What does cyber insurance cover?

Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.

Does my business really need cyber insurance?

Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.

How much does cyber insurance cost?

Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.

How fast can I get a quote?

Most clients receive a quote in under 24 hours after we review the details of their business and exposure.

What should I do first after a cyberattack?

Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

Investment Tax Credit Insurance (Apply for Coverage)

A solar project closes financing, the developer records a federal investment tax credit worth millions, and then an IRS audit questions whether the facility met placed-in-service requirements or complied with prevailing wage rules. The credit is partially or fully disallowed, and the financial model collapses. This scenario is precisely why insurance products designed to protect investment tax credits have become a standard risk-transfer tool in the renewable energy sector. Understanding how ITC insurance works, what it covers, and where gaps remain is essential for any company participating in the tax credit transfer market or structuring tax equity deals. The transferable tax credit market grew from $9 billion in 2023 to between $25 billion and $30 billion by 2025, and that expansion has only accelerated. With that growth comes a corresponding increase in exposure to IRS challenges, making insurance not a luxury but a structural necessity for most transactions.

The Inflation Reduction Act of 2022 reshaped how renewable energy tax credits function, introducing transferability under Section 6418 and expanding bonus credit adders tied to domestic content, energy communities, and prevailing wage and apprenticeship compliance. ITC insurance policies are designed to indemnify the insured party if a claimed credit is reduced or disallowed by the IRS. The policy typically covers the dollar value of the lost credit, plus associated penalties and interest, and sometimes gross-up amounts to make the insured whole on an after-tax basis.

These policies are not standardized. Each one is negotiated and placed on a form-specific basis, meaning the insuring agreements, exclusions, sublimits, and conditions vary materially from one placement to another. That is why reading the actual policy form matters more than relying on a broker's summary.

In a traditional tax equity structure, the investor takes an ownership stake in the project and claims the credit directly. The investor's diligence is extensive because its own tax position is at stake. In a Section 6418 transfer, the buyer purchases the credit from the seller at a discount, typically 90 to 94 cents per dollar of credit. If the IRS later disallows or reduces the credit, the buyer bears the loss unless insurance or contractual indemnities shift that risk.

ITC insurance bridges the gap between what contractual indemnities promise and what a project sponsor can actually pay. A small developer may not have the balance sheet to stand behind a $10 million indemnity obligation. Insurance provides a creditworthy backstop, and tax credit insurance mitigates risk for transfers but does not eliminate the need for thorough diligence.

Basis risk in the ITC context refers to the possibility that the IRS determines the eligible cost basis of the project is lower than what the developer claimed. If a project claims a $50 million basis and the IRS revalues it at $40 million, the 30% credit drops from $15 million to $12 million. That $3 million shortfall is a direct loss to whoever claimed or purchased the credit.

Insurance policies that cover basis risk will typically require an independent appraisal of the project's fair market value and eligible costs before binding. The underwriter reviews the appraisal methodology, the allocation between eligible and ineligible property, and the reasonableness of soft costs included in basis. Buyers who skip this step expose themselves to a coverage gap if the policy excludes losses arising from inflated or unsupported basis calculations.

We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.

A project is generally considered placed in service when it is ready and available for its intended function. For solar, that typically means interconnection to the grid and completion of commissioning tests. The IRS looks at objective evidence: interconnection agreements, utility acceptance letters, commissioning reports, and operational logs.

Insurance underwriters will request this documentation before binding a policy. If a project claims a 2025 placed-in-service date but interconnection did not occur until January 2026, the credit may be disallowed for the 2025 tax year. The policy form will specify whether it covers timing disputes, and some forms exclude losses arising from projects that were not genuinely operational by the claimed date. You need to confirm this coverage grant before closing.

The ITC is subject to recapture if the project ceases to qualify during the five-year period following the placed-in-service date. Common triggers include sale of the project to a tax-exempt entity, reduction in the project's qualifying use below the required threshold, or cessation of operations that causes a partial or full credit clawback.

