Cyber Business Interruption Insurance

The period of restoration is the window during which your income loss is measured. It typically begins after the waiting period expires and ends when your systems are restored to the condition they were in immediately before the event, or when they reasonably should have been restored using due diligence.

That second clause matters enormously. If your IT team delays remediation or your disaster recovery plan is outdated, the insurer can argue the period of restoration should have ended sooner. Some forms cap this period at 90, 120, or 180 days regardless of actual recovery time. You need to know your cap before binding, because a complex ransomware recovery can extend well beyond 90 days for a mid-market company without redundant infrastructure.

A waiting period functions as a time-based retention rather than a dollar-based deductible. Common waiting periods range from 8 to 24 hours, though some forms impose 6, 12, or even 48 hours. During this window, no income loss is reimbursable.

Here is the nuance that catches buyers off guard: some policies measure loss only after the waiting period ends, while others measure loss from hour one but subtract the waiting period amount from the total payout. The difference can be significant. An 8-hour waiting period on a "loss from hour one" form is far more favorable than an 8-hour period where measurement begins at hour nine. Bloc Cyber reviews this specific language at the form level before binding, because the distinction is buried in the policy wording and rarely surfaces in a summary of coverage.

Extra expense coverage reimburses costs you incur to reduce or avoid what would otherwise be a larger income loss. Renting temporary server capacity, hiring emergency IT contractors, or moving operations to a backup facility all qualify under most forms.

The key condition is that the expense must actually mitigate the loss. If you spend $50,000 on emergency cloud migration but it does not reduce your downtime, the insurer may deny that portion. Some forms also cap extra expense at the amount of income loss it prevented, meaning you cannot spend more to mitigate than the loss itself. Others provide a separate sublimit for extra expense. Knowing which structure your form uses affects how aggressively you can spend during an incident.

No two cyber policy forms are identical. Carriers draft their own proprietary wordings, and the definitions of "computer system," "service provider," and "restoration" vary meaningfully. A healthcare company subject to HIPAA and state breach-notification laws faces different regulatory exposure than a manufacturing firm, and the policy form should reflect that.

Industry-specific endorsements can modify waiting periods, add regulatory penalty coverage, or expand the definition of covered systems to include operational technology and IoT devices. Reading the actual insuring agreements, not just the declarations page, is the only way to confirm what your policy covers.

Does cyber business interruption cover voluntary shutdowns? Some forms cover voluntary shutdowns if they are undertaken in good faith to mitigate a covered event. Others require the interruption to be involuntary. Check your policy's "interruption" definition.

Can I recover lost profits from a dependent vendor's outage? Only if your policy includes dependent business interruption coverage and the vendor's event meets your policy's trigger definition. The sublimit and waiting period for DBI are often different from your primary coverage.

What happens if my waiting period is longer than my actual downtime? You receive no payout. If your systems are restored within the waiting period, the policy does not respond. This is why shorter waiting periods carry higher premiums.

Are cloud provider outages covered? They can be, under either DBI or system failure provisions, depending on how your form defines covered systems and service providers. Not all forms treat cloud infrastructure the same way.

Do I need separate coverage for ransomware-related downtime? Most cyber forms cover ransomware under the security failure trigger. The income loss from encrypted systems falls under business interruption, while the ransom payment itself falls under a separate insuring agreement, typically called cyber extortion.

Cyber business interruption insurance is not a single coverage: it is a collection of interdependent provisions that must be evaluated individually. The waiting period controls when coverage begins. The period of restoration controls when it ends. The income loss formula determines how much you recover. Extra expense, dependent business interruption, and system failure provisions each expand or restrict the policy's reach in ways that only become visible when you read the form.

A policy that looks adequate on a summary page can fail at the claim stage if the waiting period is too long, the DBI sublimit is too low, or the trigger excludes non-malicious system failures. The only way to know is to review the actual policy language before you bind.

If you are purchasing or renewing cyber coverage, consider having a specialist review your policy form with you. Bloc Cyber's practice is built around reading the insuring agreements, endorsements, and sublimits that control whether a claim pays, so you understand your coverage before you need it.