Cyber insurance and the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill (CSRB) does not require cyber insurance, but it can affect your cover. Don’t assume that a policy would pay a fine under the Bill, because whether such fines can be insured is untested. Check how your policy’s conditions work with the 24-hour and 72-hour reporting deadlines.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
The Cyber Security and Resilience Bill (CSRB) does not require you to buy cyber insurance. The print brought from the Commons does not mention insurance at all. It can still affect your cover, because it changes what you have to report, how quickly you must do it and what could go wrong financially.
The most important point: don't assume your policy would pay a fine under the Bill. Whether a regulatory fine can be insured is unsettled and depends on the law and the wording.
Can insurance cover fines under the Bill?
We have found no case deciding this for the Bill's penalties, which is unsurprising because it is not yet law. Related positions give some guidance.
| Type of fine | Position, in summary |
|---|---|
| FCA fines | Commentary consistently reports that FCA rules bar regulated firms from insuring them. Investigation costs may be treated differently |
| Criminal or quasi-criminal fines | English public policy generally prevents insurance, because it would undercut the deterrent effect |
| ICO fines | No direct authority. Some commentary has suggested they are probably uninsurable, while others treat the point as unresolved |
| Penalties under the Bill | Untested |
Many cyber policies are reported to cover fines only "to the extent insurable by law". That wording may not settle anything: you could have the clause and still find no fine is recoverable. Ask your broker and, if the amount matters, a lawyer.
The Bill's maximum penalties are the greater of £17 million and 4% of turnover for serious failures, and the greater of £10 million and 2% of turnover for lesser failures. Plan on the basis that you may have to pay any fine yourself.
What insurance might still help with
Depending on your policy, cover may respond to costs around an incident, such as:
- Forensic and incident response support
- Legal advice on notifications
- Customer communication
- Business interruption
- Recovering data and systems
- Third-party claims
Check each one, including limits, excesses, waiting periods and panel requirements. Also ask about two costs that are new or more likely under the Bill:
- Regulator charges. The Bill lets regulators impose charges to recover costs. Does your policy treat these as an investigation cost, an ordinary business cost, or neither? See cost recovery.
- Customer notifications. Would the cost of notifying UK customers be covered when the notice is a legal duty?
Where the Bill and your policy could clash
Timing. The Bill requires an initial notification to the regulator within 24 hours and a full notification within 72 hours, both from when you first become aware of a reportable incident. Your policy will have its own notification terms. Law firm Reed Smith has suggested that those conditions may need aligning with the new reporting duties to avoid friction when claims are notified.
Consent. Some policies expect you to use approved vendors or get consent before incurring costs. Make sure this can't delay a legal deadline. Agree with your insurer how it would work out of hours.
Admissions. Find out how the policy treats statements you make to regulators and customers. You may have to say things quickly and before all the facts are known.
Disclosure at renewal. Insurers may want evidence of controls and compliance. If you say that you comply with the Bill, or a framework like the CAF, make sure that is accurate. Don't overstate it.
Near misses. The wider definition of an incident could mean more events are logged. Check what your policy says about notifying circumstances that could later give rise to a claim.
Questions for your broker
- Does our policy cover fines and penalties? In what words, and under what governing law?
- Would a penalty under the amended NIS Regulations be treated differently from an ICO fine?
- Are regulator cost recovery charges covered?
- Are customer notifications covered if required by law?
- How does the notice clause work with a 24-hour regulatory deadline?
- Do we need consent before calling in our own incident response firm?
- Are incidents at our suppliers, including managed service providers, covered?
- What happens if a supplier is regulated, and we receive a notice from it?
- Would a critical supplier designation need to be disclosed?
- Does our directors' and officers' policy respond to regulatory investigations into cyber oversight?
If you are a broker or insurer
Your clients may ask you for regulatory information. A useful first step is working out which clients fall into a regulated category, and which merely supply one. Our OES vs RDSP vs RMSP guide and the Bill on one page can help. Be careful with claims about scope until the final Act and regulator guidance are published.
What to do now
- Put the 24-hour and 72-hour steps next to your policy's notification terms in the incident plan.
- Get your insurer's emergency contact into the incident runbook.
- Review your cover at the next renewal, and again when the final Act and regulator guidance are published.
- Don't rely on insurance instead of security work. Regulated duties stay with you, whether or not you are insured.
This guide does not recommend any insurer or product, and it isn't insurance or legal advice.
Sources
Frequently asked questions
No. The print brought from the Commons does not mention insurance.
It is untested. Many policies are reported to cover fines only to the extent insurable by law, and English law on insuring regulatory fines is unsettled in places. Plan as if you may have to pay it yourself.
They may. Commentators expect insurers to look for evidence of controls and compliance. Make sure anything you say at renewal is accurate.
It might provide incident response support, depending on your policy. It does not move the legal deadline, so agree how insurer processes would work out of hours.