Plain-language reference
Cyber liability glossary
Common policy, claim and liability terms explained as general concepts. Definitions in an actual policy or law control over this glossary.
- Aggregate limit
- The maximum amount the policy may pay across covered claims during the applicable policy period, subject to wording and sublimits.
- Breach coach
- A term commonly used for counsel who helps coordinate legal and response issues after a cyber event. The role and privilege questions vary.
- Business interruption
- Coverage or a loss category involving income reduction and extra expense caused by a covered interruption, subject to definitions and waiting periods.
- Claims-made coverage
- Coverage generally tied to when a claim is first made and reported, together with policy dates, retroactive dates and other conditions.
- Coinsurance
- A requirement that the insured retain a stated percentage of certain loss after other policy terms are applied.
- Consent
- Insurer approval that may be required before appointing vendors, incurring costs, settling claims or taking other specified actions.
- Cyber extortion
- A demand connected to threatened or actual interference with systems, data or operations. Coverage and legality depend on wording and circumstances.
- Cyber liability insurance
- Insurance designed to address specified first-party cyber costs, third-party claims, or both.
- Data restoration
- Work to recover, recreate or repair data and systems after a covered event, subject to scope and valuation rules.
- Deductible
- An amount the insured pays or absorbs before covered insurance payment, depending on the policy structure.
- Defense costs
- Legal and related expenses for defending a covered claim. They may be inside or outside the policy limit.
- Dependent business interruption
- Interruption loss caused by a covered event affecting a specified supplier, service provider or other dependency.
- Endorsement
- A document that changes, adds or removes policy wording. Endorsements must be read with the base form.
- Exclusion
- Policy wording that removes or limits coverage for defined events, conduct, costs, parties or circumstances.
- First-party coverage
- Coverage for specified direct costs or losses suffered by the insured organization.
- Forensic investigation
- Technical work to determine what happened, what was affected, how the event developed and what evidence supports response decisions.
- Indemnity
- A contractual obligation by one party to compensate another for specified loss or claims.
- Insurer panel
- Vendors or professionals designated or approved by an insurer for certain response or claim work.
- Limit
- The maximum amount available under a coverage part or policy, subject to all other terms.
- Notification costs
- Costs of legal analysis, notice preparation, delivery, call-centre support, monitoring services or related work after a breach.
- Policy period
- The dates during which the policy is in force, subject to reporting and other conditions.
- Proof of loss
- A formal or practical submission supporting the nature and amount of claimed loss. Requirements vary by policy.
- Reservation of rights
- A communication explaining that the insurer is investigating or handling a matter while preserving specified coverage positions.
- Retention
- An amount or layer of loss retained by the insured. The practical operation may differ from a deductible.
- Retroactive date
- A date before which specified acts, events or circumstances may not be covered under claims-made or related wording.
- Sublimit
- A lower cap applying to a particular coverage, cost type, event or circumstance within the broader policy limit.
- Technology E&O
- Errors-and-omissions coverage addressing claims that technology products or services failed to perform as promised or caused financial loss.
- Third-party coverage
- Coverage for specified claims made against the insured by customers, individuals, partners, regulators or other parties.
- Underwriting application
- Information provided to obtain or renew coverage. Accuracy, wording and supporting records can become important in a claim.
- Waiting period
- A time threshold that must pass before certain interruption coverage begins, subject to policy wording.
- War exclusion
- An exclusion addressing war, hostile acts or related events. Cyber wording and interpretation can be complex and disputed.
- Wrongful act
- A defined act, error, omission or other conduct that may be required to trigger a liability coverage part.