Texas Utility Cyber Insurance

Vulnerabilities in Operational Technology (OT) and SCADA Systems

Most SCADA systems in Texas utilities were designed decades before cybersecurity was a design priority. These systems run on legacy protocols, many of which lack encryption or authentication. When an IT network is compromised, lateral movement into the OT environment is often trivially easy because the air gap between IT and OT has eroded over years of remote-access additions and vendor integrations. A single compromised human-machine interface can give an attacker direct control over breakers, turbines, or pressure valves. Insurers increasingly require network segmentation documentation and OT-specific penetration testing before they will quote a utility risk.

Physical vs. Digital Impacts on the Texas Power Grid

A cyber event at a utility does not stop at data theft. Manipulated SCADA commands can cause physical destruction: overloading transformers, triggering pressure failures, or forcing generators offline. These physical consequences blur the line between a cyber policy and a property policy, and many standard forms exclude "bodily injury" or "property damage" arising from a cyber event. Texas utilities need to confirm whether their cyber form includes a "bricking" or "system damage" coverage grant, and whether the property policy has a cyber exclusion that would deny a claim for a physically damaged asset caused by a digital intrusion.

Business Interruption and Extra Expense Limits

Business interruption coverage under a cyber policy typically reimburses lost net income and extra expenses incurred during a covered event. The waiting period, often 8 to 12 hours, is the deductible equivalent: no losses are recoverable until that clock expires. For utilities, the waiting period can consume the most expensive hours of a disruption. Extra expense coverage pays for costs like emergency generator rentals, manual switching operations, or expedited vendor response. You should confirm whether your form measures the restoration period by when systems are "reasonably restored" or when they return to "pre-incident condition," because those two standards produce very different claim outcomes.

Contingent Business Interruption for Upstream Providers

Texas utilities depend on fuel suppliers, cloud-hosted energy management systems, and third-party SCADA vendors. If one of those providers suffers a cyber event that forces your plant offline, contingent business interruption coverage is what responds. Many standard cyber forms either exclude this coverage entirely or bury it under a sublimit that would not cover a single day of lost generation. Confirm whether the contingent BI grant extends to "named" vendors only or to any provider in your supply chain, and whether the sublimit is adequate relative to your daily revenue exposure.

A standard cyber liability form was designed for data breaches and network interruptions at commercial businesses. It was not built for a utility where a cyber event can cause physical destruction, trigger NERC violations, and produce downstream liability to retail electric providers. Specialized infrastructure policies address these exposures directly, though they come with higher premiums and more demanding underwriting requirements. Working with a broker whose entire practice focuses on cyber and technology risk at the policy-form level, like Bloc Cyber, ensures the insuring agreements actually match the exposures a Texas utility faces.

SB 2114 and State-Level Disclosure Requirements

Texas SB 2114 requires certain critical infrastructure entities to report cybersecurity incidents to the Texas Department of Information Resources within 48 hours. The PUCT also maintains its own cybersecurity reporting rules under 25.367, which apply to transmission and distribution utilities. ERCOT's Texas Cybersecurity Monitor Program adds another layer of oversight. Your cyber policy's regulatory defense coverage should explicitly include proceedings before state agencies, not just federal regulators. A policy that covers SEC or FTC investigations but is silent on PUCT proceedings leaves a significant gap for a Texas utility.

Federal CISA Reporting Standards for Critical Infrastructure

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) imposes federal reporting obligations on covered entities, including energy sector operators. CISA's final rulemaking is expected in September 2026, and the agency has been holding town hall meetings throughout 2026 to gather industry input. Once finalized, covered entities will likely face a 72-hour reporting window for substantial cyber incidents and a 24-hour window for ransomware payments. CISA's CIRCIA FAQ page outlines the current scope of covered entities and incident types. Your policy form should cover the costs of preparing and submitting these mandatory reports, including legal counsel and forensic support needed to meet the tight deadlines.

Limit adequacy is the single most common gap Bloc Cyber identifies when reviewing existing utility cyber programs. A $5 million aggregate limit may sound substantial until you price out a five-day generation outage during August peak demand in ERCOT's real-time market.

Calculating the Cost of a Total Grid Shutdown

Start with your facility's daily revenue at peak pricing, then add incident response costs (OT forensics teams bill $500 to $1,500 per hour), regulatory defense reserves, and crisis communications. A mid-size gas-fired plant producing 500 MW can generate $2 million to $4 million in daily revenue during summer pricing spikes. Five days offline puts the loss at $10 million to $20 million before you add forensics, legal, and restoration costs. Your policy limit needs to account for the full duration of a realistic worst-case event, not an average one. Sublimits on specific coverage grants, like a $1 million cap on forensics or a $500,000 cap on regulatory defense, can quietly erode the effective limit.

Third-Party Liability for Downstream Damage

When a utility's cyber event causes outages for downstream customers, retail electric providers, industrial consumers, and municipal systems, those parties may pursue claims for their own lost revenue. Third-party liability coverage under your cyber form responds to these claims, but the trigger language matters. Some forms require a "wrongful act" or "security failure" as a prerequisite, which can create disputes about whether the utility's security posture met the policy's standard. Review whether the third-party grant covers claims arising from an OT event specifically, not just data breaches.

Does a standard commercial cyber policy cover SCADA attacks? Most do not. Standard forms focus on IT network security events and data breaches. SCADA and OT exposures require either a specialized infrastructure policy or specific endorsements added to a broader form.

Will my property policy cover physical damage caused by a cyberattack? Probably not. Most property forms now include cyber exclusions. You need to confirm whether your cyber policy includes a system damage or bricking grant to fill that gap.

How long is the typical waiting period for business interruption on a utility cyber policy? Standard forms use 8 to 12 hours. Specialized utility forms may offer 4 to 6 hours, but shorter waiting periods increase the premium.

Are ERCOT reporting costs covered under cyber insurance? They can be, if the policy's regulatory defense or incident response grant explicitly includes state-level regulatory proceedings. Many forms are silent on this, which means the insurer has discretion to deny.

What underwriting information do carriers require for a utility risk? Expect requests for network architecture diagrams showing IT/OT segmentation, patch management schedules for SCADA systems, incident response plans, third-party penetration test results, and multi-factor authentication deployment across remote access points.

Does CIRCIA apply to my utility right now? The final rule is expected in September 2026. Once effective, most energy sector operators will be covered entities. Preparing your reporting procedures now reduces both compliance risk and potential coverage disputes.

Texas utility cyber insurance is not a product you purchase once and file away. The threat environment, regulatory requirements, and your own OT infrastructure change constantly, and your policy needs to keep pace. Every renewal is an opportunity to reassess whether your limits reflect current peak-revenue exposure, whether new CIRCIA obligations are covered under your regulatory defense grant, and whether your waiting periods still align with your operational resilience capabilities.

The gap between what a policy appears to cover and what it actually pays at claim time is where utilities get hurt. A form-level review before binding, not after a loss, is the only reliable way to identify sublimit shortfalls, exclusionary language around OT events, and missing coverage for state-specific regulatory proceedings. If your current program has not been reviewed at the insuring-agreement level by a specialist who reads utility cyber forms daily, you are carrying risk you have not priced. Reach out to request a policy review so a Bloc Cyber specialist can walk through your form and show you exactly where the coverage stops before a claim does it for you.

Cyber Coverage Built for Your Industry

Every industry faces a different cyber threat, from patient records in healthcare to wire fraud in construction. Bloc Cyber matches coverage to the risks your sector actually faces, drawing on specialty carriers that understand your business. Find your industry below to see how we protect it.

Field notes from the placement desk.
What carriers are asking right now.