What evidence does a cyber insurer need to pay a claim?
Usually proof of three things: that a covered event happened, what it cost, and that the policy conditions were met. Expect to provide a timeline of the incident, the forensic or incident response report, invoices from response firms, restoration and overtime costs, figures for lost revenue during the interruption, any notifications to authorities or customers, and evidence that declared controls such as MFA, backups and monitoring were in place on the day. The policy and the claims handler decide what is enough, so ask them early and keep a list as you go. Preserve logs and affected systems before rebuilding, since a wiped server cannot show anything later. NetSenX contributes one piece: alerts with their timestamps and the affected devices, kept for your plan’s alert history (30 days on Free, longer on paid plans), and an audit log of actions and changes in the account. It does not provide endpoint forensics or a cost assessment.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does our cyber insurer choose the incident response firm?
- What security controls do cyber insurers usually require?
- Is multi-factor authentication mandatory for cyber insurance?
- Do cyber insurers require endpoint detection and response on every device?
- What do cyber insurers ask about ransomware protection?