Continuity, Recovery and Cyber Insurance

Lesson 11 covered the days when an incident is live. This lesson covers the hours and weeks after it, when the question is how fast the business gets back to work and who pays. Both halves come down to preparation done before the incident: a decision about how much downtime the business can stand, backups that survive an attacker, and an insurance contract that actually fits the risk. For the small-office version of backups and restore steps, see the small business data security module. For the layer view of recovery as the eleventh layer, see lesson 02.

The stakes are visible in the data. IBM's 2026 report puts the global average breach cost at $4.99 million, as of October 2026 (IBM). Coveware's second quarter 2026 report found access was heavily identity-driven: phishing and social engineering, including vishing and help-desk manipulation, returned to the top, with attackers abusing MFA and password reset workflows, account recovery and OAuth grants (Coveware). Attackers who reach an administrator account go after backups first. That makes the design of your recovery copies a management decision, not just a technical one.

Business impact analysis

A business impact analysis (BIA) asks one question about every important process: what happens, in money and in harm, if it stops? NIST's contingency planning guide, SP 800-34 Revision 1, treats the BIA as a core step and supplies a template, and it sets out contingency planning that ties information systems to business operations (NIST SP 800-34 Rev. 1). The CSF 2.0 Recover function has two categories: Incident Recovery Plan Execution (RC.RP), restoring availability of affected systems and services, and Incident Recovery Communication (RC.CO), coordinating restoration and communicating with internal and external parties (NIST CSWP 29). ISO 22301:2019 is the international standard for business continuity management systems. The ISO page lists the 2019 edition as published, with a 2024 amendment on climate action changes, and shows the standard flagged for revision (stage 90.92 as of December 2025) with a successor at committee draft stage (ISO). I did not purchase or read the ISO text itself.

A usable BIA for a firm of 10 to 500 fits in a spreadsheet. List the processes (take orders, ship, invoice, pay staff, answer phones, deliver service). For each one, write the systems, people and vendors it needs, the cost of one hour and one day of downtime, the earliest moment the harm becomes serious, and the data you could not recreate. Interview the people who run the work. IT often does not know that the payroll cutoff is Thursday noon, or that a key customer's contract fines you for a missed delivery.

Process	Depends on	Cost of one hour down	Pain point	Target RTO	Target RPO
Order entry and shipping	ERP, warehouse scanners, carrier portal	$6,100	Same-day shipping promise breaks after 4 hours	8 hours	1 hour
Invoicing and collections	ERP, email, bank portal	$900	Cash flow slips after 3 days	2 business days	24 hours
Payroll	Payroll service, HR system, bank	$0 until cutoff, then severe	Missed paychecks, wage law exposure	Before the cutoff	24 hours
Customer phones and email	Phone system, email, ticketing	$1,400	Customers leave after one day silent	4 hours	4 hours
Engineering drawings	File server, design software	$2,500	Rework if more than a day of changes is lost	2 days	4 hours

RTO, RPO and the cost of downtime

The recovery time objective (RTO) is the longest outage a process can take. The recovery point objective (RPO) is the most data, measured as time, it can lose. If the RPO is one hour, backups or replication must capture changes at least hourly. If the RTO is eight hours, someone has to be able to rebuild or fail over that system in eight hours, with the staff and tools on hand at 3 a.m. A third number, maximum tolerable downtime, marks the point where the harm turns permanent, and the RTO must sit inside it.

Tighter targets cost more. Every hour you shave off RPO or RTO adds spending on replication, standby systems and people.

Disaster recovery tiers

Tier	How it works	Typical RTO	Typical RPO	Cost signal (rough, unsourced)	Fits
1, backup and restore	Copies stored offsite or in the cloud. After a failure, rebuild systems and restore data	Days	Hours to a day	Lowest: storage and software	Back-office systems, file shares, archives
2, pilot light	Core data replicated and minimal standby servers ready to be scaled up	Hours to a day	Minutes to an hour	Moderate: replication plus a small standing footprint	ERP, line-of-business databases
3, warm standby	A scaled-down duplicate environment always running, switched over when needed	Under an hour to a few hours	Minutes	High: you pay for two environments	Order systems, customer portals with high hourly loss
4, active-active	Two live sites sharing load, either one can carry the whole load	Minutes or near zero	Near zero	Highest	Rare in firms of this size

The columns for cost are a signal, not a price list. A cloud provider's pricing or an IT provider's quote is the real input. The tier question for a manager is whether the cost of downtime justifies the cost of the tier. Section "Worked example" below puts numbers on it.

