Cyber risks
We act in advisory and contentious matters, for insurers as well as for companies: cyber insurance products and policies, claims handling, cover for cyber risks and for IT providers.
France
A cyber attack raises several questions at once: does the cyber policy apply, which losses does it cover, who is liable for a provider’s failure, and how to handle the claim without making the damage worse.
We act for insurers, in designing their products and following up claims, and for commercial companies, on the cover of their cyber risks and of their IT activities and providers.
What we do
Cyber insurance products and policies
- Developing cyber insurance products: cover, exclusions, limits, associated services.
- Drafting “cyber” policies and their pre-contractual documentation.
- Fit with the company’s other policies (liability, fraud, business interruption).
Cover, follow-up and handling of claims
- Analysing cover when the incident occurs: notification, emergency measures, losses covered.
- Following up and handling claims, for the insurer or for the insured company.
- Dealings with incident response providers and with the authorities, where regulation requires it.
Risks of IT activities and providers
- Cover of the cyber risks of the company’s activities and of its IT providers: contracts, liability clauses, insurance requirements.
- Pre-litigation and litigation with an insurer, a provider or a third party after an incident.
Frequently asked questions
What does a cyber policy cover?
Depending on the contract: incident response costs (investigation, data restoration, notification), business interruption losses, ransom payments where the law allows, and liability towards third parties whose data was exposed. Exclusions and notification conditions vary from one policy to another: it is on reading them that cover is decided.
Who is liable for an IT provider’s failure?
First, the contract with that provider: security obligations, liability clauses, insurance requirements. Then the policies of the company and of the provider, which may overlap or pass the loss on to each other. We read the whole, before the contracts are signed as well as after the incident.