Coverage map
What policies may cover — and what they often exclude
This is a planning reference, not policy language. Your broker and carrier form determine actual coverage. We tie each row to evidence types our workflow produces.
| Type | Coverage area | Typical scope | What this means for you |
|---|---|---|---|
| First-party | Forensic & legal costs | Investigation, counsel, and breach response expenses your policy may reimburse. | Evidence that logging and IR contacts existed before the event supports eligible cost recovery — subject to policy terms. |
| First-party | Data & system recovery | Restoration of systems and data from viable backups. | Tested immutable/offline backups documented in S3/S4 are the evidence type adjusters request. |
| First-party | Business interruption | Income loss during covered downtime from a cyber event. | Requires proof the outage was a covered peril — control maintenance records help establish you were not excluded for negligence. |
| First-party | Cyber extortion (where lawful) | Ransom or extortion payments where insurable and legally permitted. | Carriers often scrutinize MFA, backups, and EDR — gaps map to S2/S3 remediation, not payout guarantees. |
| First-party | Notification & credit monitoring | Regulated notification and consumer monitoring costs. | Incident contact paths and training records from S6 support timely, documented response. |
| Third-party | Privacy & network liability | Claims from third parties for data exposure or network harm. | Accurate questionnaire answers and email authentication (SPF/DKIM/DMARC) evidence reduce misrepresentation disputes. |
| Third-party | Regulatory fines (where insurable) | Certain regulatory penalties when covered by policy wording. | Varies by policy and jurisdiction — we document controls; your broker confirms insurability. |
| Commonly excluded | Poor security / non-compliance | Losses when required controls were not maintained or answers were inaccurate. | S5 retainer + S2 accuracy checks exist to reduce this denial path — not eliminate it. |
| Commonly excluded | Pre-existing vulnerabilities | Known unpatched issues or incidents before the policy period. | S2 gap analysis documents remediation dates before bind. |
| Commonly excluded | State-sponsored acts | War/terrorism or state-actor exclusions per policy form. | Not mitigated by SMB controls — broker explains applicable endorsements. |
| Commonly excluded | Social engineering (without endorsement) | Funds transfer fraud often excluded unless endorsed. | Training and MFA evidence may support endorsements — we document; carrier decides coverage. |
| Commonly excluded | Post-attack upgrades | Improvements beyond restore-to-pre-loss condition. | S3 remediation is for underwriting readiness, not claim-funded modernization. |
Forensic & legal costs
First-party- Typical scope
- Investigation, counsel, and breach response expenses your policy may reimburse.
- What this means for you
- Evidence that logging and IR contacts existed before the event supports eligible cost recovery — subject to policy terms.
Data & system recovery
First-party- Typical scope
- Restoration of systems and data from viable backups.
- What this means for you
- Tested immutable/offline backups documented in S3/S4 are the evidence type adjusters request.
Business interruption
First-party- Typical scope
- Income loss during covered downtime from a cyber event.
- What this means for you
- Requires proof the outage was a covered peril — control maintenance records help establish you were not excluded for negligence.
Cyber extortion (where lawful)
First-party- Typical scope
- Ransom or extortion payments where insurable and legally permitted.
- What this means for you
- Carriers often scrutinize MFA, backups, and EDR — gaps map to S2/S3 remediation, not payout guarantees.
Notification & credit monitoring
First-party- Typical scope
- Regulated notification and consumer monitoring costs.
- What this means for you
- Incident contact paths and training records from S6 support timely, documented response.
Privacy & network liability
Third-party- Typical scope
- Claims from third parties for data exposure or network harm.
- What this means for you
- Accurate questionnaire answers and email authentication (SPF/DKIM/DMARC) evidence reduce misrepresentation disputes.
Regulatory fines (where insurable)
Third-party- Typical scope
- Certain regulatory penalties when covered by policy wording.
- What this means for you
- Varies by policy and jurisdiction — we document controls; your broker confirms insurability.
Poor security / non-compliance
Commonly excluded- Typical scope
- Losses when required controls were not maintained or answers were inaccurate.
- What this means for you
- S5 retainer + S2 accuracy checks exist to reduce this denial path — not eliminate it.
Pre-existing vulnerabilities
Commonly excluded- Typical scope
- Known unpatched issues or incidents before the policy period.
- What this means for you
- S2 gap analysis documents remediation dates before bind.
State-sponsored acts
Commonly excluded- Typical scope
- War/terrorism or state-actor exclusions per policy form.
- What this means for you
- Not mitigated by SMB controls — broker explains applicable endorsements.
Social engineering (without endorsement)
Commonly excluded- Typical scope
- Funds transfer fraud often excluded unless endorsed.
- What this means for you
- Training and MFA evidence may support endorsements — we document; carrier decides coverage.
Post-attack upgrades
Commonly excluded- Typical scope
- Improvements beyond restore-to-pre-loss condition.
- What this means for you
- S3 remediation is for underwriting readiness, not claim-funded modernization.
Denial drivers explained on exclusions.
KJ Digital Solutions is a risk-reduction consultancy — not an insurer, broker, or guarantor of coverage, premiums, or claim payouts. The carrier determines coverage; you remain responsible for maintaining controls for the policy term.