A cyberattack could transform a normal working day into a race against time. The files would become inaccessible, employees would lose access to critical systems, and clients could be left wondering what happened to their data.
Under such circumstances, your actions will be more important than you might think. Indeed, cyber insurance will help to cover your losses financially, but it doesn’t mean that all the decisions you make will be accepted without questions.
Indeed, most insurance companies have specific demands regarding the procedure for reporting, saving evidence, and contacting qualified specialists. To be sure that you will act according to the rules in the case of an attack, it is better to learn about them now.
One can’t follow the rules one hasn’t even gone through. Pick your policy now and list three points.
And then develop a one-page plan which will state who will make decisions, call the insurer and the IT vendor.
The instinct is to wipe the infected machines and get back to work. Resist it.
Disconnect computers that have been compromised from the Internet through either unplugging the cable or turning off the Wi-Fi connection. Don’t reimage or delete anything yet. Forensic investigators need logs, memory, and disk evidence to work out how the attacker got in and what data they touched, and that finding drives everything from your notification duties to the size of the claim.
Assume the attacker can read your email. Move incident discussions to phone calls or a separate messaging channel on personal devices until your responders say otherwise.
You have to report to the hotline the instant you think something might be happening, not once it’s verified. Insurers would rather open a file that turns out to be minor than learn about a serious breach a week late. The call usually connects you to a breach coach, often a lawyer, who coordinates the forensic and recovery firms. Working through counsel can also help keep the investigation privileged.
The panel firm should endeavor to establish the point of entry, duration of stay, systems that were accessed, and whether any data was exfiltrated from the network. Those answers aren’t academic. Verizon’s 2026 Data Breach Investigations Report found that exploiting software vulnerabilities was the most common way attackers got in, at 31% of breaches, and that ransomware appeared in 48% of breaches (Verizon 2026 DBIR). If the entry point is an unpatched VPN, restoring from backup without fixing it just invites the attacker back.
Do not respond to the ransom note yourself. Payment decisions belong with your breach coach and insurer. There’s also a legal dimension: the U.S. Treasury’s Office of Foreign Assets Control has warned that facilitating ransomware payments can carry sanctions risk, and that prompt reporting and cooperation with law enforcement count as mitigating factors (OFAC updated advisory, September 2021). Many victims never pay. Verizon found that 69% of ransomware victims didn’t.
File a report with the FBI at ic3.gov. Generally, your breach coach will advise you on timing. For business email compromise involving a wire transfer, speed matters, so call your bank immediately as well.
Here comes the part where preparation helps. If you have an offline or immutable backup that has been tested, recovery is a matter of rebuilding systems in priority order. If your only backups were reachable from the network, they may be encrypted too.
Agree on that priority order before an incident: usually identity systems first, such as Microsoft 365 or the domain controller, then the line-of-business application, then file shares, then everything else.
Reset passwords for affected and privileged accounts, revoke active sessions, and check for attacker-created accounts or forwarding rules in email. Identify the entry point that was determined through forensics prior to re-establishing the systems.
The incidents drain, and fatigue leads to errors. Rotate staff on long recovery shifts, keep a single person responsible for updates to employees, and give customer-facing staff a short, approved statement so they aren’t improvising answers about what happened.
Keep a running log of staff overtime, outside invoices, lost revenue, and extra expenses. Company interruption claims are only as good as the records behind them.
Personal information being compromised means notification laws come into effect. In New York, an amendment to General Business Law § 899-aa that took effect in December 2024 requires businesses to notify affected New York residents within 30 days of discovering a breach, with limited exceptions for law enforcement needs (MoFo summary). Other states, federal regulators, and contracts with your customers may set their own deadlines. Your breach coach should map these out early.
There isn’t any cheaper insurance add-on than a 90-minute tabletop exercise. Walk through a scenario: the file server is encrypted at 6 a.m. Monday. Who calls whom? Where is the hotline number? Who decides whether to shut down email? You’ll find gaps, such as the only person who knows the backup password being on holiday, while they’re still cheap to fix.
If you depend on any external IT staff, include them in your plan by name. A good provider of managed IT services in NYC or anywhere else should know your insurer’s hotline, your panel requirements and your restore priorities as well as you do, and should join the rehearsal.
Your policy is a contract for the worst week of your business. Read it now, write a one-page plan around it, and practise once. When the bad night comes, you’ll be following a script instead of guessing.
Ans: It will assist in starting the incident response process at the insurer and identifying which vendors, legal counsel, and forensic experts are pre-approved. Any delay or unauthorized decision could affect the coverage.
Ans: No. The affected systems should be isolated from the network but not wiped or reimaged by you until the forensic investigators have collected the evidence.
Ans:It depends on the type of insurance policy, limits, exclusions, and consents required. The company is advised to seek guidance from its insurer and breach attorney because there could be additional legal and sanctions risks.
Ans: Review the cyber insurance policy, save the emergency contacts of the insurer, identify approved vendors, have immutable backups tested, and run a yearly incident response drill.
