What does cyber insurance cover?

Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.

Does my business really need cyber insurance?

Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.

How much does cyber insurance cost?

Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.

How fast can I get a quote?

Most clients receive a quote in under 24 hours after we review the details of their business and exposure.

What should I do first after a cyberattack?

Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

NERC CIP Compliance and Cyber Insurance for Bulk Electric System Operators

Feature	Commercial General Liability (CGL)	Cyber Privacy Liability
Covers bodily injury/property damage	Yes	No
Covers wrongful collection of data	No (excluded by most ISO forms)	Yes
Responds to BIPA claims	Typically excluded or sublimited	Yes, if biometric coverage is included
Covers regulatory defense	No	Yes, under most forms
Covers class action defense costs	Only for covered claims (rare for privacy)	Yes, subject to policy terms
Duty to defend vs. duty to reimburse	Duty to defend (standard)	Varies by form: check your policy

A transmission cooperative with 140 employees passes its CIP audit, renews its cyber policy, and assumes the two documents protect the same assets. Six months later, a vendor laptop introduces malware into a substation network, a protective relay misoperates, and a transformer fails. The audit file and the policy wording now tell two very different stories.

NERC CIP compliance and cyber insurance for bulk electric system operators are often bought, managed, and reviewed by different people inside the same organization. The compliance team owns the evidence binders. The CFO or risk manager owns the renewal. Neither group usually reads the other's documents closely, and that separation is where the uninsured losses begin.

This guide works through the questions that decide whether a policy form responds after a grid-affecting cyber event. It covers operational technology exposure, mass outage liability, regulatory penalties, business interruption, and how to set limits that match your actual loss scenarios. The answers sit in the insuring agreements, the exclusions, and the endorsement schedule, not in the summary page your broker sends.

NERC CIP is a compliance framework. Cyber insurance is a risk transfer contract. The two overlap, but they measure different things: CIP asks whether you followed a documented control, while your policy asks whether a covered event caused a covered loss.

The threat environment has made that distinction expensive. The 2025 Reliability Risk Priorities Report ranks grid transformation and cybersecurity vulnerabilities as the top two risks to the Bulk Electric System. Underwriters read the same reports you do, and their application questions increasingly mirror CIP language.

That mirroring creates a trap. Your application answers about access control, patching, and remote access become representations in the contract. If your CIP-007 patch evidence shows a 35-day gap on a medium-impact asset and your application stated you patch critical systems within 30 days, a carrier may contest the claim on misrepresentation grounds. The compliance file becomes the carrier's evidence.

We recommend that compliance and risk staff review the application together before signing it. Here's what that means for you:

Match every application answer to a specific CIP evidence artifact.
Flag any control that applies to high- and medium-impact assets but not low-impact ones.
Disclose known Possible Violations or self-reports in progress, rather than letting the carrier discover them after a loss.

A clean audit is not a clean application. Treat them as two separate filings.

We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.

This comparison underscores why relying on a single policy form without reading the endorsements creates dangerous gaps. A thorough form-level review, the kind Bloc Cyber performs before placement, identifies whether your social engineering sublimit actually matches your average outbound wire size.

Most cyber policies were drafted for data. They respond well to stolen records, encrypted file servers, and extortion demands against corporate networks. Your exposure, by contrast, sits in energy management systems, SCADA servers, historians, RTUs, and protective relays.

The threat has moved toward that equipment. A 2026 CISA alert described a December 2025 incident in Poland where wiper malware destroyed HMI data and corrupted RTU firmware in the energy sector. Corrupted firmware is not a data restoration problem. It is a hardware replacement problem, and many forms treat those differently.

The policy definition of "computer system" decides whether your OT environment is even in scope. Some forms define it broadly to include industrial control systems. Others limit it to systems "used for the processing or storage of electronic data," which a carrier may argue excludes a relay or a PLC.

Read three definitions closely: computer system, data, and network security failure. If your relays and RTUs fall outside those definitions, a ransomware event that pivots from the corporate network into OT may be covered only up to the IT boundary. That boundary rarely matches your Electronic Security Perimeter. Ask your broker to confirm, in writing, how the form treats assets inside your ESP.

