Does our cyber insurer choose the incident response firm?
Often it does, or at least it has a say. Many policies give access to a panel of response firms, lawyers and recovery specialists, and some cover the costs fully only when you use them or when the insurer approves another firm in advance. Find out before an incident: read the clause on incident response services, note the hotline number and who may call it, and ask whether your existing IT provider or managed service provider (MSPMSP: managed service provider. A company that runs IT for other companies.) can work alongside the panel firm. During an incident, call the insurer early, before you sign with anyone, and keep a written record of what was agreed. Also settle who owns the forensic report, since it may be shared with the insurer. NetSenX is not an incident response firm and is not on insurers’ panels. It can give the responders a starting point: which devices raised alerts, when, and which outside addresses they contacted.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What security controls do cyber insurers usually require?
- Is multi-factor authentication mandatory for cyber insurance?
- Do cyber insurers require endpoint detection and response on every device?
- What do cyber insurers ask about ransomware protection?
- Why was our cyber insurance renewal declined or made more expensive?
Terms used here
- MSP (managed service provider)
- A company that runs IT for other companies.