Insurance requirements for cyber risks

Introduction

Cyber risks refer to potential financial, legal, operational, and reputational losses arising from cyberattacks, unauthorised access, data breaches, ransomware, identity theft, digital fraud, and disruption of computer networks. With the increasing dependence on digital technologies, biotechnology companies, healthcare institutions, financial organisations, research laboratories, and government agencies face growing exposure to cyber-related threats.

Insurance requirements for cyber risks refer to the legal, contractual, and financial arrangements through which organisations obtain protection against losses arising from cybersecurity incidents. Cyber insurance is designed to address expenses associated with data breaches, cyber extortion, business interruption, forensic investigations, legal proceedings, and third-party liability.

In biotechnology, cyber insurance is particularly important because organisations maintain sensitive genomic information, clinical trial records, patient databases, research findings, and proprietary biological information. A cyberattack affecting such information may create serious financial and legal consequences.

Meaning and Scope of Cyber Risk Insurance

Cyber risk insurance is a specialised insurance arrangement that protects individuals and organisations against specified financial losses arising from cyber incidents.

It generally provides two categories of protection.

1. First-party coverage

First-party coverage protects the insured organisation against its own direct losses, including:

Costs of investigating cybersecurity incidents.

Data recovery and restoration expenses.

Business interruption losses.

Cyber extortion response expenses, where legally permissible.

Crisis management and public relations expenses.

Costs associated with notifying affected individuals.

Digital forensic and technical investigation expenses.

2. Third-party coverage

Third-party coverage protects organisations against certain claims made by external parties following a cyber incident.

It may include:

Legal defence expenses.

Claims arising from privacy violations.

Liability for unauthorised disclosure of confidential information.

Claims involving network security failures.

Certain regulatory investigation and proceeding expenses.

Liability arising from the failure of outsourced service providers.

Coverage depends on the insurance contract, applicable law, and specific exclusions.

Legal and Regulatory Framework in India

1. Information Technology Act, 2000

The Information Technology Act, 2000 provides the principal statutory framework addressing electronic records, cybersecurity-related offences, and certain forms of unauthorised access.

Important provisions include:

Section 43: Provides for compensation for specified unauthorised acts involving computer systems and networks.

Section 43A: Historically provided compensation for failure to protect sensitive personal data or information through reasonable security practices. Its present applicability must be read in light of the Digital Personal Data Protection Act, 2023 and the relevant commencement and repeal provisions.

Section 66: Addresses specified computer-related offences committed dishonestly or fraudulently.

Section 70: Provides for the protection of protected systems.

Section 70B: Establishes the Indian Computer Emergency Response Team (CERT-In) as the national agency for cybersecurity incident response.

These provisions are relevant when organisations experience data breaches, unauthorised access, and other cyber incidents.

2. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes obligations concerning the processing of digital personal data.

Organisations processing personal data must examine their obligations concerning security safeguards, data protection, and breach notifications.

Section 8 addresses the obligations of data fiduciaries, including reasonable security safeguards to prevent personal data breaches.

Cyber insurance may help manage certain financial consequences of data protection incidents, subject to policy conditions and applicable law.

3. CERT-In Directions, 2022

The Indian Computer Emergency Response Team issued directions on April 28, 2022, under Section 70B(6) of the Information Technology Act.

These directions address cybersecurity incident reporting, maintenance of specified logs, and other information security requirements.

Specified cyber incidents must generally be reported to CERT-In within six hours of noticing them or being brought to notice.

Cyber insurance policies should therefore be coordinated with internal incident-response procedures to ensure timely regulatory reporting.

4. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

These rules established security requirements concerning sensitive personal information under the Information Technology Act.

Their continuing applicability must be assessed in light of the Digital Personal Data Protection Act and relevant transitional provisions.

5. Insurance Regulatory and Development Authority of India Act, 1999

IRDAI regulates insurance companies and supervises insurance business in India.

Cyber insurance products must comply with applicable regulatory requirements concerning policy documentation, disclosures, exclusions, and claim settlement.

Essential Insurance Requirements for Cyber Risks

Organisations seeking cyber insurance must satisfy several underwriting and contractual requirements.

1. Cybersecurity Risk Assessment

Insurers generally evaluate an organisation's cybersecurity infrastructure before issuing coverage.

The assessment may include:

Network security arrangements.

Firewall and antivirus protection.

Multi-factor authentication.

Data encryption.

Employee cybersecurity training.

Backup and disaster recovery systems.

Vulnerability assessments.

2. Accurate Disclosure of Cyber Risks

Applicants must provide accurate information concerning their digital infrastructure, previous cyber incidents, data storage practices, and existing security arrangements.

Material misrepresentation or concealment may affect the insurer's liability under the policy.

3. Appropriate Coverage Limits

Organisations must select insurance limits according to their potential financial exposure.

For example, a biotechnology company handling extensive genomic and clinical trial information may require higher coverage than a small organisation maintaining limited digital records.

4. Incident Reporting Requirements

Cyber insurance policies commonly require prompt notification of incidents that may give rise to claims.

Organisations must follow the notification procedures and deadlines specified in their policies. They must also comply independently with applicable statutory reporting requirements.

5. Business Continuity Arrangements

Insurers may examine whether the organisation maintains backup systems, recovery procedures, emergency communication arrangements, and alternative operational facilities.

6. Third-Party Service Provider Security

Organisations using cloud platforms, outsourced IT services, and external data-processing providers must assess their cybersecurity arrangements and contractual responsibilities.

