Cyber Enterprise Risk Management (Cyber ERM) V2.2
Chubb
Policy terms: 01/2022
no public priceTerms not public, quote via BTAG
-
Immediate help in an emergency covered
Incident response including emergency phase of the first 48 hours.
-
Restore data and systems covered
Data and System Recovery Costs.
-
Replace unusable devices add-on
Excluded in the base wording, offered in Switzerland as add-on «hardware replacement (bricking)».
-
Loss of income after an attack covered
After expiry of the waiting period (set in the policy).
-
Outage at the IT provider limited
Shared Computer Systems (cloud/SaaS) with its own limit, infrastructure excluded.
-
Outage due to operating error limited
Human error and programming errors are triggers; purely technical failure is not.
-
Cyber extortion covered
Ransom including cryptocurrency, where permissible and insurable; sub-limit/deductible possible.
-
Third-party claims after a data breach covered
Privacy and Network Security Liability.
-
Proceedings before authorities limited
Fines only where insurable, with a sub-limit.
-
Inform affected people covered
Notification under applicable data protection law.
-
Fraud with fake instructions no information
No cover for deception without a system breach found in wording V2.2.
-
Hacked e-banking add-on
Extension Cyber Crime (theft of money through unauthorised access).
-
Phone hacking and extra costs add-on
Extension Telecom Fraud; cryptojacking as a Swiss add-on.
-
Property damage caused by an attack not covered
Bodily injury and property damage excluded.
-
Reputational damage add-on
PR costs within incident response; loss of income due to reputational damage as a Swiss add-on.
-
Card industry penalties limited
Payment Card Loss with a sub-limit.
-
Media liability covered
Media Liability module.
Key facts and terms
- Price
- no public price
- For whom
- SMEs to multinational companies; broker «bulk quoting» for companies up to CHF 100 million revenue and limits up to CHF 5 million
- Sums insured
- CHF 5'000'000, CHF 30'000'000
- Deductible
- not stated
- Waiting period for loss of income
- not stated
- Indemnity period
- not stated
- Territorial scope
- worldwide; claims from USA/Canada excluded according to the UK wording (5.1)
- Policy terms
- Terms not public, quote via BTAG
Price: Only via a broker (bulk quoting, reply within 7 working days).
Gross negligence: In the UK wording only intent is excluded; treatment under Art. 14 ICA in the Swiss version unclear. Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 4.3 Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026Where does it say so? (gross negligence)
Exclusions and Duties before and after a loss (4)
Exclusions
- State cyber operations involving use of force/war.
Where does it say so? (exclusion)
Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 4.11
«committed, in whole or in part, by or on behalf of a sovereign State or state-sponsored actor»
Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026
- Failure of infrastructure.
Where does it say so? (exclusion)
Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 4.9
«any failure, interruption, disturbance, degradation, corruption, impairment, or outage of Infrastructure»
Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026
- Contractual liability and contractual penalties (PCI exempted).
Where does it say so? (exclusion)
Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 4.6
«including liquidated damages provisions»
Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026
Duties before and after a loss
- No strict backup/MFA obligations in the wording; instead, staggered deductibles/sub-limits for known, unpatched vulnerabilities (0–45, 46–90 … >365 days).
