What does cyber insurance cover?

Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.

Does my business really need cyber insurance?

Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.

How much does cyber insurance cost?

Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.

What is the difference between first-party and third-party cyber coverage?

First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.

How fast can I get a quote?

Most clients receive a quote in under 24 hours after we review the details of their business and exposure.

What should I do first after a cyberattack?

Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

California Utility Cyber Insurance (Free Online Quote)

A single cyberattack on a California power utility can cascade into wildfire ignition, public safety shutoffs, and regulatory penalties that dwarf the cost of the intrusion itself. For small and mid-market utilities, municipal energy providers, and independent power producers operating between 10 and 500 employees, the financial exposure from a SCADA compromise or grid interruption is not hypothetical: it is an actuarial certainty that underwriters are pricing into every renewal. California's regulatory framework layers CPUC safety mandates, CCPA and CPRA data privacy obligations, and sector-specific cybersecurity audit requirements on top of the federal NERC CIP standards that already govern bulk electric systems. The result is a compliance environment where a single breach can trigger overlapping notification duties, enforcement actions, and civil liability. This guide covers the operational technology threats facing California utilities, the reporting obligations that attach when systems are compromised, and the coverage structures, limits, and underwriting requirements that determine whether a cyber insurance policy form will actually respond when a plant goes offline. Understanding how these pieces fit together is the difference between a policy that pays and one that denies.

California's utility sector faces a threat profile distinct from general commercial enterprises. Attackers target the control systems that manage generation, transmission, and distribution, not just the IT networks that handle billing and customer data. The convergence of legacy industrial equipment with internet-connected monitoring platforms has created attack surfaces that did not exist a decade ago. A compromised relay controller or falsified sensor reading can cause physical damage to turbines, transformers, or battery storage arrays, turning a digital intrusion into a property and bodily injury event.

SCADA systems in California utilities often run on protocols designed decades before cybersecurity was a design consideration. Modbus, DNP3, and OPC Classic were built for reliability and speed, not authentication or encryption. Many of these systems still operate on flat networks with minimal segmentation, meaning a single compromised human-machine interface can give an attacker lateral access to turbine controls, valve actuators, or substation breakers. Patching is difficult because taking a controller offline for updates can itself cause a service interruption. The practical result: OT environments carry vulnerabilities that persist for years, and insurers are increasingly requiring proof of compensating controls before they will bind coverage.

California's push toward distributed energy resources, advanced metering infrastructure, and battery energy storage has accelerated the merger of IT and OT networks. Smart inverters, cloud-based DERMS platforms, and real-time pricing engines all require data flows between operational systems and enterprise IT. Each integration point is a potential entry vector. The CPUC now requires new safety standards and enhanced oversight for battery energy storage systems, reflecting the physical risks that follow when digital controls over BESS units are compromised. Underwriters evaluating utility cyber policies want to see documented network segmentation architectures and OT-specific intrusion detection before they will offer meaningful limits.

We start with a twenty-minute call to walk through your contracts, your draw process, your tech stack, and the last twelve months of attempted fraud. From there we go to market with ten-plus carriers, benchmark terms side-by-side, and present the options in plain language with recommended limits and retentions. Most intakes get indicative terms within one business day.

Under the modified General Order 167-C, the California Public Utilities Commission now mandates daily outage reporting and requires all battery energy storage systems to meet new rules governing operational safety and cybersecurity preparedness. The CPUC's Safety and Enforcement Division maintains active oversight of generation and energy storage facilities, and a cyber event that causes or threatens a service disruption must be reported within the prescribed window. Failure to report can result in enforcement proceedings, and some policy forms condition coverage on the insured's compliance with all applicable reporting obligations.

If a cyberattack on a utility also exposes customer personal information, such as account numbers, usage patterns, or payment data, the California Consumer Privacy Act and the California Privacy Rights Act create a separate set of obligations. Affected consumers must be notified, and the California Attorney General may open an investigation. Statutory damages under the CCPA private right of action range from $100 to $750 per consumer per incident, and a utility serving tens of thousands of accounts faces aggregate exposure that can exceed its cyber policy limits. Your policy form's regulatory defense and penalty sublimits matter enormously here: a $250,000 sublimit on regulatory proceedings will not cover a multi-million-dollar enforcement action.

