Cyber Insurance for Indian Businesses: Readiness First, Then Read the Wording
For a small or mid-sized business, a cyber incident can interrupt operations, expose data and consume management time. Cyber insurance may help with specified costs or liabilities, but it is not a substitute for secure systems, tested backups, incident response or regulatory reporting. The practical question is whether the business can identify an event, contain it, preserve evidence and follow its actual policy conditions.
Incident volume is a reason to prepare, not a prediction of loss
CERT-In, India’s national agency for responding to cyber-security incidents, reported the following total incidents observed nationally. These figures are not a measure of insured claims, a loss forecast, or an indication that any particular business will suffer an incident. They show why prevention and response arrangements deserve board-level attention. See the Government of India’s CERT-In series.
| Year | CERT-In cyber-security incidents | Reading the series |
|---|---|---|
| 2021 | 14,02,809 | Baseline in this five-year series. |
| 2022 | 13,91,457 | Slightly below 2021. |
| 2023 | 15,92,917 | Above the prior two years. |
| 2024 | 20,41,360 | Higher reported total than 2023. |
| 2025 | 29,44,248 | Highest total in the displayed period. |
The chart’s x-axis is calendar year; its y-axis is total incidents reported to and tracked by CERT-In, in millions. The inference is limited: the series rose from 14,02,809 in 2021 to 29,44,248 in 2025. It supports a readiness conversation; it does not establish a business’s cyber-insurance need, premium, cover limit or claim outcome.
What a cyber policy may address—and why the schedule matters
Cyber policies are not standardised promises. Depending on the specific wording, schedule and endorsements, a policy may address defined first-party costs, third-party liabilities, incident-response expenses, business interruption, digital-asset restoration, extortion-related expenses or regulatory-defence costs. Each of those labels can have limits, sub-limits, deductibles, exclusions, waiting periods, territorial terms, panel-vendor requirements and notification conditions.
Before comparing a proposal, ask for the complete policy wording and schedule. Record what systems, data, subsidiaries, outsourced service providers and business processes are in scope. Ask a licensed insurance intermediary or insurer to explain material exclusions and claims-notification requirements in writing. Do not rely on a brochure, a policy name or another company’s cover as a substitute for the contract.
Six-hour reporting is a response issue, not a claim shortcut
CERT-In’s 2022 Directions require service providers, intermediaries, data centres, body corporates and government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice. Read the Directions and CERT-In’s reporting FAQ. The FAQ says an entity may provide the information available at the time and follow with additional information within a reasonable time.
That requirement should be reviewed with legal and technical advisers for the organisation’s facts. It does not tell a business what an insurer will pay, and it should not cause teams to destroy evidence, restart systems prematurely or delay containment. A written incident plan should identify the decision owner, technical lead, legal contact, insurer/broker contact and approved external responders.
A five-stage readiness workflow
The numbered image is a qualitative workflow, not a data chart: it has no axes and it does not rank products or predict claims. Its inference is that recovery is easier to coordinate when responsibilities are agreed before an incident.
- Safeguard: maintain access controls, patching, backups and staff awareness appropriate to the business.
- Identify and contain: log the alert, isolate affected systems under technical guidance and avoid uncontrolled changes.
- Preserve and escalate: keep records, retain relevant evidence and engage qualified technical, legal and insurance contacts.
- Notify appropriately: assess CERT-In, contractual, customer, regulator and policy notification duties with advisers; do not assume one notification satisfies all duties.
- Restore and learn: restore from known-good sources, document decisions and turn lessons into control improvements.
CERT-In’s 2024 ransomware report is useful background for incident planning. For practical baseline controls, its 15 Elemental Cyber Defense Controls for MSMEs can help a business begin a proportionate controls discussion.
Renewal questions that improve the conversation
- Which revenue-critical systems, suppliers and data flows would make an interruption material?
- Who can authorise containment, engage an incident-response vendor and notify the insurer outside business hours?
- Are backups tested for restoration, not merely created?
- Does the proposal accurately describe the business’s controls, prior incidents and material changes?
- Where does the wording require prompt notice, consent before costs, or use of named providers?
- How will the business record decisions, expenses and evidence if a claim is later considered?
Cyber insurance can be one layer in a wider resilience programme. It cannot make a weak control environment safe, waive statutory duties or guarantee a claim payment. For a policy decision or active incident, use the actual contract and obtain appropriate technical, legal and insurance advice.
Source links
- PIB: CERT-In incident series, 2021–2025 — total incidents reported to and tracked by CERT-In.
- CERT-In Directions under section 70B — listed-incident reporting and timing context.
- CERT-In FAQ on the 2022 Directions — information available at the time of the initial report and follow-up context.
- CERT-In India Ransomware Report 2024 — incident-planning context.
- CERT-In 15 Elemental Cyber Defense Controls for MSMEs — practical control baseline.
- IRDAI Information and Cybersecurity Guidelines, 2026 — regulator context for insurance-sector cybersecurity; not a coverage statement for business policyholders.
Disclaimer
This article is general business and insurance education, not legal, technical, insurance, tax or investment advice and not a recommendation to buy a policy. Cover, eligibility, pricing, limits, exclusions, claims handling and outcomes depend on the policy wording, schedule, endorsements, facts, underwriting and applicable law. Reviewed by Abhipra Research / Compliance Team.
