When should I notify my cyber insurance carrier?

As soon as you reasonably suspect that an incident or circumstance may give rise to a claim, even if the scope is not yet known. Late notice is the most common reason for denied coverage; the 'as soon as practicable' standard is safer than the policy's defined window.

What is a panel firm requirement?

Most cyber insurance policies require the use of outside counsel, DFIR firms, public relations firms, and ransom negotiators selected from the carrier's pre-approved panel. Using a non-panel firm without pre-approval can result in reduced or denied reimbursement.

Can I use my own outside counsel for an incident?

Sometimes, with carrier pre-approval, especially if you have a long-standing relationship and the firm meets the carrier's standards. Coordinate with the carrier as part of first notice; do not assume your usual counsel can serve in a coverage-restricted role.

What is late notice in cyber insurance?

Late notice is notification of a claim or potential claim after the policy's required timeframe. Some courts require the carrier to prove prejudice from the delay; others apply the policy term strictly. The safer reading is to notify as soon as practicable, not at the policy deadline.

Does first notice trigger an actual claim?

Notice that a circumstance may give rise to a claim puts the carrier on notice; it is not the same as a formal claim under the policy. The notice protects against late-notice denial if the situation later develops into a claim. Carriers expect updates as the investigation progresses.

Cyber Insurance First-Notice - When and How to Notify the Carrier

The cyber insurance first-notice is the formal notification to a cyber insurance carrier that an incident or circumstance may give rise to a claim under the policy. Cyber insurance policies typically require prompt notice, and late notice is one of the most common reasons for denied coverage. Most policies also require the use of panel firms (counsel, DFIR, public relations, ransom negotiators) selected from the carrier's approved list to maintain coverage.

Source: derived from standard cyber insurance policy language across major carriers (Chubb, AIG, Beazley, Coalition, AT-BAY, Travelers, CNA). Policy-specific terms vary; always consult your binder.

When to Notify the Carrier

Notify the cyber insurance carrier as soon as you reasonably suspect that an incident or circumstance may give rise to a claim, even if the incident scope is not yet known. Most policies have a defined notification window (often 30, 60, or 90 days from discovery) but the "as soon as practicable" standard is the safer reading. Late notice is the single most common coverage dispute.

Panel Firm Requirements

Outside counsel: most policies require selection from the carrier's panel, often through a "preferred provider" arrangement that fixes hourly rates
DFIR firm: same panel requirement applies; selection of a non-panel firm typically requires carrier pre-approval and may result in reduced reimbursement
Public relations or crisis communications: often panel-restricted
Ransom negotiators and payment facilitators: usually panel-restricted, and often required for any consideration of ransom payment

What the Carrier Needs at First Notice

Date and time of discovery
Nature of the incident (ransomware, BEC, data exposure, etc.)
Affected systems and data categories (to the extent known)
Initial scope of impact
Steps taken so far
Outside counsel and DFIR firm engaged or being considered
Any law enforcement engagement

First notice is not a final claim. Carriers expect to receive updates as the investigation progresses; the initial notice is to put the carrier on notice and start the panel coordination.

Coordinate insurance first notice

IR-OS supports the cyber insurance first-notice workflow, panel firm selection, and the documentation carriers expect through the claim.

Start free

Cyber Insurance First-Notice - When and How to Notify the Carrier

When to Notify the Carrier

Panel Firm Requirements

What the Carrier Needs at First Notice

Related Terms

Coordinate insurance first notice