Where does it say so? (obligation)
Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.46 Neglected Software Exploit
«a patch, fix, or mitigation technique for such vulnerability has been available to you, but has not been applied»
Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026
All values as a table
| Module | Status | Limit | What applies | Source |
|---|---|---|---|---|
| Immediate help in an emergency | covered | not stated | Incident response including emergency phase of the first 48 hours. | Where does it say so? (Immediate help in an emergency)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, Insuring Agreement 1.1 «Incident Response Expenses by reason of a Cyber Incident or a Business Interruption Incident» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Restore data and systems | covered | not stated | Data and System Recovery Costs. | Where does it say so? (Restore data and systems)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 1.3 «Data and System Recovery Costs during the Period of Indemnity» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Replace unusable devices | add-on | not stated | Excluded in the base wording, offered in Switzerland as add-on «hardware replacement (bricking)». | Where does it say so? (Replace unusable devices)Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS), 09/2025 «zusätzlichen Angeboten wie … Hardwareersatz (Bricking)» Open document: Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS) (opens in a new window), retrieved 06.11.2026 |
| Loss of income after an attack | covered | not stated | After expiry of the waiting period (set in the policy). | Where does it say so? (Loss of income after an attack)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 1.2 «Business Interruption Loss … that exceeds the Waiting Period» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Outage at the IT provider | limited | not stated | Shared Computer Systems (cloud/SaaS) with its own limit, infrastructure excluded. | Where does it say so? (Outage at the IT provider)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.71 «However, Shared Computer System shall not include Infrastructure.» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Outage due to operating error | limited | not stated | Human error and programming errors are triggers; purely technical failure is not. | Where does it say so? (Outage due to operating error)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.5 «caused solely and directly by: A. a Computer Malicious Act; B. Unauthorised Use or Access; C. Human Error» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Cyber extortion | covered | not stated | Ransom including cryptocurrency, where permissible and insurable; sub-limit/deductible possible. | Where does it say so? (Cyber extortion)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.15 «Money, including cryptocurrency(ies), paid by you where legally allowed and insurable» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Third-party claims after a data breach | covered | not stated | Privacy and Network Security Liability. | Where does it say so? (Third-party claims after a data breach)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 1.5 «Damages and Privacy and Network Security Claims Expenses» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Proceedings before authorities | limited | not stated | Fines only where insurable, with a sub-limit. | Where does it say so? (Proceedings before authorities)Chubb Cyber Enterprise Risk Management, Coverage Highlights (CH-0404), 03/2022 «Bussgelder (soweit rechtlich zulässig)» Open document: Chubb Cyber Enterprise Risk Management, Coverage Highlights (CH-0404) (opens in a new window), retrieved 06.11.2026 |
| Inform affected people | covered | not stated | Notification under applicable data protection law. | Where does it say so? (Inform affected people)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.28 C «to comply with consumer notification provisions of Privacy Regulations» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Fraud with fake instructions | no information | not stated | No cover for deception without a system breach found in wording V2.2. | Where does it say so? (Fraud with fake instructions)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022 Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Hacked e-banking | add-on | not stated | Extension Cyber Crime (theft of money through unauthorised access). | Where does it say so? (Hacked e-banking)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 2.3 «Direct Financial Loss solely as a result of Theft of the Insured Organisation's Money» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Phone hacking and extra costs | add-on | not stated | Extension Telecom Fraud; cryptojacking as a Swiss add-on. | Where does it say so? (Phone hacking and extra costs)Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS), 09/2025 «Technologiebetrug (Cryptojacking)» Open document: Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS) (opens in a new window), retrieved 06.11.2026 |
| Property damage caused by an attack | not covered | not stated | Bodily injury and property damage excluded. | Where does it say so? (Property damage caused by an attack)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, Exclusion 4.8 «arising out of or attributable to any Bodily Injury or Property Damage» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Reputational damage | add-on | not stated | PR costs within incident response; loss of income due to reputational damage as a Swiss add-on. | Where does it say so? (Reputational damage)Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS), 09/2025 «Reputationsschaden» Open document: Chubb Cyber Bulk-Quoting Factsheet (CH9044-HS) (opens in a new window), retrieved 06.11.2026 |
| Card industry penalties | limited | not stated | Payment Card Loss with a sub-limit. | Where does it say so? (Card industry penalties)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 3.49 «due to your non-compliance with the Payment Card Industry Data Security Standard» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
| Media liability | covered | not stated | Media Liability module. | Where does it say so? (Media liability)Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung, 01/2022, 1.6 «Damages and Media Claims Expenses by reason of a Media Claim» Open document: Chubb Cyber ERM Version 2.2 Policy Wording (UK-ERM V2.2 01/22), englisches Recht – nur Stellvertreter für die nicht öffentliche CH-Fassung (opens in a new window), retrieved 06.11.2026 |
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.