Coverage Element	General Cyber Policy	Cryptojacking Endorsement
Unauthorized cloud compute charges	May be excluded or subject to low sublimit	Explicitly covered, often with higher sublimit
Incident response and forensics	Typically included	Included
Business interruption from degraded performance	Covered if waiting period is met	Covered, sometimes with shorter waiting period
Container/Kubernetes remediation	Covered under system restoration if triggered	Explicitly addresses cloud-native environments
Cloud bill reimbursement	Varies widely by form	Specifically designed for this loss type
Retention (deductible)	Standard retention applies	May have separate, lower retention

Some regulatory proceedings involve parallel tracks: the regulator's formal action and an internal investigation your company runs simultaneously. Shadow defense counsel represents your company's interests during the regulatory process without formally appearing before the agency. Monitoring counsel may be appointed under a consent order to oversee your compliance.

The costs for these roles can be substantial. Certain policy forms cover shadow counsel fees as part of the defense cost grant, while others exclude them entirely. Court-appointed monitors in state enforcement actions have generated significant fees that strain organizational budgets, and whether your policy responds to those costs depends on how the form defines "defense costs" and "regulatory proceeding."

Shadow Defense and Monitoring Counsel Roles

Table: General Liability vs. Cyber Liability Coverage

PWA-specific insurance covers the risk that the IRS determines the project failed to meet prevailing wage or apprenticeship standards, resulting in loss of the bonus credit multiplier. Some policies also cover the penalty amounts associated with correction payments if the cure mechanism is invoked.

This coverage is particularly valuable because PWA compliance involves thousands of individual payroll records across multiple subcontractors. Even well-managed projects can have gaps. A single subcontractor paying below the prevailing rate for a misclassified trade can jeopardize the entire bonus credit. Insurance does not excuse sloppy compliance, but it does protect against the financial consequences of honest errors.

Audit Protection and PWA Penalty Insurance

Coverage Element	Standard Cyber Policy	With PCI Comprehensive Rider
Forensic investigation (PFI)	Covered, subject to sublimit	Covered at full policy limit
Card brand assessments	Typically excluded	Covered, subject to retention
Card reissuance costs	Excluded	Covered
Regulatory fines (state-level)	Covered where insurable by law	Covered where insurable by law
PCI DSS non-compliance penalties	Excluded	May be covered with conditions
Notification and credit monitoring	Covered	Covered
Business interruption	Covered, with waiting period	Covered, with waiting period
Third-party liability / lawsuits	Covered	Covered

Scenario	General Liability	Cyber Liability
Customer slips in your office	Covered	Not covered
Hacker steals 10,000 customer records	Not covered	Covered under breach response and privacy liability
Ransomware shuts down operations for 5 days	Not covered	Covered under business interruption (subject to waiting period)
Employee accidentally emails PHI to wrong recipient	Not covered	Covered under privacy liability
BIPA class action for biometric timekeeping	Likely excluded	May be covered if policy does not exclude biometric claims
Virus from your network infects a client	Not covered	Covered under network security liability
Regulatory investigation by IL Attorney General	Not covered	Covered under regulatory proceeding coverage

First-party coverage pays for your own costs: forensics, notification, credit monitoring, business interruption, and data restoration. Third-party coverage responds to claims made against you by affected individuals, regulators, or business partners. Many business owners assume a single policy limit covers everything. It does not. Most forms split the limit into first-party and third-party components, and some impose sublimits within each category.

Coverage Element	First-Party	Third-Party
Forensic investigation	Covered under breach response	Not applicable
Breach coach / legal fees	Covered under breach response	Regulatory defense may fall here
Consumer notification	Covered under breach response	Not applicable
Credit monitoring	Covered under breach response	Not applicable
Regulatory fines and penalties	Not applicable	May be covered where insurable by law
Liability to affected individuals	Not applicable	Covered under privacy liability
PCI-DSS assessments	Sometimes first-party	Sometimes third-party

The distinction matters because a $1 million aggregate that must cover both forensics and a regulatory defense action can be exhausted before notification even begins. When Bloc Cyber reviews a policy form, one of the first things examined is whether the breach response sublimit is adequate relative to the company's record volume and the number of jurisdictions where it operates.

First-party business interruption coverage in a utility cyber policy typically pays lost net income and extra expense resulting from a covered cyber event that causes a measurable interruption. The critical variables are the waiting period (often 8 to 12 hours, sometimes 24), the period of restoration (capped at 60 to 180 days in most forms), and whether the policy covers the cost of procuring replacement power from the grid or emergency generators. Some forms exclude physical damage to OT equipment caused by a cyber event, creating a gap where the SCADA attack succeeds in damaging a turbine but the property damage falls outside the cyber policy and the property policy excludes cyber-caused losses.

