What it does
CP 10 75 adds a "Cyber Incident" exclusion to the commercial property coverage part or Standard Property Policy. It removes loss caused directly or indirectly by any of the following, regardless of other contributing causes:
- Unauthorized access to or use of any computer system, including electronic data.
- Malicious code, viruses or other harmful code introduced into a computer system and designed to access, alter, corrupt, delete, encrypt, disrupt or restrict use of it.
- Denial-of-service attacks.
Exceptions
- If a cyber incident results in fire or explosion, the fire or explosion damage is covered.
- The exclusion does not reduce the limited Additional Coverages for Electronic Data in CP 00 10 or Interruption of Computer Operations in CP 00 30. It also does not apply to the Electronic Commerce (E-Commerce) endorsement when attached.
- Vandalism is amended so that it does not include a cyber incident.
Who sees it
It appears on property policies from several carriers, including policies filed in recent court cases. Other ISO forms reference it as well. The 12 20 Spoilage Coverage endorsement, for example, carries over "the Cyber Incident Exclusion" to spoilage.
Quoting and selling notes
- Tell clients that ransomware, hacking and system outages caused by attacks are not covered by their property or business income coverage. They need a cyber policy for those losses.
- Manufacturers and businesses that rely on automated systems should coordinate property, equipment breakdown and cyber coverage to avoid gaps.
