How to File a Cyber Insurance Claim

Step One: First Notice of Loss

Most cyber policies require you to report an incident, called first notice of loss (FNOL), within a specific window after discovery, commonly 24 to 72 hours depending on the policy. Reporting quickly matters more than it might seem: see What Is First Notice of Loss? for why delays can jeopardize coverage.

Step Two: Your Team Gets Assigned

Once you report, the insurer assigns a claims adjuster along with a breach coach and, typically, a panel forensics firm. The breach coach takes the lead on scoping the forensics work, setting notification deadlines, controlling communications, and approving vendor costs.

Step Three: A Coverage Letter

Insurers commonly issue a preliminary or reservation-of-rights coverage letter early in the process. This is a standard part of how claims work, not necessarily a sign of a problem, and it outlines what the insurer currently understands about coverage while the investigation is still underway.

Step Four: Investigation and Notification

The investigation matures as forensics works, and your legal notification obligations get determined and executed, state by state if you operate in more than one. This stage can take time precisely because getting it right matters: rushing incomplete findings can create its own legal exposure.

Step Five: Proof of Loss

You submit a proof of loss with full documentation, invoices, time logs from vendors, and contracts, substantiating the costs you are claiming. This is where having an organized paper trail from day one pays off.

Step Six: Final Coverage Decision and Payment

The insurer issues a final coverage decision and processes payment for the covered costs. If part of your claim is denied or disputed, see Why Cyber Insurance Claims Get Delayed or Denied for the common reasons that happens and how to avoid them.

A Note on Timing

We looked for a published, methodologically sound figure for the average number of days a cyber claim takes from report to resolution and could not verify one from a primary source. Timelines vary significantly by incident complexity, so treat any specific day count you see elsewhere with some skepticism unless it cites a transparent source.