California utilities increasingly depend on third-party cloud platforms for DERMS, outage management, and customer information systems. If a vendor's system goes down due to a cyberattack, your utility may lose the ability to dispatch generation, manage load, or bill customers. Contingent business interruption coverage addresses this scenario, but many policy forms impose lower sublimits for dependent business interruption than for direct losses. Reviewing whether your policy treats a cloud DERMS provider as a covered "service provider" or excludes it under a technology services carve-out is exactly the kind of form-level analysis that prevents claim surprises. Agencies like Bloc Cyber that work at the insuring-agreement level can identify these gaps before binding.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Average defense costs for technology professional liability claims range from $50,000 to $150,000 depending on complexity and jurisdiction. Settlement amounts vary widely, but six-figure demands are common even for small firms.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

How much does a typical PCI forensic investigation cost?

PFI engagements range from $20,000 for a simple, small-merchant investigation to $120,000 or more for complex environments with multiple locations or e-commerce platforms. The card brands dictate the scope, and the merchant pays.

A cyber liability policy can pay for forensic investigation, breach notification costs, credit monitoring, public relations, legal defense, regulatory fines where insurable by law, business interruption losses, and data restoration expenses. The specific scope depends entirely on the insuring agreements and endorsements in your policy form.

FAQ: What does cyber insurance actually pay for?

The distinction is clear: general liability policies contain electronic data exclusions and are not designed to respond to cyber events. Treating a general liability policy as a substitute for a dedicated cyber form is a common and expensive mistake.

Coverage Feature	Standard Commercial Cyber	Utility-Specific Cyber
OT/SCADA event trigger	Typically excluded or silent	Explicitly covered
Business interruption waiting period	6-12 hours	8-24 hours (negotiable)
Physical damage from cyber event	Excluded	May be sublimited or endorsed
Contingent BI for cloud DERMS	Rarely covered	Available by endorsement
Regulatory defense sublimit	$100K-$250K typical	$500K-$2M available
CPUC reporting compliance condition	Not addressed	Often a policy condition

No. A data breach or cyberattack is a cyber liability exposure, not a technology E&O exposure. You need a separate cyber liability policy form to cover breach response, notification costs, regulatory defense, and third-party claims arising from a security incident. Many technology companies carry both policies because the exposures are distinct.

FAQ: Does this cover me if I get hacked?

P2PE encrypts cardholder data from the point of interaction (the card reader) to the payment processor's secure decryption environment. A validated P2PE solution removes your systems from PCI scope for those transactions, which directly reduces both your compliance burden and your risk profile. Underwriters recognize P2PE as a meaningful risk reduction and may offer premium credits for merchants using validated solutions.

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

Underwriters expect access to the buyer's due diligence reports, the virtual data room, and the near-final purchase agreement. They review financial, tax, legal, environmental, intellectual property, and employment diligence. Gaps in diligence translate to broader exclusions on the policy. If the buyer skipped an environmental Phase I assessment, for instance, the underwriter will likely exclude environmental representations from coverage entirely. Firms like Bloc Cyber, whose practice centers on reading policy forms at the insuring-agreement level, often advise clients that the quality of your diligence directly determines the quality of your coverage.

Does a standard business owner's policy cover wire fraud losses? No. BOP policies and general liability forms exclude electronic theft and funds transfer fraud. You need a standalone cyber policy with a specific social engineering or funds transfer fraud insuring agreement.

Will my cyber policy respond if a core provider outage is not caused by a cyberattack? It depends on the form. Some policies only cover "security failures" at dependent entities, while others extend to "system failures." Confirm the trigger language before binding.

Are FTC fines under the Safeguards Rule insurable? Insurability of regulatory fines varies by state. Many cyber policies cover fines and penalties "where insurable by law," but the practical answer depends on your jurisdiction and the specific penalty assessed.

How much cyber insurance does a community bank need? There is no universal answer, but institutions processing significant wire volume should ensure their aggregate limit and sublimits can absorb a realistic worst-case fraud loss plus concurrent regulatory defense costs. A $3 million to $5 million aggregate is a common starting point for institutions with $100 million to $500 million in assets.

Does cyber insurance cover customer reimbursement after an account takeover? Some policies include customer notification and credit monitoring costs, but direct reimbursement of stolen customer funds typically requires a crime or fidelity endorsement, not the standard cyber form.

DWhat happens if I'm not compliant at the time of a breach?

