CYBER INCIDENT CLAIM: THE FIRST HOURS
The first 72 hours, from Claims Desk by RFS

Cyber policies are unusual: most of them tell you who to call, and
calling somebody else first can cost you the cover.

WHAT LOSES IT
Wiping and rebuilding before anyone images the systems -- and engaging
your own IT firm or paying a ransom before the insurer approves it. Most
cyber policies only pay for responders drawn from their own panel.

1. Isolate, but do not wipe  [Immediately]
   Disconnect affected systems from the network and leave them
   powered in whatever state they are in where you safely can.
   Volatile memory and logs are the forensic evidence, and a rebuild
   destroys them.

2. Read the incident-response clause before you call your IT firm
   [Before engaging anyone]
   Most cyber policies require you to use responders from the
   insurer's panel and will not pay for anyone else. This is the
   single most expensive difference between cyber and every other
   class.

3. Notify the insurer on the incident hotline  [Immediately]
   Cyber wordings usually carry a dedicated notification route with
   a short window attached. Use that route rather than a general
   claims email.

4. Check your regulatory reporting obligations  [Check at once]
   CERT-In's directions require certain classes of cyber incident to
   be reported within a short, specific window, and sector
   regulators impose their own. Confirm what applies to you today
   rather than relying on memory -- these have changed more than
   once.

5. Preserve logs before retention expires  [Day 1]
   Firewall, VPN, endpoint, email gateway, domain controller, backup
   server. Many roll over within days, and the logs from the week
   before the incident are usually the ones that matter.

6. Do not pay, negotiate or communicate with the attacker
   [Never unilaterally]
   Not without the insurer's written agreement. Payment can breach
   the policy, and in some circumstances it raises legal exposure of
   its own.

7. Record the business interruption from the first hour  [From hour 1]
   Systems down, orders unprocessed, staff idle, workarounds paid
   for. Cyber business interruption is measured in hours and the
   record has to start with the incident.

8. Keep the forensic report and the remediation invoices separate
   [Throughout]
   Investigation, restoration, ransom, legal, notification and lost
   income usually sit under different sub-limits. A single mixed
   invoice is very hard to allocate afterwards.

------------------------------------------------------------------------
Claims Desk by RFS - claimsdesk.in - 92514 56334
We run insurance claims end to end, including on policies placed
elsewhere. Nothing here is legal advice, and what your policy pays
is decided by its wording and the facts of the loss. Where this
says 'the time your policy sets', read your own wording: the
periods genuinely differ and a wrong one costs the claim.