Contain it without destroying the evidence, and read the policy before you call anyone.
Cyber policies are unusual: most of them tell you who to call, and calling somebody else first can cost you the cover.
In orderIsolate, but do not wipe; read the incident-response clause before you call your IT firm; notify the insurer on the incident hotline; check your regulatory reporting obligations; preserve logs before retention expires; do not pay, negotiate or communicate with the attacker; record the business interruption from the first hour; keep the forensic report and the remediation invoices separate.
- Isolate, but do not wipeDisconnect affected systems from the network and leave them powered in whatever state they are in where you safely can. Volatile memory and logs are the forensic evidence, and a rebuild destroys them.Immediately
- Read the incident-response clause before you call your IT firmMost cyber policies require you to use responders from the insurer's panel and will not pay for anyone else. This is the single most expensive difference between cyber and every other class.Before engaging anyone
- Notify the insurer on the incident hotlineCyber wordings usually carry a dedicated notification route with a short window attached. Use that route rather than a general claims email.Immediately
- Check your regulatory reporting obligationsCERT-In's directions require certain classes of cyber incident to be reported within a short, specific window, and sector regulators impose their own. Confirm what applies to you today rather than relying on memory -- these have changed more than once.Check at once
- Preserve logs before retention expiresFirewall, VPN, endpoint, email gateway, domain controller, backup server. Many roll over within days, and the logs from the week before the incident are usually the ones that matter.Day 1
- Do not pay, negotiate or communicate with the attackerNot without the insurer's written agreement. Payment can breach the policy, and in some circumstances it raises legal exposure of its own.Never unilaterally
- Record the business interruption from the first hourSystems down, orders unprocessed, staff idle, workarounds paid for. Cyber business interruption is measured in hours and the record has to start with the incident.From hour 1
- Keep the forensic report and the remediation invoices separateInvestigation, restoration, ransom, legal, notification and lost income usually sit under different sub-limits. A single mixed invoice is very hard to allocate afterwards.Throughout
Liability Claim
A third party alleges injury, damage or loss caused by you or your product.
Burglary Claim
Theft from business premises, a godown, a site office or a warehouse.
Where it comes up most: IT and Professional Services. The letter that starts it: Intimation of loss.
Take this with you as a text file. It opens with no signal, prints on one page, and forwards to whoever is actually standing at the loss.
Mid-incident? Call before your IT firm touches anything else.
Whoever placed your policy, and whatever stage the claim has reached.
Cyber Incident Claim: The First Hours, Claims Desk by RFS, https://claimsdesk.in/procedures/cyber. Checked 13 September 2026.
Quote it, link to it, or reproduce it with the address attached. If you are writing about a claim and need the rule behind a line here, the desk will point you at the source: press and citation.
- Tell the insurer now, not after the assessment.
- Notice to anybody else responsible the carrier, the contractor, the police, within the time your policy sets.
- Every document within the time the insurer asks for it.