Cyber Liability Insurance

Cyber liability insurance is a specialized insurance product covering the financial consequences of cyber incidents including data breaches, ransomware attacks, and network failures, increasingly required by federal agencies for contractors handling sensitive government or personally identifiable information.

What is Cyber Liability Insurance?

Cyber liability insurance (also called cyber risk insurance or data breach insurance) is a relatively new insurance category that addresses the unique financial risks of operating in digital environments. As federal contractors handle increasing volumes of controlled unclassified information (CUI), personally identifiable information (PII), and federal contract information (FCI), agencies are requiring cyber liability coverage as a contract term.

What cyber liability insurance covers:

First-party coverages (losses to the contractor):

• Incident response costs: Forensic investigation, legal counsel, notification to affected individuals.
• Data recovery: Costs of restoring or recreating compromised data.
• Business interruption: Revenue loss during system downtime from a cyber attack.
• Ransomware/extortion: Costs of cyber extortion demands (subject to policy terms and OFAC sanctions compliance).
• Cyber theft: Direct financial losses from fraudulent funds transfer.

Third-party coverages (claims by others):

• Network security liability: Claims by clients or partners for losses caused by a security failure the contractor allowed.
• Privacy liability: Regulatory fines and third-party claims from PII data breaches.
• Media liability: Claims for online content-related violations.
• Technology E&O: Professional liability for IT service providers whose negligence caused a client's breach.

Intersection with federal compliance: CMMC (Cybersecurity Maturity Model Certification) compliance does not substitute for cyber insurance, but contractors who implement strong cyber hygiene practices typically obtain lower cyber insurance premiums. Some agencies require cyber insurance as part of CMMC implementation to ensure contractors have response resources if their cyber controls fail.

Why Cyber Liability Insurance matters for government contractors

Agencies handling sensitive data - DoD, HHS, VA, DHS - are increasingly requiring cyber liability insurance as a contract term, particularly for IT, healthcare, and data analytics contracts. The average cost of a federal contractor data breach now exceeds $4 million when notification, remediation, regulatory response, and reputational costs are included. Without cyber coverage, a single incident can threaten a contractor's financial stability.

Example

An IT analytics contractor processing veteran healthcare data for VA holds a cyber liability policy with $5 million per occurrence limits. A ransomware attack encrypts the contractor's servers and threatens to release veteran PII. The contractor engages its cyber insurer's incident response team (available 24/7 under the policy), which coordinates forensic investigation, legal counsel, crisis communications, and negotiation with the threat actor. Total incident costs reach $2.2 million. The policy covers the investigation ($400,000), notification of 15,000 affected veterans ($300,000), credit monitoring services ($180,000), system recovery ($620,000), and legal costs ($700,000), leaving the contractor with only its $100,000 deductible out of pocket.

Frequently Asked Questions

Is cyber liability insurance required on all federal contracts?

No - it is increasingly required but not universally mandated. Contracts involving sensitive data (PII, CUI, protected health information), IT services, or cloud computing are most likely to require cyber coverage. FAR does not yet contain a standard cyber insurance clause, but agency-specific clauses and solicitation requirements are common. DFARS 252.204-7012 requires adequate cybersecurity but does not directly mandate cyber insurance.

What cyber events are typically excluded from coverage?

Common exclusions include: losses from acts of war or nation-state attacks (though "war exclusion" definitions are being litigated); losses from prior known incidents or vulnerabilities; bodily injury or property damage (covered by CGL); trade secret theft (typically excluded); and infrastructure failures caused by power companies or internet service providers. Contractors should carefully review exclusions with a cyber-specialist broker.

How does the OFAC sanctions concern affect cyber insurance coverage for ransomware?

OFAC has warned that paying ransomware demands to designated entities (including certain North Korean and Russian ransomware groups) could constitute sanctions violations, potentially making such payments illegal regardless of insurance coverage. Cyber insurers have begun including OFAC compliance language in policies. Before authorizing any ransomware payment, contractors should consult legal counsel on both the insurance coverage and OFAC compliance dimensions.

What cyber insurance limits are typically required by federal agencies?

Requirements vary widely by contract type and data sensitivity. Common ranges are $1 million to $5 million per occurrence for contracts involving limited PII or CUI, and $5 million to $25 million for large data processing contracts or healthcare IT. Some DoD and intelligence community contracts for very sensitive systems specify higher limits. The solicitation's insurance requirements section will specify the required limits.