{
  "id": "cov-cyber",
  "type": "coverage",
  "languages": {
    "en": {
      "id": "cov-cyber",
      "lang": "en",
      "type": "coverage",
      "title": "Cyber Insurance",
      "shortDefinition": "Cyber insurance covers first-party and third-party losses from information security breaches – such as business interruption after ransomware, data restoration, liability and crisis services.",
      "synonyms": [
        "Cyber risk insurance"
      ],
      "linesOfBusiness": [
        "Cyber"
      ],
      "jurisdictions": [
        "CH",
        "EU",
        "Global"
      ],
      "tags": [
        "Cyber",
        "Commercial Lines"
      ],
      "relations": {
        "relatedTerms": [
          "cov-business-interruption",
          "term-exposure",
          "clause-sanctions",
          "clause-contingent-bi-cyber",
          "clause-cyber-systemic-risk-exclusion",
          "clause-cyber-war-exclusion-lma5567",
          "clause-several-liability-lma3333",
          "clause-social-engineering",
          "clause-wartezeit-cyber-bu"
        ],
        "partOf": [],
        "appliesTo": [],
        "regulatedBy": [],
        "relevantFor": [],
        "insurableVia": [],
        "mitigatedBy": [],
        "comprises": [],
        "alternativeTo": [],
        "complementedBy": [
          "cov-business-interruption",
          "cov-property-all-risks"
        ]
      },
      "attribute": null,
      "profile": null,
      "coverageProfile": {
        "trigger": "claims-made",
        "insuredInterest": "The policyholder's own financial loss and third-party liability exposure arising from information security breaches and network security incidents, irrespective of whether physical property is damaged.",
        "insuredEvents": [
          "Ransomware and other malware attacks",
          "Data breaches involving personal or confidential information",
          "Denial-of-service and network security incidents",
          "Cyber extortion and ransom demands",
          "Human error or system failure causing a security breach"
        ],
        "keyExclusions": [
          "War and state-attributed attacks",
          "Losses from failure to maintain agreed minimum security controls",
          "Bodily injury and property damage (ceded to property/liability lines, subject to silent-cyber demarcation)",
          "Fines and penalties that are uninsurable by law",
          "Pre-existing, known vulnerabilities not remediated"
        ],
        "ratingBasis": [
          "Revenue and data volume/sensitivity",
          "Industry sector and regulatory exposure",
          "Security controls in place (MFA, backups, endpoint detection, patch management)",
          "Prior claims/incident history"
        ],
        "typicalLimits": "Limits are typically purchased in layers from a few million up to several hundred million CHF/EUR for large corporates, often shared across first-party and third-party sections with sublimits for cyber extortion and crisis services.",
        "typicalDeductibles": "Per-claim or per-event deductible/retention, often combined with a waiting period deductible for the business interruption element.",
        "mandatory": [],
        "targetSegments": [
          "SME",
          "Industry",
          "Multinational"
        ]
      },
      "clause": null,
      "legalBasis": [],
      "standards": [],
      "reviewStatus": "expert-reviewed",
      "reviewedBy": "Guido Hesse, Hesse Group Holding AG",
      "lastReviewed": "2026-09-04",
      "version": "0.3.0",
      "updated": "2026-09-03",
      "generated": {
        "by": "process:reconstructed",
        "at": "2026-09-03T00:00:00.000Z"
      },
      "verified": [
        {
          "by": "human:ghesse",
          "at": "2026-09-04T00:00:00.000Z",
          "method": null
        }
      ],
      "staleAfter": null,
      "url": "https://hgh.ch/lexikon/en/knowledge/coverage/cyber-insurance/",
      "alternateUrl": "https://hgh.ch/lexikon/de/wissen/deckung/cyberversicherung/",
      "body": "## Coverage components\n\nFirst party: cyber business interruption, data restoration, cyber extortion (including negotiation services), crisis management and forensics. Third party: liability for data protection breaches and network security incidents, defence costs and regulatory proceedings where insurable.\n\n## Underwriting requirements\n\nInsurers require minimum standards such as multi-factor authentication, tested offline backups, endpoint detection, patch management and incident response plans. Missing controls lead to exclusions, sublimits or declinature.\n\n## Market development\n\nWar and state-attributed attacks are increasingly excluded with precise wordings; ransom payments are subject to sanctions reservations. The demarcation from property and kidnap-and-ransom policies (silent cyber) should be expressly regulated within the programme.\n\n## Comparison and delineation\n\nCyber insurance is regularly complemented by property all risks, which insures physical damage but expressly excludes cyber losses without a resulting physical damage event, and by business interruption cover, which as a stand-alone product responds only after an insured property damage event, not after a purely digital outage. The programme boundary between the two is exactly this physical-damage trigger: cyber policies fill the gap that property and business interruption wordings leave for outages, data loss, and extortion that never touch physical assets."
