Guides
Cyber business interruption and dependent system failure
How cyber policies pay lost income and extra expense when systems go down, how waiting periods and dependent business interruption work, and what to ask.
Cyber business interruption coverage pays the net income you lose and the extra expense you incur when a covered event takes your computer systems down for longer than the policy's waiting period. Unlike a property policy, it does not require physical damage. Better forms extend it to outages caused by a mistake or software failure, not only an attack, and to outages at the cloud and technology providers you depend on. Each of those extensions is a separate grant with its own sublimit, waiting period and definitions, so the product name tells you little.
Why your property policy does not respond
A commercial property business income form such as ISO CP 00 30 pays when a covered cause of loss damages property at your premises and interrupts operations. The trigger is direct physical loss or damage. A ransomware infection that leaves every computer physically intact does not meet it. The 10 12 edition of CP 00 30 also gives only $2,500 for interruption of computer operations caused by a virus or similar attack, and the CP 15 45 utility services endorsement is built around physical damage to off-premises power, water and communication property, not a software failure at a vendor. Manuscript and carrier-specific forms differ, but the pattern is consistent enough that business interruption for a cyber event is something you buy on a cyber policy. For the property side, see business interruption insurance: how business income coverage works and contingent business interruption insurance and supply chain risk.
What the coverage pays
A cyber policy's business interruption grant typically has two measures.
- Income loss. Net income (profit or loss before taxes) that you would have earned, plus normal operating expenses that continue, including payroll. It is the same idea as business income in a property policy.
- Extra expense. The additional cost of limiting the outage, such as overtime, temporary staff, rented equipment, a manual workaround or a premium-rate cloud environment. extra expense works the same way in a property context.
The loss is measured over a period of restoration, which ends when systems are or should have been restored with reasonable speed. Some forms add an extended period after restoration for sales that stay depressed, and some cap the total period at a number of days. Confirm all three on your declarations. See period of restoration for the concept.
The trigger: what kind of outage counts
Forms differ most in what kind of event starts coverage. Think of it as three tiers.
| Tier | Typical wording | Examples |
|---|---|---|
| Security failure | Unauthorized access or malware that interrupts your systems | Ransomware, denial-of-service attack, hacker deleting data |
| System failure | Unintentional, unplanned interruption of your own systems not caused by an attack | Administrator error, failed update, hardware or software fault |
| Dependent system failure | Interruption of a provider's systems that you rely on | Cloud host, SaaS platform, payment processor, managed service provider |
A policy that stops at the first tier leaves a common loss uncovered. Many outages are caused by mistakes, and a form limited to attacks will not respond to them. System failure, cloud outages and the CrowdStrike lesson covers how the 2024 CrowdStrike outage tested this and how system failure grants differ.
Two related points matter. First, voluntary shutdown: if you take systems offline to stop an attack from spreading, does the policy treat that as covered? Coalition says on its help center that its systems failure coverage includes voluntary shutdown to mitigate a loss and that an endorsement removes the requirement that its consent be in writing. Other carriers may condition this differently, so ask. Second, hardware rendered unusable by an attack, often called "bricking": many forms exclude the replacement cost unless it is added by endorsement.
The waiting period: trigger or deductible
Nearly every cyber form has a waiting period, measured in hours, before business interruption coverage begins. How it works changes the payout more than the number of hours does. Coalition describes the two designs on its own help pages: most policies treat the waiting period as a time-based retention, meaning no coverage for losses in the first hours (it gives 8 as the example), while its own policy treats it as a trigger. Once the outage lasts longer than the waiting period, losses count from the moment the interruption began, subject to the dollar retention. Coalition's default is eight hours, and it says it offers periods as low as one hour. Those are one carrier's terms, but the distinction applies in any quote: ask whether the waiting period is a deductible or a trigger.
