Cyber Incident: The First 48 Hours and Your Insurer
If you think your business has been breached, ransomed or defrauded, do three things in order: contain what you can without destroying evidence, notify your cyber insurer before you hire anyone or agree to pay anything, and write down what happened as you go. Cyber policies commonly require prompt notice and the insurer's consent before costs are incurred, so the order of the first two days can decide what the policy pays.
Key points
- Isolate affected systems. Do not wipe, reinstall or delete anything until someone qualified has preserved it.
- Call the insurer's incident line early. Notice conditions and consent clauses are where cyber claims commonly run into trouble.
- Do not agree to a ransom demand, a forensics engagement or a public statement before the insurer is involved. Many policies name the vendors they will pay for.
- Every state has a breach notification law; some set deadlines, others require notice without unreasonable delay. Washington's is administered by the Attorney General.
- Keep a timeline from the first sign of trouble. It is the claim file.
Hour 0: contain and preserve
The first instinct is to make the problem go away: turn machines off, restore from backup, change every password. Some of that is right and some of it destroys the evidence an investigator and your insurer will need.
Guidance published for small businesses by the Cybersecurity and Infrastructure Security Agency comes down to a few steps you can take before any expert arrives: disconnect affected devices from the network rather than powering them down, preserve logs and any messages from the attacker, stop using compromised accounts, and keep a record of what you observed and when. [1]
What not to do in the first hours: do not pay anything, do not reply to the attacker beyond what a professional advises, do not wipe or reimage affected machines, and do not announce the incident publicly. Each of those can affect coverage, the investigation or your legal position.
Notify the insurer before you hire anyone
Cyber policies are usually written on a claims-made basis with notice conditions: the policyholder must report a claim or a circumstance that could become one promptly, often within a stated period, and sometimes to a specific incident-response line rather than to the broker. Late notice can be a reason for the insurer to deny part or all of a claim.
The second reason to call early is practical. Most cyber insurers maintain panels of breach coaches (lawyers who manage the response), forensic firms, notification vendors and public-relations firms, and the policy commonly requires that work be done by panel vendors, or with the insurer's consent, for the cost to be covered. A firm you hire on your own at 2 a.m. may be excellent and uninsured.
Our guide to how cyber claims are handled describes the sequence from the insurer's side; the cyber insurance page lists the coverage parts a policy typically includes.
Why consent matters
Three places where consent clauses bite:
- Ransom and extortion payments. Policies that cover extortion commonly require the insurer's prior consent to any payment, and payments can be restricted by law where the recipient is subject to sanctions. The insurer's panel handles that screening. A payment made without consent may not be reimbursed.
- Settlements. Liability coverage for claims by affected customers or partners usually includes a consent-to-settle clause: the insurer must agree before you admit liability or settle.
- Vendor costs. Forensics, notification, credit monitoring, legal advice and public relations are the costs a cyber policy is built to pay, within limits and sublimits, and often only when the insurer approved the vendor.
Read the consent and notice sections of your policy now, while nothing is happening. They are short, and they are the part of the policy you will need under pressure.
Who else has to be told
Every state has a data breach notification law, and most require notice to affected individuals, and in many cases to the state Attorney General, within a defined period after the breach is discovered. Washington's law is administered by the Attorney General's office, which publishes the requirements and receives notices. [2] Businesses that hold payment card data, health information or customers' data in other states can have additional obligations.
The breach coach's first job is usually to work out which laws apply and what the deadlines are. That is one more reason to involve the insurer early rather than working it out alone. The Federal Trade Commission's guide for businesses sets out the general sequence of securing operations, fixing vulnerabilities and notifying the right parties. [3]
What to write down
Start a timeline on the first day and keep it running. For each entry, note the time, who observed what, what action was taken and by whom. Include the first sign of trouble, the systems and accounts involved, any messages from the attacker, every call to the insurer, the broker and vendors, and every decision and who approved it.
That document does several jobs at once. It is the basis of the insurance claim, the starting point for the forensic investigation, part of the record for any regulator, and the thing that lets you answer "when did you know?" accurately months later.
What this looks like on a cyber policy
A cyber policy is usually two halves. First-party coverage pays your own costs: incident response, forensics, notification, business interruption, data restoration and, where included, extortion. Third-party coverage responds to claims against you by customers, partners or regulators. Each half has its own limits, sublimits, waiting periods and conditions. Our article on what cyber insurance covers goes through the parts by name.
Two conditions deserve attention before an incident rather than during one: the security controls the application said you had in place, because insurers can check, and the notice clause described above. The basic controls that reduce the odds of needing any of this are in cybersecurity best practices for business owners.
A checklist for the first 48 hours
- Disconnect affected systems from the network. Do not wipe them.
- Preserve logs, messages and screenshots.
- Call the insurer's incident line, then your broker.
- Follow the breach coach's instructions on vendors, notifications and communications.
- Do not pay, settle or announce anything without the insurer's consent.
- Keep the timeline current.
- Once the immediate response is under control, review the controls and the policy with your advisor.
Existing NRG clients can reach us through the Service Center; the policy's own incident line comes first.
Sources
[1] Cybersecurity and Infrastructure Security Agency, cybersecurity resources for small businesses (agency site). Accessed October 26, 2026.
[2] Washington State Office of the Attorney General, data breach notifications (agency site). Accessed October 26, 2026.
[3] Federal Trade Commission, Data Breach Response: A Guide for Business. Accessed October 26, 2026.
Coverage examples are illustrative. Policy wording, exclusions, limits, underwriting and applicable law determine coverage. This article is general information, not legal advice or a coverage determination.
Frequently asked questions
- Under most cyber policies that include extortion coverage, yes. The insurer's consent is typically a condition of reimbursement, and payments can be restricted by law depending on who the attacker is. Involve the insurer and its panel before responding to any demand.
- Policies describe this as "promptly" or "as soon as practicable", and some set a specific period. The safe reading is: as soon as you suspect an incident, even before you know its scope. Reporting a circumstance that turns out to be nothing costs little; late notice can cost the claim.
- Commonly, yes, within the policy's limits and conditions, and often only when the insurer's panel or an approved vendor does the work. That is the practical reason to make the insurer your first call rather than your last.