Underwriters pricing utility cyber policies focus on a specific set of controls and exposures. Your application will be scrutinized for OT network segmentation, patch management cadence for SCADA systems, incident response plan maturity, and whether you have conducted a tabletop exercise involving an OT-specific scenario in the past 12 months. California's new cybersecurity audit mandate adds another layer: underwriters want to see evidence that you have completed or scheduled the required audits. Companies that cannot demonstrate these controls face higher retentions, lower limits, or outright declinations.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Does a standard property policy cover physical damage caused by a SCADA cyberattack? Most property forms contain a cyber exclusion that removes coverage for physical damage resulting from a cyber event. You need either a cyber policy with a physical damage endorsement or a property policy with a cyber carve-back to close this gap.

What waiting period should a utility expect for business interruption coverage? Waiting periods typically range from 8 to 24 hours. A shorter waiting period increases the premium, but for a utility where every hour of downtime costs tens of thousands in lost revenue and purchased power, the trade-off is often worth it.

Are CPUC fines and penalties insurable under a cyber policy? Some policy forms cover regulatory fines and penalties "to the extent insurable by law." California law permits insurance for certain civil penalties, but criminal fines are uninsurable. The sublimit on regulatory proceedings is often the binding constraint.

Does contingent business interruption cover a cloud vendor outage? It depends on whether the policy form defines the cloud vendor as a covered service provider. Many forms limit contingent BI to named vendors or impose a separate, lower sublimit.

How does CCPA exposure affect utility cyber policy limits? Statutory damages under the CCPA can aggregate quickly for utilities with large customer bases. A policy with a $1 million aggregate limit may be insufficient if 50,000 customer records are exposed.

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

DWhat happens if I'm not compliant at the time of a breach?

Underwriters expect California utility applicants to demonstrate several baseline controls before they will offer competitive terms:

Network segmentation between IT and OT environments, with documented firewall rules and monitoring
An OT-specific incident response plan tested through tabletop exercises within the past 12 months
Multi-factor authentication on all remote access points to SCADA and control systems
A vulnerability management program that addresses OT assets, even where traditional patching is impractical
Compliance with CPUC General Order 167-C reporting requirements and any applicable NERC CIP standards
Evidence of completed or scheduled cybersecurity audits under California's 2025 mandate

Meeting these requirements does not guarantee favorable pricing, but failing to meet them will almost certainly result in coverage restrictions.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Utility cyber policies in California typically offer aggregate limits ranging from $1 million to $25 million, with retentions (self-insured amounts) starting at $25,000 for smaller municipal utilities and reaching $250,000 or more for mid-market independent power producers. Sublimits on specific coverage parts, such as regulatory defense, contingent BI, and crisis management, often run at 25% to 50% of the aggregate limit. A $5 million aggregate policy with a $1.25 million regulatory defense sublimit may sound adequate until you face simultaneous CPUC and Attorney General investigations. The retention and sublimit structure is where Bloc Cyber's form-level review adds the most value: identifying where a sublimit will exhaust before the claim is resolved.

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

DWhat happens if I'm not compliant at the time of a breach?

Placing utility cyber coverage requires a broker who reads the policy form before binding, not after a claim is filed. The difference between a covered and denied claim often sits in a single definition, such as whether "computer system" includes programmable logic controllers, or whether "network security failure" encompasses a compromised OT protocol. Generalist brokers who treat cyber as an add-on to a commercial package rarely catch these distinctions. A specialist practice focused entirely on cyber and technology liability will review each insuring agreement, sublimit, retention, and waiting period against your specific operational profile.

Real claims illustrate the exposure more clearly than abstract descriptions. Here are patterns that repeat across the technology sector:

A SaaS company deploys a billing module that overcharges 12,000 end users over six months. The client demands $410,000 in restitution costs plus $150,000 in legal fees. The tech E&O form responds to the defense and indemnity obligation.
An MSP fails to complete a server migration on schedule, causing a healthcare client to miss a compliance deadline. The healthcare company faces a regulatory fine and sues the MSP for $275,000. The policy form may respond, but only if the regulatory fine is not excluded as a penalty.
A custom software vendor delivers an inventory management system that miscounts stock levels. The client loses $600,000 in downstream sales. The vendor's tech E&O policy covers defense costs and settlement, but a sublimit on the policy caps the payout at $500,000.

