Insured, as long as you can prove it

A cyber insurance policy does not promise to pay for every attack. It promises to pay for the attack if the insured company has met certain duties. Insurance law calls these obliegenheiten, policyholder duties, and in cyber policies they are mostly the same: multi-factor sign-in for remote access and privileged accounts, a backup kept offline or immutable, a deadline for critical security updates, protection on all endpoints, no remote maintenance services exposed to the internet.

As long as nothing happens, these are lines in a contract that someone last read when it was signed. They become relevant the day after the attack.

What Section 28 VVG says

The German Insurance Contract Act (VVG) grades the consequences of a breached duty by fault. Section 28(2): in case of intentional breach the insurer is released from its obligation to pay, where the contract provides for this. In case of grossly negligent breach it may reduce its payment in proportion to the severity of the policyholder's fault. And then the clause that matters: the burden of proving that there was no gross negligence lies with the policyholder.

Subsection 3 softens this. The insurer remains liable to pay insofar as the breach did not cause the loss. Missing encryption on notebooks changes nothing about an intrusion through an unpatched VPN gateway. But someone has to be able to show that distinction too, and it does not apply in case of fraudulent intent.

The evidence exists beforehand or not at all

After a loss, the insurer asks questions, usually with a forensics provider at its side: was multi-factor sign-in for remote access active on the day of the attack, for all accounts? Did the offline copy exist, and when was it last restored from? How long had the exploited vulnerability been known?

These questions arrive in the week when IT is rebuilding operations, and often the very systems holding the answers are encrypted. Evidence gathered only then is patchy at best. It has to exist beforehand, continuously, with a date, and it has to be stored where the attack does not reach.

Then there is the notification itself. Section 30 VVG requires the insured event to be reported without undue delay. Anyone who first has to look for the claims hotline and the policy number in the mailbox of an encrypted mail server loses time that no contingency plan accounts for.

How isidaten handles it

In Contract Management, the cyber insurance is managed as a contract and its duties as contract obligations. A template provides twelve typical, neutrally worded duties, from multi-factor sign-in through network segmentation and awareness to notifying the insured event. You adopt what is in your own contract.

Three sources of evidence can be linked per duty. First, the implementation status of the matching control in the statement of applicability. Second, an external check from the external rating of your own domains, such as open remote maintenance ports or e-mail sender verification; the weakest domain counts. Third, manual evidence with a document, date and responsible person, which counts only as partially met after twelve months. This yields the status: met, partial, not met or unchecked. Overriding it requires a reason, and the calculated status remains visible alongside.

Ahead of the next cancellation or renewal date, the module creates a reminder 60 days in advance, because that is when insurers typically ask for the current state again. The duty evidence can be generated as a PDF, including for storage outside your own systems.

One limitation belongs here: the template is neutral; the wording of your own contract governs. If it differs, for instance on the patch deadline, the deadline in the contract applies.

The test question

Which duties are in your cyber policy, and who could produce dated evidence for each of them today?

If you have to look up the policy to answer the first half, after a loss only the insurer will know the answer.

Sources

Section 28 VVG, breach of a contractual duty (German). Section 30 VVG, notification of the insured event (German).