Recapture insurance covers the financial loss if a recapture event occurs through no fault of the insured. Policies typically exclude intentional acts by the insured that trigger recapture, such as voluntarily selling the project to a disqualified buyer. The recapture amount declines by 20% per year, so the exposure is highest in years one and two. Buyers should confirm whether the policy covers the full five-year period or only a portion.

Coverage Element	General Cyber Policy	Cryptojacking Endorsement
Unauthorized cloud compute charges	May be excluded or subject to low sublimit	Explicitly covered, often with higher sublimit
Incident response and forensics	Typically included	Included
Business interruption from degraded performance	Covered if waiting period is met	Covered, sometimes with shorter waiting period
Container/Kubernetes remediation	Covered under system restoration if triggered	Explicitly addresses cloud-native environments
Cloud bill reimbursement	Varies widely by form	Specifically designed for this loss type
Retention (deductible)	Standard retention applies	May have separate, lower retention

Some regulatory proceedings involve parallel tracks: the regulator's formal action and an internal investigation your company runs simultaneously. Shadow defense counsel represents your company's interests during the regulatory process without formally appearing before the agency. Monitoring counsel may be appointed under a consent order to oversee your compliance.

The costs for these roles can be substantial. Certain policy forms cover shadow counsel fees as part of the defense cost grant, while others exclude them entirely. Court-appointed monitors in state enforcement actions have generated significant fees that strain organizational budgets, and whether your policy responds to those costs depends on how the form defines "defense costs" and "regulatory proceeding."

Shadow Defense and Monitoring Counsel Roles

PWA-specific insurance covers the risk that the IRS determines the project failed to meet prevailing wage or apprenticeship standards, resulting in loss of the bonus credit multiplier. Some policies also cover the penalty amounts associated with correction payments if the cure mechanism is invoked.

This coverage is particularly valuable because PWA compliance involves thousands of individual payroll records across multiple subcontractors. Even well-managed projects can have gaps. A single subcontractor paying below the prevailing rate for a misclassified trade can jeopardize the entire bonus credit. Insurance does not excuse sloppy compliance, but it does protect against the financial consequences of honest errors.

Prevailing wage compliance requires paying workers at rates determined by the Department of Labor for the project's geographic area and labor classification. Apprenticeship requirements mandate that a specified percentage of total labor hours be performed by qualified apprentices. The final regulations detail specific recordkeeping obligations, including certified payroll records, good-faith effort documentation for apprenticeship requests, and cure provisions for inadvertent violations.

The cure mechanism is critical. If a developer discovers a wage underpayment, it can correct the violation by paying back wages plus interest and a penalty equal to $5,000 per worker affected. This cure right preserves the bonus credit, but only if the correction is timely and properly documented. Your diligence process should verify that the developer has systems in place to track compliance in real time, not just at project completion.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Average defense costs for technology professional liability claims range from $50,000 to $150,000 depending on complexity and jurisdiction. Settlement amounts vary widely, but six-figure demands are common even for small firms.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

How much does a typical PCI forensic investigation cost?

PFI engagements range from $20,000 for a simple, small-merchant investigation to $120,000 or more for complex environments with multiple locations or e-commerce platforms. The card brands dictate the scope, and the merchant pays.

Buyers in the Section 6418 transfer market face a unique challenge: they are purchasing a tax attribute from a project they do not own or control. The due diligence checklists developed for transfer transactions are extensive, covering project eligibility, basis support, PWA compliance, placed-in-service evidence, and environmental and permitting status.

A mid-market company buying its first transferable tax credit, perhaps a profitable manufacturer or professional services firm, needs to understand that this is not a passive investment. The buyer's tax return will reflect the credit, and the buyer bears primary risk of disallowance. Insurance is one layer of protection, but it does not replace the need to review project documentation, tax opinions, and independent engineer reports before closing.

