1. Forms
2. CY
3. CY-20-37

What the form is

The CY 20 37, titled "AMEND RETENTION – BUSINESS INCOME AND EXTRA EXPENSE – WAITING PERIOD (CCI)", is an endorsement to a commercial cyber insurance policy, such as the ISO form CY 00 02 Commercial Cyber Insurance Policy. Its primary function is to modify the application of the waiting period retention specifically for Business Income and Extra Expense coverage. Commercial cyber policies often include a time-based deductible (the "waiting period") for these coverages, rather than a monetary deductible. This endorsement specifies that the insurer will only pay the amount of business income loss and extra expense that is incurred after this predetermined waiting period has expired.

Classes of business it applies to

This endorsement is relevant for any organization that has or is purchasing a commercial cyber insurance policy which includes Business Income and Extra Expense coverage and wishes to customize the standard waiting period provision. It is particularly pertinent for businesses where IT system downtime can quickly lead to significant financial loss. Examples include:

• E-commerce companies reliant on online sales platforms.
• Financial institutions that depend on network availability for transactions and operations.
• Healthcare providers who need constant access to patient records and networked medical devices.
• Manufacturing firms that utilize automated or interconnected production systems.
• Professional service firms that depend on access to client data and communication systems.

Special considerations

The critical aspect of this endorsement is its impact on when coverage for Business Income and Extra Expense begins to pay after a cyber incident. Key considerations include:

• Understanding the Waiting Period: The insured must clearly understand the duration of the selected waiting period (e.g., 8 hours, 24 hours, 48 hours). Losses incurred during this waiting period are effectively self-insured by the business.
• Loss Calculation: The endorsement clarifies that the insurer pays for the loss amount incurred after the waiting period ends. It's important to confirm how losses accruing during but extending beyond the waiting period are handled.
• Policy Integration: This endorsement amends the main cyber policy. Its terms must be read in conjunction with the policy's Business Income and Extra Expense insuring agreement and other relevant conditions.

For example, if a business has a 24-hour waiting period and experiences a 36-hour system outage due to a covered cyber event, this endorsement would clarify that the insurer is responsible for the business income losses and extra expenses incurred during the 12 hours after the initial 24-hour waiting period concluded.

Key information for agents and underwriters

• Risk Assessment: The choice of waiting period, and therefore the potential use of this endorsement to modify it, should align with the insured's operational resilience and financial capacity to absorb initial downtime costs. Businesses with robust business continuity and disaster recovery plans might tolerate a longer waiting period for a premium advantage.
• Pricing Implications: Generally, a longer waiting period results in a lower premium, as it reduces the insurer's exposure to smaller, more frequent BI/EE claims. This endorsement helps tailor that exposure.
• Coverage Clarity: Agents must ensure clients fully comprehend how the waiting period and this endorsement affect their coverage, particularly the fact that there is no coverage for BI/EE losses during the waiting period itself.
• Underwriting Guidelines: Underwriters will assess the insured's industry, revenue streams, IT dependencies, and incident response capabilities when determining acceptable waiting periods and the applicability of this endorsement. The standard ISO Commercial Cyber Insurance Policy (CY 00 02) may have a default waiting period, and the CY 20 37 endorsement is used to formally amend this.