A hypothetical to see the difference
Say a 30-person distributor has net income plus continuing expenses of $40,000 per business day. Its systems are down for four business days, and it has a 24-hour waiting period. This is an invented illustration, with a simplified calendar.
| Waiting period design | Days counted | Covered loss before dollar retention |
|---|---|---|
| Time retention (first 24 hours excluded) | 3 days | $120,000 |
| Trigger (outage exceeded 24 hours, loss counted from start) | 4 days | $160,000 |
Same outage, a $40,000 difference. Neither design is wrong, but they are priced differently, and you need to know which one you hold.
Dependent business interruption
dependent business interruption (also called contingent BI in cyber forms) pays your lost income when someone else's systems fail. Look for these features:
- Which providers count. Some forms cover only IT providers, such as cloud hosts, SaaS vendors, data centers and managed service providers. Others add any vendor or supplier. Some schedule named providers; others use a definition. A form limited to named providers will not cover the one you add next year unless you update the schedule.
- Cause of the provider's failure. Some forms cover only a security failure at the provider, and others also cover a non-malicious failure. That distinction mattered a great deal in the 2024 CrowdStrike outage.
- Sublimit and waiting period. Dependent BI often has a lower limit than direct BI, and sometimes a longer waiting period, because the insurer cannot see the provider's controls.
- Non-IT supply chains. A supplier's factory fire or a shipping delay is outside a cyber policy. That risk sits in the property policy's contingent coverage, if you have it.
Coalition describes its direct and contingent coverage as responding to interruption of your own systems or those of a cloud provider due to a cybersecurity failure or systems failure, and gives a SaaS provider shut down by a hacker as an example. Treat that as a sample of how one form is structured, not a market standard.
Common limits and exclusions to read
- Betterment. Upgrades that improve systems beyond their prior state are generally excluded unless added by endorsement.
- Infrastructure. Failure of electric power, telecommunications or the internet outside your control is excluded in many forms, with carve-backs for your own network or for services you contract for. Read the carve-back. See common cyber insurance exclusions.
- War and state-backed attacks. See war and state-backed attack exclusions in cyber policies.
- Unsupported or unpatched systems. Some forms reduce or exclude loss arising from known vulnerabilities left unpatched.
- Reputational harm and lost future customers. Often covered only to a narrow extent.
- Sublimits. Ransomware events may carry a sublimit or coinsurance that applies to the BI payment too (ransomware sublimits and coinsurance in cyber policies).
Proving the loss
The carrier measures lost income against what would have happened without the outage. You will need sales and payroll for the prior year, current-year trends, records of what was down and when, and evidence of manual workarounds. A forensic accountant often builds the calculation, and your own accountant should be in the room. documenting a business interruption claim, from day one to final payment covers the documentation habits, and what happens when you file a cyber claim shows how this fits into the whole claim. The same math helps you set the limit: the business income (interruption) limit calculator estimates daily income at risk, and your IT recovery time tells you how many days to insure.
Questions to ask your broker
- Does the BI grant apply to system failure, not only security failure?
- Is the waiting period a deductible or a trigger, and how many hours?
- Is dependent BI included, for which providers, and at what sublimit?
- Does voluntary shutdown qualify, and does it need the carrier's consent?
- How long is the period of restoration, and is there an extended period?
- Are the BI, extortion and data restoration limits separate or shared?
- Do any exclusions (infrastructure, unpatched systems, war) cut into the BI grant?
Run these against the cyber insurance readiness checklist when you prepare for renewal, and compare quotes on these terms, not on price alone.
Key takeaways
- Cyber business interruption pays lost net income and extra expense without physical damage, which a property policy generally cannot do.
- The trigger decides coverage: security failure only, or also system failure and provider outages.
- Ask whether the waiting period is a time deductible or a trigger. In our hypothetical it changed the payout by $40,000.
- Dependent BI varies by which providers count, whether non-malicious failures qualify and what the sublimit is.
- Document downtime and workarounds from the first hour, since the claim is paid on proof.