Cyber, crime and D&O risk and claims handbook (Estonia)

A company's risks are no longer separate boxes that can be insured one by one and then forgotten. A single e-mail account takeover can, within the same week, mean a system outage, a payment to the wrong account, a leak of customer data, supervisory proceedings and, in the end, a claim against the members of the management board. In such a situation nobody asks whether the company had "insurance". The questions are whether its insurance contracts were consistent with one another, whether notifications were made on time and whether the loss can be proved.

This section is based on my manuscript "Ettevõtte juhtkonna riskiraamat" (a risk handbook for company management), which deals with the interplay of cyber, crime and D&O insurance.¹ For the web, the text has been rewritten, checked again against Estonian law (the consolidated texts in Riigi Teataja as of November 2026) and supplemented with Supreme Court case law. The lines of insurance themselves are covered in depth on separate pages: D&O claims, cyber claims, crime and fidelity claims and war exclusions. This section looks at them from the perspective of company management: how risks are mapped, how an insurance programme is built and how it is made to work in a crisis.

Who the English handbook is for

The English chapters are written for foreign insurers, reinsurers, MGAs, brokers and claims handlers who underwrite or handle cyber, crime and D&O business with Estonian and Baltic insureds. The Estonian original speaks to the insured's management. Read from the insurer's side, it shows what a well-advised Estonian policyholder will do after a loss, which arguments Estonian law gives it and where coverage disputes usually arise. Eleven chapters and the case collection are available in English; the remaining chapters are linked to the Estonian original.

Whom the original handbook addresses

• Members of the management and supervisory boards, whose diligence is assessed with hindsight after a crisis and who are personally liable (Commercial Code (äriseadustik, ÄS) § 187, § 315, § 327).² In an entity within the scope of the Cybersecurity Act (küberturvalisuse seadus, KüTS), the management board must in addition designate a board member who approves the security measures, oversees their implementation and is responsible for them; if no member is designated, these duties apply to all board members (KüTS § 6¹).³
• The chief financial officer, because payment processes are today the main attack vector.
• In-house counsel and risk managers, who need to know how the definitions in an insurance contract ("direct loss", "fraud", "computer system", "insured person") affect the outcome of a dispute.
• The insurance broker, whose task is to act in the client's best interest, to identify the client's demands and needs and to find suitable cover (Insurance Activities Act (kindlustustegevuse seadus, KindlTS) § 184, § 192 lg 2 p 1).⁴

Structure of the handbook

I. Risk landscape and insurance needs

• The modern risk landscape: why traditional property and liability insurance is no longer enough and how cyber, crime and D&O risks shade into one another.
• Mapping insurance needs, in Estonian: Kindlustusvajaduse kaardistamine, with three subpages (the entrepreneur's view, risk mapping in practice, the broker's and the lawyer's view).

II. Structure of the insurance programme

• Integrated insurance programmes: limits, sub-limits, primary and excess layers, overlaps.
• Cyber, crime and D&O insurance: interplay and boundaries: which policy covers what and where the grey areas arise.
• Practice-based scenarios, in Estonian: Riskistsenaariumid (ransomware combined with fraud, a supply-chain attack, a data breach followed by an investor claim).
• Avoiding coverage gaps: coordinating the policies, definitions, the roles of the broker and the lawyer.
• Model programme structure, in Estonian: Näidis-kindlustusprogrammi struktuur.

III. Incident, claim and dispute

• Incident and crisis management (Estonian overview: Intsident ja kriisijuhtimine): the first 24 to 72 hours, evidence and forensics, crisis communications and notification and claims strategy across several policies.
• Insurance claims and disputes (Estonian overview: Kindlustusnõuded ja vaidlused): presenting the claim, typical coverage disputes and international aspects.

IV. Tools (in Estonian)

• Riskide enesehindamine: cyber, crime and D&O self-assessment questionnaires.
• Insurance Readiness Audit: a model for a six- to eight-page audit.
• Kriisisimulatsioonid: a cyber attack, invoice fraud, a D&O crisis and an integrated exercise.
• Kontrollküsimused juhtkonnale ja näidis-riskikaart: control questions for management and a model risk map.
• Kindlustusturu suunad ja ettevõtte strateegilised valikud: insurance market trends and the company's strategic choices.

V. Cases

• Case collection: international court cases and loss examples published by insurers on cyber, crime and D&O insurance, and publicly known incidents in the Baltic states.

Three principles that run through the handbook

First: from risk to contract, not the other way round. An insurance programme must be built on a mapping of the company's business model, cash flows, systems and liabilities. Buying policies without that analysis produces fragmented protection whose holes appear in a crisis.

Second: definitions decide. An insurance contract does not cover "events" in general but the agreed insured event, whose boundaries are set by definitions, exclusions, sub-limits and deductibles. Under Estonian law a standard term is interpreted, in case of doubt, against its user (Law of Obligations Act (võlaõigusseadus, VÕS) § 39), and hidden or unclear limitations may not bind the policyholder.⁵ This protection does not, however, replace reading the contract before a loss.

Third: insurance is an active tool. Cover must be activated in a crisis: notify on time, mitigate the loss, preserve evidence and qualify the claim correctly. The law requires the insured event to be notified without delay and, in liability insurance, a claim to be notified within one week (VÕS § 448, § 514).⁶

What this handbook is not

The handbook does not replace the analysis of a specific insurance contract. Policy conditions differ considerably between insurers and from year to year, and for large risks the parties may depart from the provisions of the Act that protect the policyholder (VÕS § 427 lg 3; see large risks).⁷ If a loss has already occurred, start with the Estonian guide to the first 72 hours or, in English, with the first 24 to 72 hours, and get in touch where needed.

Related pages

• Kindlustusprogramm ettevõttele ja eraisikule (insurance programmes, in Estonian)
• Esimesed 72 tundi pärast kahju (the first 72 hours after a loss, in Estonian)
• Insurance litigation and arbitration in Estonia
• Reservation of rights and declination letters under Estonian law
• Lines of insurance in Estonia
• Glossary of Estonian insurance law terms

References