Cyber insurance for public agencies: coverage, exclusions, and controls

Reference article · 5 min read

Agencies buy cyber coverage through a broker from a commercial carrier or, commonly at the local level, through a public entity risk pool that spreads risk across member governments. Either way, underwriting has become an outside review of the agency's security program. A policy that once renewed with a signature and a premium payment may now require documented evidence of specific controls before a carrier will quote.

The shift produces predictable problems. A carrier asks for controls nobody funded, a renewal quote arrives with a higher retention and a lower ransomware sublimit, or an incident begins and no one is certain who the agency is permitted to call. Coverage varies by carrier and form, so read the specimen policy as the authority.

What a cyber policy typically covers

Most cyber policies are written on a claims-made basis and split into first-party and third-party sections. First-party coverage pays the agency's own costs:

• Incident response. Breach counsel, digital forensics, and containment, usually the first coverage triggered.
• Notification and monitoring. Required notices to affected individuals, call center support, and credit monitoring.
• Business interruption and extra expense. Lost revenue from functions such as utilities and permitting, plus the cost of operating while systems are down, usually after a waiting period measured in hours.
• Restoration. Rebuilding systems and restoring data to their prior state, not improving on it.
• Cyber extortion. Negotiation support, and sometimes payment, subject to law and sanctions screening.

Third-party coverage pays what the agency owes others: privacy liability for claims by residents or employees, regulatory defense and fines where insurable, payment card assessments, and media liability.

Exclusions and sublimits that matter

• Failure to maintain stated controls. If the agency represented a control on the application and did not maintain it, the carrier may deny the claim or rescind the policy. This is the exclusion most directly within agency control.
• War and hostile act. Market language has tightened in response to state-sponsored attacks. Read how the form defines attribution.
• Prior knowledge and retroactive dates. Incidents known before the policy period, and events predating the retroactive date, fall outside coverage.
• Sublimits. Ransomware, funds transfer fraud, and regulatory coverage often carry limits well below the policy aggregate. The headline limit is rarely the operative number.

Whether a ransom may be paid at all is a separate question: some states restrict or prohibit ransom payments by public entities, and federal sanctions screening applies regardless. These rules change, so confirm the current position with counsel before an incident rather than during one.

The application as a de facto control checklist

Underwriting questionnaires have converged on a similar set of controls, which gives agencies something concrete to budget against:

• Multi-factor authentication on remote access, email, privileged accounts, and backup systems
• Endpoint detection and response, often monitored by a managed service
• Backups that are offline or immutable, separated from production credentials, and restore-tested
• Network segmentation, particularly of operational technology and public safety systems
• Privileged access management and removal of standing administrative rights
• Patching cadence, external attack surface, and end-of-life systems still in service
• Email filtering, security awareness training, and phishing simulation
• A written incident response plan that has been exercised
• Logging sufficient to support a forensic investigation

Treat the answers as contract language, because that is what they become. Have the person who operates each control confirm the answer and keep evidence: configuration exports, restore test records, training reports. An answer signed by someone who did not check is a coverage problem waiting for a claim. The list also makes a budget case, validated from outside the agency.

The insurer's panel and who an agency may call

Most policies require carrier consent before the agency incurs covered expense, and carriers maintain approved panels of breach counsel, forensics firms, and notification vendors. Engaging a trusted local firm that is not on the panel can leave the agency paying that invoice.

• List the carrier's claim hotline near the top of the incident response call list, alongside law enforcement and state or regional information sharing partners. Insurer notice does not satisfy statutory or program reporting obligations, which run on their own clocks.
• Breach counsel is usually engaged first, so forensics proceeds under attorney direction.
• If the agency has a preferred forensics or legal firm, ask the carrier to pre-approve it in writing when the policy is bound. Mid-incident requests are slower and less likely to be granted.

What to require of vendors

• Cyber liability and technology errors and omissions coverage, with limits scaled to the sensitivity of the data rather than one boilerplate number in every contract.
• Tail coverage. Because these policies are claims-made, require coverage to continue for a defined period after the contract ends.
• Certificates and notice. A certificate at award and at each renewal, plus notice of cancellation or material change.
• Subcontractor coverage. Confirm whether the policy reaches the subcontractors that touch agency data.

Do not mistake the certificate for protection: a vendor's limit is shared across all of its customers and can be exhausted by someone else's breach. Indemnification, breach cost allocation, notification timelines, and data return obligations do the real work; insurance stands behind them.

How to prepare for renewal

1. Compare last year's application answers to current reality and assemble evidence for each control claimed.
2. Price the controls the agency cannot yet claim and submit them as a budget request, with the renewal as justification.
3. Ask the broker for the specimen policy, sublimits, retention, panel list, and consent rules.
4. Brief leadership on what is covered, what is not, and what the retention means for the general fund.

HQT works with state and local agencies on the controls underwriters ask about, including identity, endpoint, backup, and segmentation work, and on documenting them well enough to answer an application accurately.

Frequently asked questions