The short answer
Check specialist assessment, restoration, business interruption, liability to third parties and crisis management separately. The policy sets the conditions, excesses, waiting periods, sub-limits and approved service providers. In an incident, contact the response team and insurer promptly; notifying the insurer does not replace the regulatory reporting requirements that need to be examined.
1. Link each cost item to a clause
Prepare a list of possible costs with the people who know the business: specialist response, restoration, continuity, third-party claims and crisis communications. For each item, locate the clause, limit and conditions that trigger cover. A cyber product's marketing name does not demonstrate that all these costs are covered.
Mobilière's presentation is a product example, not a standard or a recommendation. Do not apply its conditions to your policy. The question of a ransom requires a separate examination of the contract and applicable framework; it must never be promised as automatically covered.
2. Prepare contacts before an incident
Identify the IT provider, internal lead, insurer's assistance service and decision-maker authorised to commit expenditure. Check whether approved providers or prior agreement are required. Keep these contact details available through arrangements that do not depend solely on the affected system.
Examine the excess, waiting period and sub-limits for each relevant cover. Compare them with your continuity options: which operations can be maintained and who decides whether to operate at reduced capacity? Obtain confirmation on outstanding contractual questions without confusing this work with a technical security audit.
3. Organise the response and preserve evidence
During an incident, mobilise response specialists and the insurer promptly in accordance with the planned procedure. The company appoints a contact to coordinate information, decisions and costs. Technical operations and evidence preservation are carried out with the specialists, without improvising risky interventions.
Keep a timeline of known facts, decisions and expenditure. Distinguish assumptions from confirmed findings. Ask how to obtain agreement for interventions and retain the supporting documentation. These arrangements assist the insurance assessment without delaying decisions needed to protect people and business operations.
4. Distinguish insurance from notifications
Reporting to the National Cyber Security Centre (NCSC) concerns, in particular, critical infrastructure subject to the applicable obligation. Notification to the Federal Data Protection and Information Commissioner (FDPIC) is governed by the conditions of Article 24 of the Federal Act on Data Protection (FADP), particularly the high risk associated with a personal data security breach. No twenty-four-hour obligation should be presented as universally applicable to all SMEs.
Have these obligations examined promptly with the relevant people responsible, along with any other obligations that may apply to the company. Notifying the insurer is a separate procedure. Record who assesses, who submits and which information is confirmed; also coordinate communication commitments towards clients and partners.
Frequently asked questions
Are restoration and business interruption covered under the same section?
Not necessarily. Check each item, its conditions and its limits in the policy. Technical intervention alone does not demonstrate business interruption cover.
Is notifying the insurer sufficient for the authorities?
No. Procedures involving the NCSC or FDPIC have their own conditions. Have the applicable obligations examined separately from the insurance notification.
Can any service provider be engaged immediately?
Mobilise the necessary response while promptly checking the policy procedure and the agreements or providers accepted. Coordinate with the insurer and retain decisions and supporting documents.