Standard cyber forms commonly exclude bodily injury and property damage. Your property policy may, in turn, carry a cyber exclusion. The transformer in our opening scenario can fall between both contracts.

The solutions vary by form:

Cyber policy endorsement: adds property damage arising from a security failure, usually with a sublimit.
Property policy write-back: removes or narrows the cyber exclusion for physical loss.
Standalone cyber physical damage policy: written specifically for tangible loss caused by a network event.

If neither policy affirmatively addresses cyber-caused physical damage, assume neither will pay.

Coverage Element	Standard Policy	Comprehensive Policy
Ransom Payment Sublimit	$100,000 - $250,000	Full policy limit
Negotiation Services	Panel vendor only	Choice of vendor with pre-approval
Sanctions Screening	Included	Included with legal counsel
Data Restoration	Subject to separate sublimit	Included in aggregate limit
System Rebuild	Limited to like-kind replacement	Includes upgrades if required by regulation
Business Interruption Waiting Period	12 - 24 hours	6 - 8 hours
Dependent Business Interruption	Excluded	Included with sublimit

Internal Threats: When Employee Information is Compromised

Employee data exposure is often overlooked in privacy liability planning. Your HR systems hold Social Security numbers, direct deposit information, health records, and sometimes biometric data. A breach of employee records triggers notification obligations under state law and can generate lawsuits from your own workforce.

Insider threats, whether from a disgruntled employee exfiltrating data or a payroll vendor suffering a breach, create exposure that sits at the intersection of cyber liability and employment practices liability. Not every cyber form covers claims brought by employees: some policies contain an "insured vs. insured" exclusion that bars coverage when the claimant is also an employee. This is a gap that must be identified during the placement process, not discovered during a claim.

A distribution utility serving 60,000 meters loses load for 11 hours after an attack on its control center. Commercial customers file claims for spoiled inventory. A hospital alleges its backup generation was strained. A municipal water system downstream reports pressure loss.

Those are third-party claims, and the question is whether your liability coverage responds. Many cyber forms carry an infrastructure or utility exclusion that removes losses arising from "failure of power, utility, or telecommunications infrastructure." The exclusion was written to protect carriers from widespread outages caused by others. Read literally, it can also strip coverage when you are the utility that failed.

Pay attention to how the exclusion is drafted. Some forms exclude only outages of infrastructure "not under the insured's operational control." That wording preserves coverage for your own systems. Broader wording excludes any power failure, regardless of who controlled the asset.

The war and state-actor question compounds this. The market's model cyber war clauses include provisions addressing state-backed attacks that impair the functioning of a nation's essential services. Grid attacks are the textbook example of that language. If your form includes such a clause, you need to know how attribution is decided and who bears the burden of proving it.

Your tariff matters too. Many state-approved tariffs limit utility liability for service interruptions absent gross negligence. A carrier may still owe defense costs even when your tariff ultimately defeats the claim, so defense coverage carries real value even where indemnity exposure seems low.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

Carriers view social engineering as a high-frequency, controllable-risk exposure. Unlike a data breach that may involve millions of records, a wire fraud loss is often the result of a single procedural failure. Insurers price and limit accordingly. A company with a $1 million crime policy might carry only $250,000 in social engineering coverage. If a single BEC attack costs $400,000, the policy pays $250,000 and the insured absorbs the rest. Some endorsements also apply co-insurance, meaning the carrier pays only 50% or 75% of the loss up to the sublimit. On a $250,000 sublimit with 50% co-insurance, your maximum recovery is $125,000.

Why Social Engineering Limits are Lower Than Policy Aggregate

Social engineering losses are almost always first-party: your company sent money to a criminal. The loss belongs to you, not to a customer or third party filing a claim against you. This distinction matters because third-party liability coverage on a cyber form will not respond. You need a first-party coverage grant, either within a crime policy or as a standalone endorsement, that explicitly names social engineering or fraudulent impersonation as a covered peril.

The Importance of First-Party vs. Third-Party Loss

The penalty exposure is larger than most finance teams model. The statutory maximum for a CIP violation now stands at $1,584,648 per violation, per day following the January 2025 adjustment. Actual settlements run far lower, but they are not trivial, and they are not limited to technical control failures.

