Business Interruption Claims After a Cyber Incident

What Business Interruption Coverage Actually Pays For

If a cyber incident takes your systems down, business interruption coverage is meant to replace the income you lose while you are not able to operate normally, plus continuing expenses you still have to pay during that downtime (like rent and payroll) even though revenue has stopped.

The “Period of Restoration”

Coverage runs for what policies call the period of restoration: from when the interruption begins until operations are restored to substantially where they were before the incident. According to Indiana’s state cyber insurance toolkit glossary, this period is often capped, commonly around 30 days, though some policies extend to 3, 6, or even 12 months depending on the terms.

How Loss Gets Calculated

Insurers typically calculate the loss as net profit lost plus continuing expenses during the interruption, benchmarked against what your revenue and expenses looked like over the same period in a prior year, adjusted for any trend, seasonality, or growth you can document. This is why clean financial records matter: the stronger your documentation of normal performance, the easier it is to substantiate what you actually lost.

What Happens After Systems Come Back Up

Many policies also include an extended period of indemnity, commonly 30 to 180 days, that continues covering lost income after systems are technically restored. The logic is straightforward: a business rarely snaps back to full revenue the instant systems come online, so this extension covers the ramp-up period.

Why This Is a Separate Claim From Your Breach Response Costs

Business interruption loss is typically handled as its own claim category, distinct from the forensics, legal, and notification costs of the breach itself. Both can apply to the same incident, so make sure your proof of loss accounts for both categories rather than only the direct response costs.