How much cyber cover? Start with a downtime model

The decision behind the headline

This review focuses on daily cash exposure, restoration bills, specialist costs and annual aggregate limits.

Model three phases for the consultancy: initial containment, safe restoration and return to ordinary throughput. Estimate external specialist fees separately from staff time spent reconstructing work. Ask which labour and restoration categories the policy recognises; a business budget can include costs that the insurance calculation does not. If clients accept delayed delivery, identify revenue shifted rather than permanently lost. If deadlines cannot be extended, quantify the affected assignments and any contractual consequences as distinct questions.

A hypothetical scenario to test

A consultancy loses its document system for five working days and must reconstruct deadlines manually. This is an invented example, not a reported claim or a promised payout. Reconstruct the sequence from the first sign of trouble to ordinary service resuming. Ask what would happen if the problem occurred during a holiday or at the busiest time of year. The stress test should expose assumptions about availability and timing before they are relied upon.

Consider hypothetical expenses of CHF 25,000 for technical work and CHF 10,000 for additional administrative support. Do not assume the sum becomes an insured loss: valuation, approved providers, sublimits and retained amounts still need confirmation. Compare the scenario with the per-event limit and annual aggregate. If two unrelated incidents happen in the same policy year, ask how the remaining annual capacity is calculated. Preserve enough liquidity to fund initial response while eligibility and invoicing are clarified. The appropriate limit follows the specific operating dependencies and expense structure, not an arbitrary multiple of revenue or a reassuring round number.

Identify the contractual boundary

Turnover is not the same as insured loss. Identify costs that continue, costs avoided and work recoverable later, according to the policy calculation. Model the liquidity needed before reimbursement separately; a solvent company can still face a short-term cash squeeze during recovery.

Compare the wording, then the price

Use an identical scenario with each insurer and request clarification of interruption calculation, expense limits, retention, event aggregation and coverage duration. Ask for the relevant clause and a written explanation of anything left uncertain. An optional extension should appear in the schedule, not merely in a sales discussion.

Reduce the exposure before transfer

A useful first action is to model short and prolonged outages with financial and technical teams. Assign an owner, a completion date and a simple test of whether the measure works. Written procedures matter only if staff can find and use them under pressure.

Evidence and the next review

Prepare monthly accounts, revenue concentration, restore estimates and emergency staffing costs. Date the records and keep an accessible copy away from the affected process. Keep offline access to the insurer contact, incident plan and supplier escalation list. A claim notification does not replace any required regulatory notification. Review the arrangement when your activity, technology, locations or counterparties change.