Avoiding coverage gaps in a cyber, crime and D&O programme

In short. The biggest practical problem in cyber, crime and D&O insurance is not the absence of individual policies but the mismatch between them. A coverage gap arises where a risk does not clearly fall under any policy, or where several policies assume that liability lies with another. Coverage gaps do not arise by chance but from deficiencies in the system, and they can be avoided with three elements: coordination of the policies, harmonisation of the definitions and an active role for the broker and the lawyer.¹

For underwriters and brokers, the coverage matrix and the renewal checklist below are the questions a well-advised Estonian insured will put at renewal.

1. Coordinating the insurance contracts

Coordination means that cyber, crime and D&O insurance are not bought separately but as a programme in which each policy fulfils a specific role. In practice, it must be analysed how the policies respond to the same event: which policy covers the technical costs of a cyber incident, which the monetary loss resulting from fraud and which the claims made against the board.

Example. A company falls victim to a social engineering fraud. If the cyber policy excludes such frauds and the crime policy lacks the corresponding extension, there is a coverage gap. If the policies are coordinated, it is known in advance which policy covers the risk and with what limit.

Coordination also includes an analysis of the exclusions:

• whether the war exclusion in the cyber policy has the same wording as the one in the crime policy;
• whether the D&O policy excludes claims arising from a cyber incident;
• whether the policies refer to each other or exclude risks on the assumption that they are covered elsewhere.

A situation must be avoided in which one policy excludes a risk because it falls "under the other policy" and the other policy excludes the same risk because it does not meet its definition. That is the classic case of falling between two stools.

A practical tool: the coverage matrix. Prepare a table whose rows are the company's critical scenarios and whose columns are the policies. In each cell, record whether the scenario is covered, with what limit, sub-limit and deductible, and which exclusions may apply. Empty cells and cells with a question mark are the agenda for the negotiations.

2. Harmonising the definitions

Definitions are the core of an insurance contract: they determine which event is an insured event. The following concepts in particular must be harmonised.

Example. An employee makes a payment on the basis of a misleading e-mail. If the cyber policy treats this as "human error" and excludes it, and the crime policy requires "direct theft", both policies may refuse to indemnify.

Harmonisation does not mean that all policies must be identical. It means that they must be logically consistent, so that the same event does not fall between the definitions.

From the perspective of Estonian law, it is worth remembering that, in case of doubt, a standard term is interpreted against the party that supplied it, usually the insurer (Law of Obligations Act (võlaõigusseadus, VÕS) § 39 lg 1), and that a surprising term may not become part of the contract (VÕS § 37 lg 3).² The Supreme Court has stressed that the statutory presumption is cover for the costs arising from the insured event and that limitations must be clear.³ These principles help in a dispute but do not replace clear wording: harmonising the definitions before a loss is always cheaper than a dispute afterwards.

3. The roles of the broker and the lawyer

The broker's role is to understand the company's risk profile, to offer the solutions available on the market, to compare insurers' terms and to help negotiate the scope of cover and the limits. The broker is obliged to act in the client's interest (Insurance Activities Act (kindlustustegevuse seadus, KindlTS) § 184).⁴

The lawyer's role is to analyse the wording of the policies from a legal perspective, to identify exclusions and grey areas, to assess how the policies will work in a dispute and to ensure that they match the company's actual risks.

Example 1. A company wants to cover the social engineering risk. The broker offers a policy that contains the extension, but with a sub-limit of EUR 25,000. The lawyer points out that the company's largest supplier payments are EUR 300,000 and that the sub-limit is inadequate given the risk profile. As a result of the negotiations, the sub-limit is raised and it is clarified that the call-back requirement is a duty of care, not a precondition of the insured event (so that a breach is assessed under VÕS § 452 lg 2).

Example 2. The broker offers a standard policy, but the lawyer finds that the war exclusion is so broad that it may also catch ordinary criminal cyber attacks whose perpetrator is associated with a state. A clarified wording is agreed which ties the exclusion to armed conflict between states or to a state's own cyber operation with a significant impact on the functioning of a state, and which determines how attribution is proved.

The broker and the lawyer must work together: the broker brings market practice, the lawyer legal clarity.

4. Documentation and the working process

Avoiding coverage gaps does not end with the conclusion of the contract. Documenting risk management and decisions is equally important, particularly in the D&O context, where the board's conduct is assessed with hindsight. The following must be documented:

• risk analyses and the risk map;
• the board's discussions and decisions on the insurance programme;
• the reasons for the solutions chosen (why the limit is what it is, why a certain risk was left uninsured);
• the broker's recommendations and how they were dealt with.

If a dispute arises later, the documentation shows that the board acted knowingly and with due care. To be released from liability, a board member must prove his or her own diligence (Commercial Code (äriseadustik, ÄS) § 187).⁵ A conscious and documented decision to leave a risk uninsured is defensible; a decision that nobody took is not.

5. A systemic approach

Avoiding coverage gaps requires insurance to be part of risk management:

1. risks are analysed before insurance is bought;
2. the policies are chosen according to specific risks;
3. the terms of the policies are coordinated with one another;
4. the solutions are updated regularly.

In a rapidly changing environment, where cyber and geopolitical risks evolve and conditions in the insurance market change (see Kindlustusturu suunad ja ettevõtte strateegilised valikud, in Estonian), last year's solution may already be inadequate.

6. Renewal checklist

Before each renewal, ask:

• Have the company's business model, markets, IT platforms or key suppliers changed?
• Is there social engineering cover, and does the sub-limit match the largest ordinary payment?
• Is the war exclusion uniform across all policies?
• Does the D&O policy exclude claims arising from a cyber incident?
• Is business interruption covered also in the case of an IT outage without physical damage?
• Is client property (money, data) covered?
• Do the policies contain exclusions that refer to each other, or other insurance clauses?
• Are the notification procedure and the contacts known for all policies and entered in the crisis plan?
• Do the representations made in the proposal correspond to reality?

7. A model coverage matrix

The matrix below is illustrative. The company completes it on the basis of its own policies.

The value of the table lies in the cells containing a question mark or a "gap". They are the agenda for the renewal negotiations.

Related pages

• Integrated insurance programmes
• Maakleri ja juristi vaade (the broker's and the lawyer's view, in Estonian)
• Insurance Readiness Audit (in Estonian)
• Näidis-kindlustusprogrammi struktuur (model programme structure, in Estonian)
• Reviewing policy wordings under Estonian law

References