership and Insolvency Task Force materials on cyber claims record that some policies require a preapproved incident-response vendor list, and others require prior mutual agreement before a particular provider is retained. That is a description of common policy design, not a reading of YOUR form. Last verified 7 September 2026. Not legal advice. Not coverage advice.

• Find the policy (or the broker's claims packet) and the 24/7 breach hotline. The NAIC/FTC cyber-insurance consumer flyer tells buyers to ask whether the carrier offers a breach hotline available every day of the year at all times. Use the number on YOUR documents, not a number from a search result.
• Call as soon as the incident is a possible claim — in the first hour if that is what the notice clause says, not after you 'know everything'. Waiting for a complete forensic picture is how late-notice arguments start.
• Do not retain a DFIR firm, restorer, or outside counsel off the panel until you have asked the carrier (or the broker) which vendors the policy recognises. If a vendor is already on a retainer your policy pre-cleared, say so. The contact-breach-counsel page on this site is the privilege-and-engagement checklist. The what-is-dfir page on this site is the DFIR explainer. A dedicated 'when you need DFIR' guide is not on this site yet.
• Do not reimage, delete logs, or 'clean up' so the claim looks tidy. The FTC Data Breach Response guide is explicit: do not destroy forensic evidence during investigation and remediation. NIST SP 800-61r2's evidence-handling guidance is acquire, preserve, secure, and document. The first-24-hours page on this site is the hold checklist.
• Read YOUR policy. This page does not interpret it, does not bind a carrier, and does not rank carriers.

Generic policy-condition concepts — verify against YOUR policy

Cyber policies are contracts. The conditions below show up often enough that NAIC materials and incident-response practice treat them as expected questions. They are not a statute, not a model form, and not YOUR coverage. Some policies are stricter; some are quieter. Confirm each row against the form you actually bought, including endorsements and the panel list. Last verified 7 September 2026. Not legal advice. Not coverage advice.

What the insurer will ask — a checklist

Have this packet ready when you call the hotline or the broker. You will not have complete answers in the first hour. Incomplete-and-honest beats late-and-polished. This is an operational intake list distilled from what NAIC/FTC consumer guidance says first-party coverage typically pays for (forensics, counsel, notification, interruption, extortion) and from what CISA tells operators to track in the first response. It is not YOUR carrier's claim form.

• Named insured, policy number, broker, and the 24/7 breach-hotline number on YOUR documents.
• When you first became aware, in UTC, and how (alert, customer, law enforcement, employee). Discovery is often when a notice clause starts — this page does not decide that for you.
• What you observed: systems, accounts, identity plane, backups, a ransom note if one exists. Unknowns belong on the list, not in a guess.
• Whether personal data, payment data, or a regulated dataset might be involved. 'Might' is enough to flag; whether a notification duty has started is counsel's question.
• What you have already done: isolation, evidence hold, who you called, whether anyone reimaged or deleted logs. The first-24-hours page on this site is the hold-and-timeline checklist.
• Whether you have already retained counsel, DFIR, a restorer, or a notification vendor — names, when, and whether you believe they sit on the panel. If you have not retained anyone, say that. The contact-breach-counsel page on this site is the privilege-and-engagement checklist. The what-is-dfir page on this site is the DFIR explainer. A dedicated 'when you need DFIR' guide is not on this site yet.
• A single point of contact who will answer follow-ups (commander or in-house legal), on the out-of-band channel. NIST SP 800-61r2: designated people, not a blast.
• Whether a ransom or extortion demand is in play, and whether anyone has already paid or promised to. Do not negotiate on a channel the actor can see. This page is not ransom advice.

Insurer notice is not a regulator filing

Mixing these is how a coverage call turns into fake legal advice. Noticing your cyber carrier is a contract step. Reporting to CISA, the FBI, a state attorney general, a data-protection authority, or a sector regulator is a different kind of act — sometimes a legal duty, sometimes voluntary sharing. One does not discharge the other. Last verified 7 September 2026. Not legal advice.

CISA's #StopRansomware Guide tells operators to follow the notification requirements in their own incident-response plan and lists 'cyber insurance company' among the relevant stakeholders, next to IT, managed security providers, and leadership. The same guide's contact table has a Cyber Insurance row. That is operational handling advice from CISA, not a statute, and not a statement that a CISA report satisfies a policy notice clause — or the other way around.