Feature	Seller-Side Coverage	Buyer-Side Coverage
Named insured	Project developer or sponsor	Credit purchaser
Trigger	IRS challenge to the credit	IRS disallowance on buyer's return
Basis risk	Covered if appraisal supports basis	Covered, but buyer relies on seller's appraisal
PWA compliance	Developer controls records	Buyer depends on developer's documentation
Recapture	Developer manages ongoing compliance	Buyer has no operational control
Cost allocation	Typically borne by seller	Buyer pays premium directly
Typical premium range	2-5% of credit value	3-6% of credit value

No. A data breach or cyberattack is a cyber liability exposure, not a technology E&O exposure. You need a separate cyber liability policy form to cover breach response, notification costs, regulatory defense, and third-party claims arising from a security incident. Many technology companies carry both policies because the exposures are distinct.

FAQ: Does this cover me if I get hacked?

P2PE encrypts cardholder data from the point of interaction (the card reader) to the payment processor's secure decryption environment. A validated P2PE solution removes your systems from PCI scope for those transactions, which directly reduces both your compliance burden and your risk profile. Underwriters recognize P2PE as a meaningful risk reduction and may offer premium credits for merchants using validated solutions.

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

Underwriters expect access to the buyer's due diligence reports, the virtual data room, and the near-final purchase agreement. They review financial, tax, legal, environmental, intellectual property, and employment diligence. Gaps in diligence translate to broader exclusions on the policy. If the buyer skipped an environmental Phase I assessment, for instance, the underwriter will likely exclude environmental representations from coverage entirely. Firms like Bloc Cyber, whose practice centers on reading policy forms at the insuring-agreement level, often advise clients that the quality of your diligence directly determines the quality of your coverage.

Tax indemnity agreements are contractual promises from the seller to reimburse the buyer if the credit is disallowed. They are only as strong as the seller's financial capacity to pay. A well-capitalized utility holding company can stand behind a $20 million indemnity. A single-project LLC with no assets beyond the project cannot.

ITC insurance, by contrast, transfers the risk to a rated insurance carrier. The carrier's ability to pay does not depend on the project's success or the developer's solvency. The policy form defines covered events, exclusions, and claims procedures independently of the purchase agreement. For mid-market buyers, the distinction matters enormously: you are not just buying a promise, you are buying a promise backed by an insurer's claims-paying ability.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

Will my policy pay for the fines if I'm not compliant?

This depends entirely on the policy form. Some forms cover PCI fines only if the merchant was making good-faith compliance efforts. Others exclude fines arising from known non-compliance. Read the exclusions carefully before binding.

How much does a typical PCI forensic investigation cost?

What is the difference between a fine and an assessment?

A fine is a penalty for non-compliance with PCI DSS standards. An assessment is a cost-recovery mechanism: the card brands and issuing banks recoup their actual losses (fraud charges, card replacement costs) from the breached merchant. Both are financial obligations, but they arise from different triggers and may be treated differently under a policy form.

How much does ITC insurance typically cost? Premiums generally range from 2% to 6% of the insured credit value, depending on project type, basis complexity, and whether the policy covers PWA risk. Larger, well-documented projects tend to fall at the lower end.

Does ITC insurance cover intentional noncompliance? No. Policies uniformly exclude losses caused by the insured's fraud, willful misconduct, or intentional failure to comply with tax requirements.

Can a buyer purchase ITC insurance after closing the transfer? Some carriers will bind post-closing, but premiums are typically higher and underwriting is more restrictive. Binding before or at closing is standard practice.

Is a tax opinion still necessary if I have insurance? Yes. Most underwriters require a "will" or "should" level tax opinion from independent counsel as a condition of coverage. The opinion and the insurance serve different functions.

What happens if the IRS audits the project years after the transfer? The policy remains in force for its stated term, which typically extends through the statute of limitations for the relevant tax year plus any extensions. Claims can be made during the policy period regardless of when the audit begins.

