Contents
Short answer
Business cyber insurance typically combines three parts: emergency help (such as IT forensics and crisis advice), own losses (such as data recovery or business interruption) and third-party claims (cyber liability). Which modules are included and at what level differs by provider and contract. What counts are the conditions and the policy schedule.
Typical areas of cover
Assistance and services
Emergency hotline, IT forensics for analysis and evidence, crisis management and PR advice, legal advice on notification duties. The German Insurance Association (GDV) names these services as part of a standard cyber policy under its non-binding model conditions.
Own losses
Costs of data recovery and system reconstruction, costs of notifying affected people and – depending on the contract – compensation for business interruption, for example via an agreed daily rate or loss of income.
Third-party claims (cyber liability)
Assessing and defending third-party claims and compensating justified ones, for example after a data leak. GDPR damages can also be covered under newer model conditions.
Cyber extortion
Support and costs in an extortion case, for example after ransomware – the contract sets the extent.
Only if agreed
Cyber fraud (such as fake payment instructions), outages at cloud providers or service providers, and prevention services such as training are often optional or limited. Don’t assume them.
Which points should a business compare?
- 1
Insured events
Which incidents trigger cover – attack, operating error, data protection breach?
- 2
Sum insured and sub-limits
Overall sum and limits for individual modules.
- 3
Excess
Monetary and time-based: from which hour of interruption is compensation paid?
- 4
Indemnity period
For how long is business interruption compensated at most?
- 5
Business interruption and cloud
Is an outage at the cloud or service provider covered, or only your own IT?
- 6
Cyber fraud
Included, optional or excluded?
- 7
Service provider costs and consent
Must you use designated crisis providers or obtain consent first?
- 8
Obligations and security requirements
Which measures does the contract require before and after an incident?
- 9
Exclusions
For example war, infrastructure failures or intent – wording differs.
Step by step
- 01
Clarify IT dependency
How long could your business work without IT, email or online shop? That shows how important business interruption cover is.
- 02
Identify third-party data
Do you process customer, patient or payment data? Then liability and notification costs matter more.
- 03
Check service providers and cloud
Note which systems run at third parties and check whether their outage would be covered.
- 04
Assess your security honestly
Clarify backups, updates and access before answering application questions.
- 05
Compare conditions
Compare modules, sums, excesses and obligations – not just the premium.
Checklist
- Insured events and exclusions are known.
- Sum, sub-limits and excesses fit the risk.
- Indemnity period and time excess for business interruption are checked.
- Cloud and service provider outages are clarified.
- Cyber fraud is included or consciously not chosen.
- Obligations are known and implemented.
- Claims process and hotline are recorded in the incident plan.
Common mistakes
- Assuming business interruption or cyber fraud is always included.
- Reading only the product brochure, not the conditions.
- Not checking cloud dependencies.
- Forgetting obligations after signing.
- Instructing service providers yourself in a claim when consent is required.
Frequently asked questions
Is business interruption always included?
No. It is often a separate or optional module, with an indemnity period and a time excess.
Are cloud outages covered?
Only if agreed. Some contracts cover outages at service providers, others only your own IT.
What does cyber liability mean?
The part that assesses third-party claims, defends unjustified ones and pays justified ones, for example after a data leak.
What are the GDV model conditions?
Non-binding templates from the German insurance association. Insurers can use them but may also deviate.
Does insurance replace IT security?
No. It cushions financial consequences and usually requires security measures itself.
Sources
- GDV – Das leistet eine Cyberversicherung (aktualisiert 21.04.2026)
- GDV – Unverbindliche Musterbedingungen AVB Cyber (Stand 02/2024)
Checked on 7 October 2026.
This content is for general guidance only and does not replace individual insurance advice, legal advice or a technical security review. What counts are the relevant policy conditions, the policy schedule and the specific case.