How do you determine a cyber sum insured?
There is no one-size-fits-all sum insured. The starting point should be a concrete loss scenario that is plausible for your own company. To build it, record the possible business interruption and other external costs separately. Then check whether quotations actually cover these items and which sublimits, waiting periods, deductibles or exclusions apply.
The calculation below only adds up your own assumptions. The result is not a premium, not a quotation and not a recommendation for a particular sum insured.
Scenario calculation: daily value × days of downtime + recovery + legal/notification + optional item (direct loss or third-party loss). Enter amounts in whole francs and, if unsure, calculate several scenarios separately. The total remains an internal scenario: sublimits, deductible, waiting period, exclusions and follow-on costs not captured can change how the contract works. You can then have your scenario checked against quotations or review the comparison criteria.
What belongs in a robust scenario?
1. Lost earnings rather than plain revenue
For business interruption, total daily revenue is not automatically the right assumption. Document which contribution margin or earnings could actually be lost if the critical process fails, and which costs continue to run. The definition in the policy may differ.
2. A realistic recovery time
The days of downtime should come from your own emergency and recovery plan. Consider not only the technical repair but also testing, data reconciliation and a controlled restart. If unsure, calculate a minor, moderate and severe scenario separately.
3. External recovery
Depending on the incident, this may include IT forensics, incident response, clean-up, reinstallation and data recovery. Internal staff costs and services already paid for under contract should be documented separately so that no item is counted twice.
4. Legal and notification
A data incident can trigger external legal advice, investigations and necessary communication. Whether notification or information is required depends on the specific facts and the applicable law. The calculation does not assume a fixed notification deadline or a flat number of affected persons.
5. Direct loss or third-party loss
Only enter this optional item if it is part of your scenario. A direct financial loss, a contractual claim by a customer and data protection liability are different risks. Whether they are insured depends solely on the terms of the specific quotation.
From scenario total to quotation review
Do not simply carry the calculated total over as your desired sum insured. Ask every quotation the same questions:
| Checkpoint | Question for the comparison |
|---|---|
| Sum insured | Is the limit available per event and additionally as an annual aggregate? |
| Business interruption | Which waiting period, valuation method and maximum indemnity period apply? |
| Sublimits | Which sublimits apply to provider outage, fraud, extortion, data and recovery? |
| Deductible | Is it applied once per event or to several modules? |
| Third-party losses | Which claims arising from data protection, confidentiality and contracts are included or excluded? |
| Incident response | Which hotline and providers must be contacted first in the event of a claim? |
| Security information | Which answers in the questionnaire become relevant for acceptance and claims assessment? |
A quotation can fall short on the decisive sublimit despite a high overall limit. Conversely, a high limit replaces neither suitable terms nor a tested recovery plan.
Three scenarios beat false precision
A simple range is practical:
- Limited incident: a critical process is briefly disrupted and external help remains manageable.
- Serious outage: several systems must be restored in a controlled way and external specialists are engaged for longer.
- Severe incident: in addition to your own downtime, legal investigations or possible third-party claims arise.
For each scenario, record the assumptions, owners and date. This lets you update the calculation when systems, cloud dependencies or contracts change.
Sources and context
Advice and placement of quotations are provided by BTAG Versicherungsbroker AG. Only the quotation, the insurance terms and the individual risk assessment are binding.