Technology
The product is the service, and the service is provided on an infrastructure that is almost never entirely owned. What a technology company will have to support on the day of the incident was decided long before, in the contract it signed with its client and in the one it signed with its supplier.
Data breach, service outage and contractual penalties
A technology policy is read with the client's contract alongside.
The committed service level, the indemnity clause, and the role of data processor determine in advance the extent of an incident. These three clauses are negotiated while the contract remains open, and they determine which part of the promise can be transferred to a policy and which part is supported with own resources.
Service level penalties and what is insurable from them.
A software failure harms the client without breaking anything, and that loss is covered by professional technology liability. The penalty agreed in the service level agreement is another matter: it is an obligation you assumed by contract, and policies exclude it unless expressly agreed. Distinguishing in the contract itself the damage from the penalty is what allows insuring the insurable part.
Network interruption and extension to cloud provider.
The network interruption cover starts to accrue once a waiting period negotiated in hourly segments is fulfilled. When the cloud provider fails, it only responds if the extension to technology providers is contracted.
Data exfiltration and the duty to notify.
A breach triggers the deadlines of Articles 33 and 34 of Regulation (EU) 2016/679, and the first thing is to know your position. As a data processor, the obligation is to notify the controller without undue delay, while the seventy-two hours to notify the supervisory authority apply to them. Article 82 further limits your liability to what you breach of your own obligations or what you do outside their instructions, and that boundary is what is transferred to the contract and the policy. The cyber policy response panel orders forensic, notification, and defence; it is advisable to have its phone number outside the systems.
The delivered code and the retroactive date.
Professional cover is contracted on a claims-made basis, so it addresses what is claimed during its validity regardless of when it was programmed. A version delivered years ago continues to run at the client's premises, and retroactivity decides which projects remain protected when changing company. Inventorying which versions remain in production before moving the policy is what sets the date that must be preserved.
The covers that support a company in this sector
Each one is designed based on the company's real exposure. None are contracted the same in two companies in the same sector.
- Cyber risk insurance24h response and business interruption
- Group health insurance for companiesFlexible pay and medical network
- Life insuranceProtection for those who depend on you
- Personal accident insuranceFinancial consequences contained
- Subsidy insurance for work absenceIncome while you are signed off
Lo que nos preguntan en technology
Does the cyber policy also cover errors in my software?
They are two distinct and complementary contracts. The cyber policy covers the security incident —intrusion, encryption, data breach— and the stoppage it causes; the programming or configuration error that economically harms the client belongs to professional technology liability. Many software companies maintain both, with their own limits and with the boundary between the two written in both terms and conditions.
What happens if the outage is caused by my cloud provider?
The network interruption guarantee covers the loss of margin due to system unavailability, and by default refers to your own systems. To ensure coverage when the provider is down, you must expressly contract the extension to technology providers. The compensation is payable once the agreed waiting period has been exceeded, so this period is chosen alongside the availability commitment you have already signed with your clients.
A client demands unlimited liability in the contract. What part of that is insurable?
The policy covers the damage you cause, within the contracted limit and with any exclusions it may have; what you assume beyond your legal liability, through a hold harmless clause or an agreed penalty, is usually excluded due to the exclusion of assumed contractual obligations. The useful conversation happens before signing: limit the indemnity to actual damage, cap the penalty, and ensure that this cap fits within the limit you already have.
What we have published about these risks
Anatomy of a ransomware claim: the seventy-two hours that determine the cost
The ransom is almost never the most expensive item. The costly part is the downtime, the reconstruction of the environment, and the notifications that must be made against the clock.
8 min de lecturaActualidad normativa
NIS2: which companies it affects and what changes in their cyber risk policy
The directive greatly expands the number of obligated entities and introduces personal liability for management. What it implies for insurance.
6 min de lecturaGuía
Collective health: medical network, reimbursement or mixed
The decision that most affects staff satisfaction is not the premium, it is the modality. And it depends on where people live, not where the headquarters is.
6 min de lectura