Cyber Insurance Policy Conditions in an NCA ECC Incident

When a reportable incident occurs, two sets of obligations start at once. The regulator expects incident handling under the NCA ECC, and the insurer expects the policy conditions to be met. Understanding cyber insurance policy conditions incident NCA ECC obligations together, before an event, is what keeps a claim intact. This article sets out a practical sequence for the first 24 hours.

Policy wordings differ, so read yours against this outline. The three conditions below are the ones most commonly written as preconditions to cover: timely notification, use of the insurer's panel firms, and records of cost.

Why the two clocks collide

The NCA ECC sets expectations for incident management, including reporting to the national authority. The policy sets its own notification window, often expressed in hours, and ties cover to compliance with it. Neither clock pauses for the other, and the same few people are usually responsible for both.

The risk is rarely a refusal to cooperate. It is a missed step: a late insurer notice, a forensic firm appointed without approval, or costs that cannot be separated from routine spending. Each of these gives an insurer grounds to dispute part of a claim.

Condition one: notify the insurer and broker within the window

Check the notification clause before an incident, not during one. Note whether it runs from the occurrence, from discovery, or from the point you reasonably suspect a breach. Note also whether notice must go to the insurer, the broker, or both, and in what form.

A sensible sequence is:

1. Declare the incident internally and start a timestamped log. Record who discovered it, when, and on what evidence.
2. Send a short, factual notice to the insurer and broker. State what is known, what is not yet known, and that investigation is under way. Do not wait for a complete picture.
3. Complete the regulator reporting your obligations require through the NCA channel, using the same facts and wording.
4. Send the insurer a follow-up when the regulator submission is made, so both records align.

Insurer notification does not need to wait for the NCA upload. A holding notice is brief and can be sent within the first hour or two. The regulator submission needs more detail and usually follows. Sending the insurer notice first protects the policy condition without delaying the regulatory one, and consistent wording across both avoids later disputes over what you knew and when.

Keep a notification record: the time, the recipient, the channel, the content sent and any acknowledgement received. Adjusters ask for it.

Condition two: engage panel firms without delaying containment

Most policies require that forensic, legal and communications support come from an approved panel, or that any other firm be approved in advance. Containment cannot wait for that approval, so separate the two activities.

• Containment is your own responsibility and starts immediately: isolate affected systems, revoke compromised credentials, preserve logs and images. These are normal first-response actions and do not depend on the panel.
• Investigation and specialist support should be engaged through the panel, with the insurer's approval where the policy requires it.

In practice, ask the insurer or broker for the panel contact at the time of notice, and request written approval of the engagement and its scope. If you must act before approval arrives, document what was done, why it could not wait, and who authorised it. Preserve evidence before anything is rebuilt, since both the panel firm and the regulator will need it.

Panel firms and your internal team should agree early on one evidence-handling process, including chain of custody for images and logs. That single process serves the insurer, the regulator and any later legal proceedings.

Condition three: record costs from the first hour

Claims are paid on documented loss. Costs incurred in the first 24 hours are often the hardest to reconstruct afterwards, because people are working on the incident rather than recording it.

Open a separate cost code or ledger for the incident on day one. Adjusters generally look for records that show:

• the date, time and description of each cost
• who incurred it and who authorised it
• whether it relates to response, investigation, legal support, notification, restoration or business interruption
• the supporting invoice, timesheet or purchase record
• whether the cost is additional to normal operating expense

For internal staff time, record hours by person and task rather than estimating later. For business interruption, record the start of the outage, the systems affected and the baseline you will use to measure loss. Keep these records distinct from the incident log, but cross-reference them by timestamp.

Aligning the later incident report with the claim

After the first 24 hours, the regulator report and the claim file draw on the same facts. Build both from one master timeline so the chronology, scope and root cause match. Differences between the two are a common reason for adjuster follow-up questions.

When you prepare the formal incident report for the regulator, check it against the insurer record for dates, affected systems, data categories and impact. If the facts change, update both. Where personal data is involved, consider the PDPL notification position at the same time, since it may bring its own timing and content requirements.

A short checklist for the first 24 hours

1. Start the incident log and the cost ledger.
2. Send the holding notice to the insurer and broker.
3. Begin containment and preserve evidence.
4. Obtain panel contact details and written approval of scope.
5. Submit the regulator report with wording consistent with the insurer notice.
6. Send the insurer an update and confirm receipt.
7. Review the cost record at the end of the first day.

How we support this

Our Cyber Claims and Incident Support service exists to help you meet the policy conditions: timely notification, panel firms, cost records and the evidence the insurer needs to pay. We work through four steps: notify the insurer and broker within the policy window, coordinate panel firms and approvals, record costs, losses and evidence, and prepare the claim file with adjuster follow-up.

The deliverables are a notification record, a claim file with evidence, and a loss quantification. Our involvement is typically measured in hours as needed, and the service covers SAMA CSF, NCA ECC and PDPL contexts.

We do not replace the insurer's panel firm. We coordinate with the panel and protect your interests alongside them. If an incident has already happened, we can still help, although earlier involvement protects the claim best. The most useful step now is to read your notification clause and panel requirements against this sequence, and agree who does what before you need it.