Process failures draw penalties as well. In October 2025, LADWP faced a $350,000 civil penalty for providing false or misleading information during a 2020 audit. That violation concerned candor with regulators, not a breach.

New obligations expand the target. CIP-003-9, now enforceable, requires low-impact BES operators to detect and disable malicious vendor remote access communications. Smaller generator owners and cooperatives that previously treated low-impact compliance as a documentation exercise now carry technical obligations, and new evidence gaps.

The fine is often not the largest cost. The same analysis notes that utilities spend substantial staff time on three to six years of retrospective auditing and rebuilding compliance records. That internal labor is rarely insurable.

Most cyber forms cover regulatory defense and penalties only when they arise from a privacy or security event. A NERC penalty for an access control failure discovered during a routine audit, with no breach, typically falls outside that trigger.

Some specialized energy products now offer affirmative coverage for NERC and FERC penalties even without a system breach. Before you rely on that grant, check four points:

Whether the trigger is a "regulatory proceeding" or requires a "security event."
Whether penalties are covered "where insurable by law," and which state's law governs.
Whether defense costs erode the limit.
Whether self-reported violations count as claims, and when they must be noticed.

The distinction between a breach-triggered grant and a standalone regulatory grant is the entire coverage question.

Business interruption is the coverage most poorly suited to utilities in standard forms. The typical cyber BI grant pays lost net income plus continuing expenses during a period of restoration. Utility revenue does not behave like a retailer's.

Consider an investor-owned utility whose rate base guarantees recovery of certain costs. Its lost revenue during an outage may be partly recoverable through regulatory mechanisms. A carrier will argue that recoverable revenue is not a loss. A merchant generator, by contrast, loses wholesale market revenue in real time and may face replacement power costs to meet contractual delivery obligations.

Those replacement power costs are the issue that catches buyers. A generator that cannot deliver under a bilateral contract may need to purchase energy at spot prices during a peak event. Some forms treat that purchase as an extra expense. Others exclude it as a contractual liability or a consequential loss.

Waiting periods matter as well. A 12-hour waiting period is common on corporate cyber policies. For a generator during a summer peak, the most expensive hours may fall inside that window.

Most cyber forms cap the period of restoration at 90 to 180 days, or sometimes less. That works for a ransomware event against file servers. It fails when the event destroys firmware or damages a large power transformer with a long replacement lead time.

Build the indemnity period from your actual restoration timeline. Map each critical asset to its replacement lead time, commissioning schedule, and testing requirements under your own CIP change management procedures. If your recovery plan assumes 14 months to replace a generator step-up transformer, a 120-day indemnity period leaves 10 months uninsured. Ask whether the form offers an extended period of indemnity after operations resume, since revenue often lags restoration.

Your exposure extends to vendors. A SCADA vendor, a managed security provider, or a balancing authority suffers an attack, and your operations stop even though your network was never touched.

Contingent BI responds to that scenario only when the form defines the dependent business broadly. Check whether "dependent business" includes:

Named OT vendors and integrators with remote access
Cloud-hosted historian or analytics platforms
Third-party operators of shared transmission or interconnection facilities

Many forms sublimit contingent BI at a fraction of the direct BI limit, or restrict it to IT providers. Given CIP-013 supply chain obligations and CIP-003-9 vendor remote access controls, your vendor list should drive this sublimit, not the carrier's default.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

It depends on your policy. Many standard policies require a specific "Cyber Crime" endorsement to cover losses from being tricked into sending money to a fraudster.

Does cyber insurance cover social engineering scams?

Is deepfake fraud covered under standard impersonation terms?

It depends entirely on the policy language. Many forms written before 2024 reference only email or written communication. If the endorsement does not explicitly include voice or video impersonation, a deepfake-based claim may fall outside the coverage grant. Ask your broker to confirm the form addresses synthetic media.

