Contingent business interruption in cyber insurance

Contingent business interruption (CBI) is cyber insurance cover for lost income when an outage at someone else’s systems, such as a cloud, payment or software provider you rely on, stops you operating even though your own network was not attacked. Insurers also call it dependent business interruption.

What it means in practice

Ordinary cyber business interruption cover responds when your own systems go down. CBI responds when a provider’s systems go down and you can’t earn revenue as a result. Example: your online store runs on a hosted e-commerce platform. The platform is hit by ransomware and is offline for two days. Your own network is fine, but you can’t take orders.

Don’t confuse it with property cover. Business interruption under a property policy generally needs physical damage to insured property. Cyber cover doesn’t, but it comes with its own conditions.

Wordings vary by insurer, so what follows are questions to ask, not promises. Broker and insurer guides describe the same handful of differences.

Start with which providers count. Some policies cover any provider of services to you. Others limit cover to IT or cloud providers, or to vendors you name or schedule. Some add non-IT suppliers as a separate extension, and some exclude infrastructure such as internet or power providers.

Then ask what triggers it. Most CBI responds to a security failure at the provider, meaning an attack. Cover for an accidental outage or software defect, often called system failure, is less common and is often sublimited. Some insurers pay for total shutdowns but not partial or intermittent ones.

Finally, check limits and waiting periods. CBI may sit under a sublimit smaller than the full policy limit, and a waiting period, often counted in hours, applies before loss begins to count.

Canadian wordings vary too. At least one Canadian cyber product lists dependent non-IT service provider and critical service provider business interruption as extensions. The Insurance Bureau of Canada notes that one widely used technology failing can hit many organizations at once, and that outcomes turn on the policy language.

Where it shows up in an incident

CBI matters when a vendor you depend on goes down. The CFO or risk manager usually owns it, with the broker. Notice should go to the insurer promptly. One US law firm’s insurance recovery blog calls prompt notice critical.

The usual mistakes are assuming a vendor outage is covered without reading the trigger and the provider definition, and not knowing which vendors the policy names. Another is keeping no record of when the outage started and ended, which sets both the waiting period and the amount of loss. A vendor’s service credit, meanwhile, is not a replacement for lost income.

In a tabletop exercise

Sample inject: “Your cloud billing provider tells customers it is investigating a security incident. Your team can’t invoice or collect payments. After six hours the provider says it has no estimated restoration time. Does anyone know whether the cyber policy covers vendor outages, which vendors it names, and when the waiting period starts? Who tells the broker?”

Discussion question: “Which three outside providers could stop us earning revenue, and are they on our dependency map and in our policy wording?”

What is contingent business interruption in cyber insurance?

What it means in practice

Where it shows up in an incident

In a tabletop exercise

Sources