What does cyber liability insurance cover?

Cyber liability covers the fallout of a data breach or cyberattack: first-party costs like forensics, customer notification, data restoration, crisis management, and sometimes ransom payments, plus third-party liability to customers and partners whose data was exposed. Many policies also cover regulatory fines and business interruption — but check the sublimits, which often cap specific perils.

What does cyber liability insurance not cover?

Cyber policies generally exclude bodily injury and property damage (covered by general liability), losses from failing to maintain the security controls you attested to, and known but unpatched vulnerabilities. Many also carve out war or state-sponsored attacks. Insurers often verify your controls only after a claim, so an unmaintained control can trigger a denial at the worst moment.

What are sublimits on a cyber policy?

Sublimits are lower caps on specific perils within a cyber policy. Even if your aggregate limit is $1M, ransomware or social-engineering fraud might be capped at $100K or $250K. These sublimits are where real exposure hides, so read them carefully — the headline limit rarely tells the whole story.

Why do cyber policies require security controls?

Insurers increasingly require controls like multi-factor authentication and tested backups as a condition of coverage and price policies on the controls you represent at application. If you fail to maintain a control you attested to, the insurer can deny a claim. That's why keeping both the policy and the questionnaire you submitted matters.

How long should I keep cyber insurance policies?

Keep each policy at least six years past its term, along with the security questionnaire you submitted. Breaches are often discovered long after they begin, and a claim depends on which policy was in force and whether your representations about security controls were accurate.

Insurance

Cyber Liability Insurance Policy

Cyber liability insurance is a specialized business policy that covers the financial losses and legal liability from a data breach or cyberattack — incident response, customer notification, legal liability, regulatory fines, and sometimes ransomware and business interruption. Standard commercial policies typically exclude these digital risks. The policy lists the insurer, policy number, coverage limits, sublimits, and term, and is increasingly required for businesses handling sensitive data.

Written & maintained by the Granite team · Last updated June 2026

Overview

A cyber policy is issued to a business and renews annually, typically after a security questionnaire or assessment. Coverage splits into first-party (your own costs: forensics, notification, data restoration, crisis management, cyber extortion, lost income) and third-party (liability to customers, partners, and regulators whose data was exposed).

The details that matter most are the sublimits — many policies cap ransomware or social-engineering fraud well below the headline limit — and any required security controls, since failing to maintain a control you attested to on the application can void a claim.

When you’ll get your Cyber Liability Insurance Policy

Your business stores customer data, payment info, or health records
A client or partner contract now requires cyber coverage
You renewed cyber insurance after a security assessment
You added ransomware or business-interruption coverage
Your industry faces rising breach and regulatory exposure

What’s on your Cyber Liability Insurance Policy

These are the fields Granite reads and extracts automatically the moment you upload one.

Named Insured: The business the policy covers.
Carrier & Policy Number: The insurer and unique policy identifier.
Aggregate Limit: The most the policy pays in total across the term.
Sublimits: Lower caps on specific perils like ransomware or social-engineering fraud.
Required Controls: Security measures (MFA, backups) the policy requires you to maintain.
Policy Term: The effective and expiration dates of coverage.

How long to keep it

Keep each policy at least 6 years past its term, along with the security questionnaire you submitted.

A breach can be discovered long after it began, and claims hinge on which policy was in force and whether you maintained the required controls. Keeping the policy plus the application you signed protects you if an insurer later questions a representation you made.

How Granite handles your Cyber Liability Insurance Policy

Granite reads your cyber policy on upload — carrier, policy number, aggregate limit, sublimits, and term — and files it with your business insurance, alongside the security questionnaire you submitted. It keeps each renewed year so a later-discovered breach maps to the right policy, and reminds you before the term lapses.

FAQ

Cyber Liability Insurance Policy: common questions

What does cyber liability insurance cover?: Cyber liability covers the fallout of a data breach or cyberattack: first-party costs like forensics, customer notification, data restoration, crisis management, and sometimes ransom payments, plus third-party liability to customers and partners whose data was exposed. Many policies also cover regulatory fines and business interruption — but check the sublimits, which often cap specific perils.
What does cyber liability insurance not cover?: Cyber policies generally exclude bodily injury and property damage (covered by general liability), losses from failing to maintain the security controls you attested to, and known but unpatched vulnerabilities. Many also carve out war or state-sponsored attacks. Insurers often verify your controls only after a claim, so an unmaintained control can trigger a denial at the worst moment.
What are sublimits on a cyber policy?: Sublimits are lower caps on specific perils within a cyber policy. Even if your aggregate limit is $1M, ransomware or social-engineering fraud might be capped at $100K or $250K. These sublimits are where real exposure hides, so read them carefully — the headline limit rarely tells the whole story.
Why do cyber policies require security controls?: Insurers increasingly require controls like multi-factor authentication and tested backups as a condition of coverage and price policies on the controls you represent at application. If you fail to maintain a control you attested to, the insurer can deny a claim. That's why keeping both the policy and the questionnaire you submitted matters.
How long should I keep cyber insurance policies?: Keep each policy at least six years past its term, along with the security questionnaire you submitted. Breaches are often discovered long after they begin, and a claim depends on which policy was in force and whether your representations about security controls were accurate.

Sources

This page is checked against primary and authoritative sources:

Keep your Cyber Liability Insurance Policy in one place.

Drop it in once. Granite reads it, files it, and makes it findable forever — by you today, and by the people who'll need it later.

Get Granite Try the live demo See pricing