Provision	Standard Cyber Form	Specialized Energy Form
Computer system definition	IT and data systems	May include ICS, SCADA, OT
Physical damage	Usually excluded	May be endorsed with sublimit
Bodily injury	Excluded	Sometimes written back for OT events
Utility/infrastructure exclusion	Broad	Often narrowed to third-party infrastructure
NERC/FERC penalties	Breach-triggered, if any	May be affirmative, no breach required
BI indemnity period	90 to 180 days typical	Longer periods may be negotiable
Replacement power costs	Rarely addressed	May be extra expense
Contingent BI	IT providers only	May include OT vendors
War/state-actor clause	Model clause language	Same exposure, negotiated attribution

None of these columns is automatically superior. A specialized form with a $2 million physical damage sublimit inside a $25 million tower may give you less real protection than a standard form paired with a property write-back. The comparison you need is provision by provision against your loss scenarios, not product name against product name.

The market is also moving. U.S. cyber direct written premiums reached approximately $9.46 billion in 2025, up 3.5%, and capacity for OT-heavy risks remains narrower than for general commercial accounts. Expect underwriters to ask for detailed segmentation evidence before offering broader grants.

Limits are often set backward. A buyer asks what peers purchase, picks a round number, and builds a tower to fit the budget. That approach answers a procurement question, not a risk question.

For a bulk electric system operator, sound limits start from the largest credible loss and then account for how sublimits and retentions carve that limit into smaller usable pieces. A $10 million aggregate limit with a $1 million regulatory sublimit, a $2 million physical damage sublimit, and a $500,000 contingent BI sublimit is not $10 million of protection against a grid event. It is $10 million of protection against the narrow set of losses that fall under no sublimit.

Retentions deserve equal scrutiny. A $250,000 retention may look manageable on a budget spreadsheet. Stress-test it against cash flow during an outage month, when revenue is down and restoration costs are front-loaded. If your cooperative cannot fund the retention while also financing emergency equipment purchases, the retention is set too high, regardless of the premium savings.

Build three to five scenarios and price each one by component. A useful set for a mid-sized operator might include:

Ransomware confined to IT: forensics, restoration, extortion, notification.
Ransomware pivoting into OT: add firmware replacement, manual operations staffing, BI.
Destructive attack with physical damage: add equipment replacement, extended BI, third-party outage claims.
Audit-discovered CIP violation: penalty, defense, compliance remediation.
Vendor compromise: contingent BI, CIP-013 investigation, regulatory inquiry.

Then check aggregation. Do these losses share one aggregate limit, or do separate insuring agreements carry separate limits? A single destructive event can trigger first-party, third-party, and regulatory coverage at once, exhausting a shared aggregate within weeks.

Underwriters price OT controls directly. Network segmentation between IT and OT, multifactor authentication on remote access, offline backups of control system configurations, and tested incident response plans for OT all move pricing and available terms.

Your CIP program gives you a documentation advantage that many commercial buyers lack. Use it. Present segmentation diagrams, CIP-005 remote access evidence, and CIP-009 recovery test results in the submission. If you can show that a corporate network compromise cannot reach your ESP, you have a credible argument for broader OT terms. If you cannot show it, expect exclusions written around that gap.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

It depends on your policy. Many standard policies require a specific "Cyber Crime" endorsement to cover losses from being tricked into sending money to a fraudster.

Does cyber insurance cover social engineering scams?

Is deepfake fraud covered under standard impersonation terms?

Does a standard cyber policy cover damage to substation equipment? Usually not without an endorsement. Most standard forms exclude property damage, so a policy form may respond only if it has been specifically endorsed or paired with a property policy write-back.

Can insurance pay a NERC fine? It depends on the form and on state law governing the insurability of penalties. Some specialized policies offer affirmative regulatory penalty coverage, while most standard forms limit it to fines arising from a security event.

Will my policy respond if a nation-state attacks the grid? Read the war and state-actor exclusion closely. Many current clauses address state-backed attacks on essential services, and the attribution process in your form decides the outcome.

Does my CIP audit result affect my insurance? Yes, indirectly. Application answers often track CIP controls, and inaccurate answers can give a carrier grounds to contest a claim.

Are low-impact BES assets treated differently by insurers? Underwriters often ask separate questions about low-impact sites, especially vendor remote access. With CIP-003-9 now enforceable, expect closer scrutiny of those controls.

What is the most common gap you see in utility cyber programs? The gap between the cyber policy's property damage exclusion and the property policy's cyber exclusion. A cyber-caused equipment failure can fall between both contracts.