Coverage Element	Commercial General Liability	Cyber Insurance
Data breach notification costs	Not covered	Covered under first-party
Ransomware payment	Not covered	Covered (subject to sublimit)
Regulatory defense	Not covered	Covered under third-party
Business interruption from cyberattack	Not covered	Covered with waiting period
Funds transfer fraud	Not covered	Covered via cyber crime endorsement
Third-party lawsuit over data loss	Excluded or severely limited	Covered under third-party liability
Technology product failure	Not covered	Covered under Tech E&O

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

California utility operators face a combination of OT-specific cyber threats, layered regulatory reporting duties, and business interruption exposures that standard commercial cyber policies were not designed to address. The policy form matters more than the premium: a lower-cost policy with an OT exclusion or a $100,000 regulatory sublimit provides a false sense of security. Every utility buyer should understand their waiting periods, sublimit stacking, and whether their SCADA systems fall within the policy's definition of covered assets before they bind.

If you are evaluating cyber coverage for a utility operation, consider requesting a form-level review from a specialist who can walk through the insuring agreements with you. You can get started with Bloc Cyber to have a specialist examine how your policy form responds to the specific risks your operation faces. No pricing promises, no coverage guarantees: just a clear reading of what the form will and will not do when a claim arrives.

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

What does cyber insurance cover?
Cyber insurance covers the financial losses from a data breach or cyberattack. This includes breach response, legal fees, customer notification, ransomware, business interruption, and regulatory fines, depending on your policy.
Does my business really need cyber insurance?
Yes. Any business that stores customer data, processes payments, or relies on connected systems faces cyber risk. Small and mid-sized companies are frequent targets because they often have fewer defenses.
How much does cyber insurance cost?
Cost depends on your industry, revenue, data volume, and security practices. We market your risk to multiple carriers to find strong coverage at a competitive price. Request a quote for an exact figure.
What is the difference between first-party and third-party cyber coverage?
First-party coverage pays for your own losses, like data recovery and lost income. Third-party coverage pays for claims from others harmed by a breach on your systems.
How fast can I get a quote?
Most clients receive a quote in under 24 hours after we review the details of their business and exposure.
What should I do first after a cyberattack?
Contact us right away. We help you start breach response, connect you with forensic and legal support, and guide your claim so you contain the damage quickly.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Get In Touch

California Utility Cyber Insurance

Understanding Cyber Risks in California's Utility Infrastructure

Vulnerabilities in Operational Technology (OT) and SCADA Systems

The Convergence of IT and OT in Smart Grid Environments

Mandatory Reporting and California Regulatory Compliance

CPUC Requirements and Critical Infrastructure Reporting Duties

CCPA and CPRA Implications for Utility Data Breaches

Shadow Defense and Monitoring Counsel Roles

Table: General Liability vs. Cyber Liability Coverage

Audit Protection and PWA Penalty Insurance

Core Coverage: Grid Downtime and Business Interruption

First-Party Limits for Plant Stoppage and Power Outages

Contingent Business Interruption for Supply Chain Failures

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Comparing Utility Insurance Options

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

DWhat happens if I'm not compliant at the time of a breach?

How Underwriters Evaluate Utility Cyber Risk

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Common Questions About Utility Cyber Insurance

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

DWhat happens if I'm not compliant at the time of a breach?

Key Underwriting Requirements for California Utilities

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Policy Limits and Retention Structures for Utility Risks

FAQ: Does this cover me if I get hacked?

Implementing Point-to-Point Encryption (P2PE)

The Underwriter's Review of Data Rooms

DWhat happens if I'm not compliant at the time of a breach?

Working With a Specialist Broker

How much does a typical PCI forensic investigation cost?

FAQ: What does cyber insurance actually pay for?

Before You Buy a Policy

Caden Braly

Cyber Coverage Built for Your Industry

Healthcare

Banking

Retail / E-Commerce

Legal

Technology / SaaS

Education

Energy / Utilities

Manufacturing

Construction

Defense

Healthcare

One foundation.Ten industry-specific builds.

A policy you can actually read.Structured in three clean blocs.

First-Party

Third-Party

Specialty

Cyber Liability Insurance, Explained

What does cyber insurance cover?

Does my business really need cyber insurance?

How much does cyber insurance cost?

What is the difference between first-party and third-party cyber coverage?

How fast can I get a quote?

What should I do first after a cyberattack?

Field notes from the placement desk.What carriers are asking right now.

Construction Cyber Risk: Project Data, Wire Transfers and Connected Sites

Defense Contractor Cyber Risk: Protecting Controlled Unclassified Information

Retail Cyber Risk: Payment Data, Loyalty Systems and Seasonal Exposure

Tell us about your business.We’ll come back with terms.

One foundation.
Ten industry-specific builds.

A policy you can actually read.
Structured in three clean blocs.

Field notes from the placement desk.
What carriers are asking right now.

Tell us about your business.
We’ll come back with terms.