The FTC Data Breach Response guide, which is US regulator guidance for businesses rather than a statute, tells firms to assemble a team that can include legal, forensics, information security, operations, communications, and management, and not to destroy forensic evidence. It does not tell you how to notice a carrier. The team list and the evidence hold still apply while you are on the phone with the insurer.

Do not mix policyholder notice with insurance-licensee notice. The NAIC Insurance Data Security Model Law (#668) is about insurance licensees notifying a state insurance commissioner of a cybersecurity event. It is not the clause in YOUR cyber policy, and it does not apply to you merely because you bought a policy. Counsel maps YOUR duties. Mapping is not filing.

Coverage pitfalls — common, not a ranking of denials

These are the ways a mid-incident team talks itself out of the call, or makes the call too late to use the panel. They are operational failure modes, not a prediction that YOUR claim will be denied, and not a ranking of carriers. Verify YOUR policy. Not coverage advice. Not legal advice.

• Waiting to 'know everything'. Notice clauses often run from discovery of an incident or circumstance, not from a finished forensic report. Incomplete-and-on-time is the job in the first hour.
• Hiring a favourite DFIR firm or law firm first, then telling the carrier. If the form requires the panel or prior consent, a unilateral engagement is a coverage argument you do not want. Ask first. The contact-breach-counsel page on this site is the privilege-and-engagement checklist. The what-is-dfir page on this site is the DFIR explainer. A dedicated 'when you need DFIR' guide is not on this site yet.
• Skipping notice to 'preserve privilege'. Common practice is that counsel directs DFIR so working papers can sit under attorney-client privilege — that is practice, not a ruling that privilege will attach on your facts, and not a reason to miss a notice clause. Privilege is a legal question for counsel. Coverage is a contract question on YOUR form.
• Reimaging or deleting logs so the environment 'looks contained' before the carrier or DFIR sees it. FTC: do not destroy forensic evidence. NIST SP 800-61r2: preserve, then eradicate.
• Treating a CISA report, an IC3 complaint, or a customer email as if it noticed the insurer. It did not. The hotline and the address on YOUR policy are the notice channel unless the form says otherwise.
• Negotiating a ransom or promising a payment without asking whether the form requires consent. The NAIC/FTC flyer lists cyber extortion among typical first-party coverages; consent, legality, and whether to pay are not this page's job.
• Naming two owners for the carrier. Split instructions are how two scopes, two vendor retainers, and two stories get born. One commander, one carrier contact.

Where this shows up in ShipReady Metrics

The signed-in app does not notice an insurer, interpret a policy, retain a panel vendor, or file a claim. It does not keep a copy of your policy. If you already have a session: signed-in app → Compliance → CRA reporting tracks the 24-hour / 72-hour / 14-day ladder from your recorded awareness for findings the org has classified as CRA-in-scope. That ladder is not an insurer notice, it does not start a clock for you, and it is not a determination that CRA applies. A named human still submits. None of those surfaces is a substitute for the commander, counsel, the insurer, or DFIR.

Primary sources (last verified 7 September 2026)

Every operational and regulatory claim on this page is taken from one of these. If a later revision of a source changes the advice, the date above is how you can see we have not re-checked yet.

The NAIC/FTC 'Cyber Insurance' consumer flyer is guidance for buyers on what first-party and third-party cyber coverage typically includes (forensics, legal counsel, notification, interruption, extortion, a 24/7 breach hotline) — it is not a policy form and not coverage advice on YOUR contract. NAIC Receivership and Insolvency Task Force cyber-claims materials describe panel-vendor and prior-agreement conditions as they appear in policies; they do not interpret YOUR policy. NAIC Insurance Data Security Model Law (#668) governs insurance-licensee notice to a state insurance commissioner, not policyholder notice to a cyber carrier. CISA's #StopRansomware Guide lists the cyber insurance company as a response stakeholder. The FTC Data Breach Response guide is business guidance from a US regulator; do not destroy forensic evidence. NIST SP 800-61 Revision 2 remains the current final Computer Security Incident Handling Guide (August 2012) — guidance, not a statute.

Frequently asked questions