Your CIP program proves you followed the standard. Your insurance program determines who pays when following the standard was not enough. Those are different questions, and the answers live in different documents.

The work is specific. Confirm that your OT assets fall inside the policy's definition of computer system. Find where the property damage exclusion meets your property policy's cyber exclusion. Check whether regulatory penalties require a breach trigger, whether your indemnity period matches transformer lead times, and whether your contingent BI sublimit reflects your actual vendor dependencies.

Grid operators who treat compliance and coverage as one review, rather than two separate filings, find their gaps on paper instead of in a claim. Bloc Cyber places cyber liability insurance at the insuring-agreement level, which is where these questions get answered. If you are approaching renewal or buying a first policy, request coverage and have a specialist walk through the form with you before you bind it.

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

Standalone Cyber Insurance Versus a Cyber Endorsement on Your Business Owners Policy: Limits, Sublimits, Incident Response, Coverage Triggers, and Costs

3 November 2026

Compare standalone cyber insurance vs. BOP endorsements. Explore coverage limits, sublimits, incident response, claim triggers, exclusions, and costs.

Application Warranties and No-Known-Loss Letters: How Cyber Insurance Gets Rescinded

3 November 2026

Learn how cyber insurance applications, warranties, and no-known-loss letters can lead to policy rescission, claim denials, and costly coverage gaps.

War and Hostile Act Exclusions in Cyber Insurance After State-Backed Attack Endorsements: Attribution, Carve-Backs, Critical Infrastructure, Disputes, and Limits

3 November 2026

Explore cyber insurance war exclusions, state-backed attacks, attribution, carve-backs, critical infrastructure risks, coverage disputes, and limits.

Get In Touch

NERC CIP Compliance and Cyber Insurance for Bulk Electric System Operators

The Intersection of NERC CIP and Cyber Risk Management

Protecting Operational Technology (OT) and Critical Assets

Bridging the Gap Between IT and OT Security Measures

Insurance Coverage for Physical Damage from Cyber Attacks

Internal Threats: When Employee Information is Compromised

Insuring Against Grid Events and Mass Outages

Why Social Engineering Limits are Lower Than Policy Aggregate

The Importance of First-Party vs. Third-Party Loss

Regulatory Fines and NERC Compliance Violations

How Policies Handle Penalties and Legal Defense Costs

Business Interruption and Revenue Recovery for Utilities

Calculating Indemnity Periods for Long-Term Grid Repairs

Contingent Business Interruption for Supply Chain Failures

Does cyber insurance cover social engineering scams?

Is deepfake fraud covered under standard impersonation terms?

Comparison: Standard Cyber vs. Specialized Energy Policies

Determining Appropriate Coverage Limits for BES Operators

Evaluating Loss Scenarios and Liability Aggregation

The Impact of Security Maturity on Policy Premiums

Does cyber insurance cover social engineering scams?

Is deepfake fraud covered under standard impersonation terms?

Common Questions About Utility Cyber Insurance

Building a Resilient Future for the Grid

Caden Braly

Cyber Coverage Built for Your Industry

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

Healthcare

One foundation.Ten industry-specific builds.

A policy you can actually read.Structured in three clean blocs.

First-Party

Third-Party

Specialty

Cyber Liability Insurance, Explained

What does cyber insurance cover?

Does my business really need cyber insurance?

How much does cyber insurance cost?

What is the difference between first-party and third-party cyber coverage?

How fast can I get a quote?

What should I do first after a cyberattack?

Field notes from the placement desk.What carriers are asking right now.

Standalone Cyber Insurance Versus a Cyber Endorsement on Your Business Owners Policy: Limits, Sublimits, Incident Response, Coverage Triggers, and Costs

Application Warranties and No-Known-Loss Letters: How Cyber Insurance Gets Rescinded

War and Hostile Act Exclusions in Cyber Insurance After State-Backed Attack Endorsements: Attribution, Carve-Backs, Critical Infrastructure, Disputes, and Limits

Tell us about your business.We’ll come back with terms.

One foundation.
Ten industry-specific builds.

A policy you can actually read.
Structured in three clean blocs.

Field notes from the placement desk.
What carriers are asking right now.

Tell us about your business.
We’ll come back with terms.