Types of Cyber Insurance Coverage

1. Data Breach Insurance

Provides coverage for specified expenses arising from unauthorised access, disclosure, or loss of personal and confidential information.

2. Ransomware Insurance

May cover eligible incident response, forensic investigation, restoration, and certain cyber extortion-related expenses, subject to legal restrictions and policy exclusions.

3. Business Interruption Insurance

Protects against specified financial losses arising from interruptions to business operations caused by covered cyber incidents.

4. Cyber Liability Insurance

Provides protection against certain third-party claims arising from network security failures, privacy violations, and data breaches.

5. Digital Asset Restoration Insurance

May cover eligible expenses associated with restoring corrupted, damaged, or inaccessible digital information.

6. Social Engineering and Cyber Fraud Coverage

Certain policies provide protection against specified financial losses caused by fraudulent electronic communications, impersonation, or manipulation of employees.

Major Challenges in Cyber Risk Insurance

Cyber insurance presents several legal and commercial challenges.

Rapid technological changes: Cyber threats continuously evolve, making risk assessment difficult.

Increasing premiums: Organisations with weak cybersecurity infrastructure may face higher premiums or restrictive coverage.

Systemic cyberattacks: A single attack affecting a widely used cloud service may generate claims across multiple insured organisations.

Attribution difficulties: Identifying the responsible person or organisation behind an attack may be challenging.

Policy exclusions: War, terrorism, infrastructure failure, and intentional misconduct exclusions may affect coverage.

Data valuation: The financial value of confidential business information and research databases may be difficult to determine.

Regulatory compliance: Organisations may face separate reporting, investigation, and legal obligations following an incident.

Important Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other relevant constitutional provisions.

The judgment established that informational privacy is an essential component of individual privacy and that personal information requires appropriate legal protection.

Relevance: Cyber incidents involving personal information may result in privacy-related legal liabilities. Organisations should consider cyber insurance to manage eligible expenses arising from data breaches and privacy claims.

2. Shreya Singhal v. Union of India (2015)

The Supreme Court examined the constitutional validity of Section 66A of the Information Technology Act, 2000, and struck it down for violating freedom of speech and expression.

The judgment is important because it clarified constitutional limits on regulating online activities.

Relevance: Organisations must ensure that cybersecurity policies and digital monitoring practices operate within constitutional and statutory boundaries. Cyber insurance cannot replace compliance with applicable legal requirements.

3. Avnish Bajaj v. State (NCT of Delhi) (2008)

The case concerned the circulation of an obscene video through an online marketplace and examined legal questions involving intermediary responsibility and offences under the Information Technology Act.

It highlighted the legal risks associated with online platforms and electronic content distribution.

Relevance: Digital businesses may face legal exposure arising from inadequate platform controls, content management failures, and cybersecurity weaknesses. Appropriate insurance may help address certain covered legal expenses and liabilities.

4. NASSCOM v. Ajay Sood (2005)

The Delhi High Court considered fraudulent emails sent by individuals impersonating another organisation and recognised the legal significance of protecting business identity in electronic communications.

The judgment addressed passing off through electronic communications.

Relevance: Businesses may experience financial and reputational damage from email impersonation, phishing, and fraudulent digital communications. Cyber insurance policies may cover certain losses arising from these incidents.

5. Canara Bank v. Canara Sales Corporation (1987)

The Supreme Court examined issues relating to forged cheques and the liability of a bank in connection with unauthorised transactions.

Although the case predates modern cyber insurance, it provides useful principles concerning financial responsibility and unauthorised transactions.

Relevance: The judgment is relevant by analogy when examining disputes involving fraudulent financial transactions. Modern cyber insurance policies may address specified digital payment fraud and unauthorised electronic transactions.

Role of Organisations and Insurance Companies

Organisations must adopt effective cybersecurity governance before purchasing cyber insurance. They should maintain updated security systems, conduct regular audits, train employees, and establish documented incident-response procedures.

Insurance companies should evaluate the organisation's cybersecurity maturity, exposure to third-party risks, data sensitivity, and potential financial liabilities.

They should also clearly explain:

Covered cyber incidents.

Insurance limits and deductibles.

Exclusions and waiting periods.

Claim notification procedures.

Business interruption conditions.

Requirements for incident investigation and documentation.

In biotechnology, particular attention should be given to genomic databases, clinical trial information, research software, laboratory automation, and intellectual property protection.

Conclusion

Insurance requirements for cyber risks have become increasingly important because organisations depend heavily on digital infrastructure and electronic information. Cyberattacks, data breaches, ransomware, digital fraud, and operational disruptions can create substantial financial and legal consequences.

In India, the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, CERT-In Directions, 2022, and applicable IRDAI regulations provide an important framework for managing cybersecurity and insurance-related responsibilities.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India (2017), Shreya Singhal v. Union of India (2015), and NASSCOM v. Ajay Sood (2005) establish important principles concerning privacy, internet regulation, and electronic impersonation.

Ultimately, an effective cyber insurance framework should combine appropriate insurance coverage, strong cybersecurity infrastructure, accurate risk disclosure, regulatory compliance, and timely incident reporting. Such an approach helps organisations manage emerging digital threats while protecting confidential information, financial resources, and institutional reputation.

Note: The cited judgments establish broader principles of privacy, cyber regulation, electronic impersonation, and financial liability. They are not direct judicial decisions determining the mandatory insurance requirements or coverage terms of cyber insurance policies.