Cyber insurance

What cyber insurance is

Cyber insurance compensates the financial consequences of information security incidents: a hack, ransomware, a personal data leak, an attack that has stopped systems from working. There is no special law for this class: it is voluntary and governed by the Russian Civil Code (Chapter 48) and the policy wording of each insurer. Coverage therefore varies noticeably between companies, and the contract needs careful reading.

What a policy usually covers

The company's own costs and losses

• incident investigation — computer forensics experts;
• restoring data, software and system configurations;
• notifying clients and other data subjects, legal advice, crisis communications;
• business interruption losses: lost profit and fixed costs during downtime after an attack — usually after a waiting period of several hours;
• costs related to cyber extortion. Payment of the ransom itself is excluded in many policies or requires separate approval.

Liability to third parties

• claims from clients and partners over a leak of their data or transmission of malicious code;
• defence costs in court disputes and regulatory proceedings.

Optional extensions are common: social engineering fraud (fake "CEO" emails asking for a money transfer), telephone hacking losses, liability for website content. Sub-limits usually apply to them.

What is usually not covered

• administrative fines — most insurers exclude them or will not insure them;
• incidents the company knew about before the contract started;
• war and other broad exclusions listed in the policy wording;
• failures of external infrastructure — power grids, backbone communication links — unless expressly included;
• upgrading systems beyond restoring their previous state;
• consequences of failing to apply the security measures declared in the proposal form.

Who buys it and why

There is no compulsory cyber insurance in Russia, but the risks for business have grown with legal requirements. Since 30 May 2025, Article 13.11 of the Code of Administrative Offences (KoAP) imposes large fines on organisations for personal data leaks:

Under Law No. 152-FZ on personal data, the operator must notify Roskomnadzor (the communications and data protection regulator) of unlawful transfer of personal data within 24 hours, and of the results of its internal investigation within 72 hours. Critical information infrastructure entities also comply with Law No. 187-FZ. A policy usually does not reimburse the fines themselves, but it covers investigation, recovery and defence costs — everything that helps meet legal requirements quickly and limit the damage.

What drives the price

• the company's industry and revenue, and how dependent the business is on IT systems;
• the volume and type of data processed: personal, payment, medical;
• security maturity: multi-factor authentication, backups kept outside the main network, timely patching, attack detection tools, staff training;
• incident history;
• the limit of liability, sub-limits, deductible and the business interruption waiting period.

Before quoting, the insurer asks for an information security questionnaire and sometimes runs an external scan. The answers become part of the contract, so fill in the questionnaire together with your IT team.

Choosing a policy and an insurer

• Compare not only the overall limit but also sub-limits for business interruption, extortion and social engineering.
• Check whether the insurer has a 24/7 hotline and a panel of incident response contractors.
• Clarify the definition of an insured event: an "attack" only, or any "failure", including employee error.
• See how downtime losses are calculated and what documents are needed.

See the catalogue under Insurance companies. Polis Re specialists can help compare terms — submit a request.

Claims

1. If you suspect an incident, call the insurer's hotline immediately: it will bring in experts whose fees are covered by the policy.
2. Preserve event logs and system images; do not rebuild everything from scratch until agreed.
3. Do not negotiate with or pay extortionists without the insurer's consent.
4. Meet your duties to notify Roskomnadzor and data subjects within the legal deadlines.
5. Collect documents on costs and downtime losses.

Common mistakes

• Filling in the questionnaire "as it should be" rather than as it is: an investigation after an incident makes this grounds for refusal.
• Expecting the policy to pay a Roskomnadzor fine.
• Too small a downtime sub-limit for a business that earns its money online.
• Restoring systems yourself before the experts arrive — evidence gets destroyed.

Related classes: professional liability for IT companies and integrators, directors and officers liability (D&O), commercial property for servers and equipment.