    },
    "de": {
      "id": "cov-cyber",
      "lang": "de",
      "type": "coverage",
      "title": "Cyberversicherung",
      "shortDefinition": "Die Cyberversicherung deckt Eigen- und Drittschäden aus Informationssicherheitsverletzungen – etwa Betriebsunterbrechung nach Ransomware, Datenwiederherstellung, Haftpflicht und Krisendienstleistungen.",
      "synonyms": [
        "Cyber Insurance"
      ],
      "linesOfBusiness": [
        "Cyber"
      ],
      "jurisdictions": [
        "CH",
        "EU",
        "Global"
      ],
      "tags": [
        "Cyber",
        "Unternehmensversicherung"
      ],
      "relations": {
        "relatedTerms": [
          "cov-business-interruption",
          "term-exposure",
          "clause-sanctions",
          "clause-contingent-bi-cyber",
          "clause-cyber-systemic-risk-exclusion",
          "clause-cyber-war-exclusion-lma5567",
          "clause-several-liability-lma3333",
          "clause-social-engineering",
          "clause-wartezeit-cyber-bu"
        ],
        "partOf": [],
        "appliesTo": [],
        "regulatedBy": [],
        "relevantFor": [],
        "insurableVia": [],
        "mitigatedBy": [],
        "comprises": [],
        "alternativeTo": [],
        "complementedBy": [
          "cov-business-interruption",
          "cov-property-all-risks"
        ]
      },
      "attribute": null,
      "profile": null,
      "coverageProfile": {
        "trigger": "claims-made",
        "insuredInterest": "Das Eigenschadeninteresse und die Haftpflichtexposition des Versicherungsnehmers aus Informationssicherheitsverletzungen und Netzwerksicherheitsvorfällen, unabhängig davon, ob eine Sachbeschädigung eintritt.",
        "insuredEvents": [
          "Ransomware- und andere Malware-Angriffe",
          "Datenschutzverletzungen mit Personen- oder vertraulichen Daten",
          "Denial-of-Service- und Netzwerksicherheitsvorfälle",
          "Cyber-Erpressung und Lösegeldforderungen",
          "Menschliches Versagen oder Systemausfall als Ursache einer Sicherheitsverletzung"
        ],
        "keyExclusions": [
          "Krieg und staatlich attribuierte Angriffe",
          "Schäden aus Nichteinhaltung vereinbarter Mindestsicherheitsstandards",
          "Personen- und Sachschäden (Zuordnung zu Sach-/Haftpflichtdeckungen, vorbehaltlich Silent-Cyber-Abgrenzung)",
          "Gesetzlich nicht versicherbare Bussen und Strafzahlungen",
          "Bekannte, nicht behobene Vorschwachstellen"
        ],
        "ratingBasis": [
          "Umsatz und Datenvolumen bzw. -sensitivität",
          "Branche und regulatorische Exposition",
          "Vorhandene Sicherheitskontrollen (MFA, Backups, Endpoint Detection, Patch-Management)",
          "Bisherige Schaden- bzw. Vorfallhistorie"
        ],
        "typicalLimits": "Die Limiten werden für Grossunternehmen meist geschichtet von wenigen Millionen bis zu mehreren hundert Millionen CHF/EUR eingekauft, häufig gemeinsam für Eigen- und Drittschadenteile mit Sublimiten für Cyber-Erpressung und Krisendienstleistungen.",
        "typicalDeductibles": "Selbstbehalt je Schadenfall bzw. Ereignis, häufig kombiniert mit einer Wartezeit-Selbstbeteiligung für den Betriebsunterbrechungsbaustein.",
        "mandatory": [],
        "targetSegments": [
          "KMU",
          "Industrie",
          "Multinationale Unternehmen"
        ]
      },
      "clause": null,
      "legalBasis": [],
      "standards": [],
      "reviewStatus": "expert-reviewed",
      "reviewedBy": "Guido Hesse, Hesse Group Holding AG",
      "lastReviewed": "2026-09-04",
      "version": "0.3.0",
      "updated": "2026-09-03",
      "generated": {
        "by": "process:reconstructed",
        "at": "2026-09-03T00:00:00.000Z"
      },
      "verified": [
        {
          "by": "human:ghesse",
          "at": "2026-09-04T00:00:00.000Z",
          "method": null
        }
      ],
      "staleAfter": null,
      "url": "https://hgh.ch/lexikon/de/wissen/deckung/cyberversicherung/",
      "alternateUrl": "https://hgh.ch/lexikon/en/knowledge/coverage/cyber-insurance/",
      "body": "## Deckungsbausteine\n\nEigenschäden: Cyber-Betriebsunterbrechung, Datenwiederherstellung, Cyber-Erpressung (inklusive Verhandlungsdienstleistungen), Krisenmanagement und Forensik. Drittschäden: Haftpflicht für Datenschutzverletzungen und Netzwerksicherheitsvorfälle, Verteidigungskosten und behördliche Verfahren, soweit versicherbar.\n\n## Underwriting-Anforderungen\n\nVersicherer verlangen Mindeststandards wie Multi-Faktor-Authentisierung, getestete Offline-Backups, Endpoint Detection, Patch-Management und Notfallpläne. Fehlende Kontrollen führen zu Ausschlüssen, Sublimiten oder Ablehnung.\n\n## Marktentwicklung\n\nKriegs- und staatlich attribuierte Angriffe werden zunehmend präzise ausgeschlossen; Ransomware-Zahlungen unterliegen Sanktionsvorbehalten. Die Abgrenzung zu Sach- und Kidnap-Ransom-Policen (Silent Cyber) sollte im Programm ausdrücklich geregelt sein.\n\n## Vergleich und Abgrenzung\n\nDie Cyberversicherung wird regelmässig durch die Sach-Allgefahrenversicherung ergänzt, die Sachschäden deckt, Cyber-Schäden ohne Sachfolgeschaden aber ausdrücklich ausschliesst, sowie durch die eigenständige Betriebsunterbrechungsversicherung, die nur nach einem versicherten Sachschadenereignis leistet, nicht aber nach einem rein digitalen Ausfall. Die Programmgrenze zwischen beiden ist genau dieser Sachschaden-Auslöser: Die Cyberdeckung schliesst die Lücke, die Sach- und Betriebsunterbrechungsbedingungen für Ausfälle, Datenverlust und Erpressung ohne Sachbezug offenlassen."
    }
  }
}