Coverage Is Not Control: A Board Test for Cyber Insurance

The Comfort of a Certificate

A cyber insurance policy can arrive at the board table looking like assurance. It has limits, deductibles, endorsements, and a carrier’s name on the cover. It may even satisfy a customer questionnaire or a lender condition. But a certificate of coverage is not evidence that the company can detect an intrusion, contain it, communicate through it, or recover from it. For mid-market boards, the distinction matters because cyber incidents are no longer peripheral events handled by the information technology function. They are enterprise events that can interrupt revenue, trigger regulatory scrutiny, invite litigation, and test the credibility of management.

The board’s obligation is not to buy insurance and move on. It is to test whether the policy reflects the company’s actual risk appetite, whether the operating environment can support a successful claim, and whether the coverage contributes to—rather than substitutes for—operational resilience. That is a governance question before it is a procurement question.

Where the Paper and the Practice Diverge

Cyber policies are not uniform, and the differences are rarely captured in a one-page summary. Boards should ask management and the broker to explain the architecture of the program in plain business terms. Common areas of divergence include:

• Silent exclusions and endorsed limitations. A policy may appear broad while endorsements narrow coverage for specific causes, systems, or third parties. State-backed attacks, infrastructure failures, and widespread events are frequent areas of restriction.
• Sublimits and waiting periods. Notification costs, forensic investigation, business interruption, and ransomware response may each carry separate limits or time deductibles. A headline limit can overstate the protection available for the losses the company is most likely to face.
• Dependent business interruption. Mid-market companies often depend on a small number of vendors, processors, or cloud providers. Coverage for contingent losses may be limited, conditioned, or absent.
• Social engineering and funds transfer fraud. These events can sit between crime and cyber coverage. The board should know which policy responds, what controls are required, and whether the limit is adequate relative to treasury exposure.
• Regulatory and legal costs. Defense costs, regulatory inquiries, and consumer notification obligations may be treated differently across policies. The board should understand which costs erode the limit and which sit outside it.
• Consent and panel requirements. Insurers frequently require pre-approval of breach counsel, forensic vendors, or communication firms. A response plan that ignores those requirements can create avoidable coverage disputes.

These are not technicalities reserved for the risk manager. They determine whether the insurance program supports the company’s stated tolerance for disruption, or merely creates an appearance of transfer.

The Claims Test Comes Before the Claim

A cyber claim is an operational exercise conducted under pressure. The company must notify the carrier promptly, preserve evidence, engage approved vendors, document decisions, and substantiate losses—often while systems are degraded and executives are managing customers, employees, and regulators. Boards should ask whether the company has rehearsed that sequence.

Useful questions include: Who has authority to notify the carrier? Has the company tested the notification channel outside normal business hours? Are panel vendors pre-identified and contracted? Does the incident-response plan account for privilege and evidence preservation? Can finance produce a credible business interruption calculation, including lost revenue, extra expense, and restoration costs? Has the company documented the controls that the policy requires, such as multifactor authentication, backups, or segmentation?

A policy that has never been tested against the incident-response plan is a hypothesis. The board should treat it as such.

A Board-Ready Framework

A practical board test can be organized around five questions. First, risk appetite: Does the policy’s structure reflect the disruptions the company has decided it can absorb, and the losses it intends to transfer? Second, control alignment: Are the policy’s conditions consistent with the company’s actual security and recovery capabilities, or do they assume controls that are not in place? Third, scenario fit: Has management mapped a plausible incident—ransomware, vendor outage, funds transfer fraud, data exfiltration—through the policy to identify gaps, sublimits, and uninsured costs? Fourth, claims readiness: Has the company rehearsed notification, vendor engagement, evidence preservation, and loss documentation with the broker and carrier requirements in view? Fifth, value protection: Does the program protect the assets and relationships that drive enterprise value, including customer confidence, contractual commitments, and recovery time, rather than only the cost of forensic investigation?

The board does not need to adjudicate policy language. It does need to require a clear narrative: here is the risk we retain, here is the risk we transfer, here is how we respond, and here is how we know the transfer will perform.

Governance With a Calendar

Cyber insurance should have a governance cadence. The board should review the program at least annually and whenever the business changes materially—an acquisition, a new cloud dependency, a shift in payment processes, or a significant customer contract with security obligations. Management should report on claims readiness, not just premium and limit. The audit or risk committee can oversee the testing, while the full board retains visibility into the enterprise-level trade-offs.

In 2026, the question is no longer whether a mid-market company needs cyber insurance. The better question is whether the board can distinguish a policy that supports resilience from one that merely documents an intention to buy it. Coverage is not control. The board’s task is to make sure the company has both—and knows the difference.