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

Energy projects increasingly depend on networked monitoring systems, SCADA infrastructure, and cloud-based compliance platforms. A data breach that compromises payroll records used to demonstrate PWA compliance, or a ransomware attack that destroys placed-in-service documentation, can create real problems during an IRS audit. Companies active in the tax credit transfer market should consider whether their cyber liability coverage addresses the specific data assets that support their tax positions. At Bloc Cyber, we review policy forms at the insuring-agreement level to identify whether your cyber coverage responds to scenarios like destruction of compliance records or unauthorized access to financial systems tied to tax credit claims.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

Will my policy pay for the fines if I'm not compliant?

How much does a typical PCI forensic investigation cost?

What is the difference between a fine and an assessment?

The ITC insurance market has matured rapidly alongside the growth of Section 6418 transfers. Policies now address basis risk, placed-in-service disputes, recapture events, and PWA noncompliance with increasing specificity. But no two policy forms are identical, and the details of exclusions, sublimits, and conditions matter as much as the headline coverage grant.

If your company is buying transferable tax credits or participating in tax equity structures, treat insurance placement with the same rigor you apply to the underlying transaction diligence. Read the policy form. Understand what triggers a claim and what the exclusions carve out. Pair your ITC insurance with appropriate cyber coverage for the digital systems that store and manage your compliance documentation.

If you are evaluating how your existing insurance program responds to these exposures, request a review so a specialist can walk through the policy form with you and identify where coverage stops before a claim finds the gap.

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Get In Touch

Investment Tax Credit Insurance

Understanding Investment Tax Credit Insurance in the Inflation Reduction Act Era

The Role of ITC Insurance in Tax Equity and Transferability

Why Basis Risk and Valuation Matter for Renewable Energy Projects

Navigating Technical Compliance: Placed-in-Service and Recapture Risks

Meeting Placed-in-Service Documentation Requirements

Common Recapture Events and How Insurance Protects Investors

Shadow Defense and Monitoring Counsel Roles

Prevailing Wage and Apprenticeship (PWA) Rule Verification

Ensuring Compliance to Secure the 30% Credit Multiplier

Audit Protection and PWA Penalty Insurance

How much does a typical PCI forensic investigation cost?

Due Diligence for the Tax Credit Transfer Market

Seller-side vs. Buyer-side Coverage Comparison

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

Comparison: Tax Indemnity vs. ITC Insurance Coverage

Will my policy pay for the fines if I'm not compliant?

How much does a typical PCI forensic investigation cost?

What is the difference between a fine and an assessment?

Common Questions About ITC Insurance

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

How Cyber and Technology Risk Intersects with Energy Project Diligence

Will my policy pay for the fines if I'm not compliant?

How much does a typical PCI forensic investigation cost?

What is the difference between a fine and an assessment?

Making the Right Choice for Your Energy Project

Caden Braly

Cyber Coverage Built for Your Industry

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

Healthcare

One foundation.Ten industry-specific builds.

A policy you can actually read.Structured in three clean blocs.

First-Party

Third-Party

Specialty

Cyber Liability Insurance, Explained

What does cyber insurance cover?

Does my business really need cyber insurance?

How much does cyber insurance cost?

What is the difference between first-party and third-party cyber coverage?

How fast can I get a quote?

What should I do first after a cyberattack?

Field notes from the placement desk.What carriers are asking right now.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Defense Contractor Cyber Risk: Protecting Controlled Unclassified Information

Retail Cyber Risk: Payment Data, Loyalty Systems and Seasonal Exposure

Tell us about your business.We’ll come back with terms.

One foundation.
Ten industry-specific builds.

A policy you can actually read.
Structured in three clean blocs.

Field notes from the placement desk.
What carriers are asking right now.

Tell us about your business.
We’ll come back with terms.