Regulated systems

Some rules set contingency requirements. The HIPAA Security Rule's contingency plan standard (45 CFR 164.308(a)(7)) lists five implementation specifications: a data backup plan, a disaster recovery plan and an emergency mode operation plan, which are required, and testing and revision procedures and an applications and data criticality analysis, which are addressable (45 CFR 164.308). Addressable means you must implement it or document why an equivalent alternative fits. It does not mean optional. The criticality analysis is, in practice, the BIA. PCI DSS 4.0.1 expects its incident response plan to include business recovery and continuity procedures and data backup processes. The incident response plan elements sit in Requirement 12.10.1, and the standard is distributed by the PCI Security Standards Council, so confirm the wording in your own copy (see lesson 05). CIS Controls v8.1 devotes a control to data recovery: Control 11 says to establish and maintain data recovery practices sufficient to restore in-scope enterprise assets (CIS).

Backups that survive ransomware

Ransomware crews know backups are what let a victim refuse to pay, so they hunt for them. CISA's guide says to maintain offline, encrypted backups and test them regularly, because many ransomware variants try to delete or encrypt accessible backups. It also says to keep golden images (clean system templates), infrastructure-as-code templates and backup hardware available for rebuilding, and in its response checklist to restore from offline, encrypted backups, prioritizing critical services, and reconnect only clean systems to avoid reinfection (CISA). OFAC's advisory lists offline data backups and incident response plans among the steps that reduce the risk of extortion and count as mitigating factors (OFAC).

A common rule of thumb extends the older "3-2-1" idea: three copies of the data, on two kinds of storage, one offsite, and one immutable or offline, with a regular check that the copy restores with no errors. The extension is a practice, not a rule in any statute. What matters is the property behind it. At least one copy must be out of reach of any account an attacker can steal.

Design choice	What it protects against	What can still go wrong	Question for your IT provider
Immutable storage with a retention lock (the copy cannot be altered or deleted before the lock expires)	An attacker or insider with admin credentials deleting backups	Lock set too short; the lock tied to the same admin account; backup of already-infected systems	What is the lock period, and who can change it? Show us a failed delete attempt as proof
Separate credentials and separate cloud account or tenant for backups	One stolen identity reaching both production and backup	Shared password manager entry; single sign-on tied to the same directory	Do backup administrators use different accounts than production administrators, with MFA?
Offline or air-gapped copy (disconnected media or a vault)	Network-borne attacks and mass encryption	Media sits in the same building; the copy is stale	How old is the offline copy, and where is it stored?
Backups of SaaS data (mail, files, collaboration, CRM)	Account takeover, deletion, sync of corrupted files	Believing the vendor's built-in retention is a backup	What is backed up outside the vendor, and for how long?
Encrypted backups with keys held separately	Theft of backup media or storage	Lost keys make restore impossible	Where are the keys, who can use them, and is there a break-glass copy?
Backup monitoring and alerts	Silent failure for weeks	Alerts go to a mailbox nobody reads	Who gets failure alerts, and how many jobs failed last month?

Restore testing and the evidence for it

A backup is a theory until someone restores it. The test has to be on a schedule, written down, and timed against the RTO. A manager should be able to open a folder and see, for each critical system, the date of the last restore test, who ran it, how long it took, what was restored, and what failed. Test three things: a single file, a full system, and a full application with its data and its dependencies. The last one fails most often, because the system needs an identity service, a license server or a network setting that was never captured.

Ransomware readiness beyond backups

Backups bring the data back. The business needs more to keep going while that happens. These decide how bad the week is.

First, an alternate way to work. Printed customer lists, a paper order form, a prepaid card for urgent purchases, a phone tree, a spare laptop that is not on the network. Second, a communication path that does not depend on the attacked systems: personal or out-of-band phone numbers, a text group, and a way to reach staff when email is down. Third, a recovery order written in advance: identity first, since nothing else can be trusted until the directory is clean, then the core business systems, then everything else. Fourth, clean rebuilds. CISA's guide says to remove persistence mechanisms and rebuild systems, starting with critical services, and to identify the initial breach point, including compromised accounts (CISA). Restoring on top of a still-compromised directory just gives the attacker a second turn.

Cyber insurance

Cyber insurance reimburses defined costs of a cyber incident, and offers services during one. Policies differ a lot in wording, so the definitions page matters more than the brochure. The NAIC, the association of state insurance regulators, collects and publishes cyber insurance market data on its cybersecurity page; its summary there is dated and cites roughly $6.5 billion of premium for 2020, so for current figures use the latest NAIC report on the cybersecurity insurance market (NAIC).

First-party and third-party coverage

Type	Coverage part (names vary)	What it usually pays	Watch for
First-party (your own losses)	Incident response	Forensics, outside breach coach, notice, call center, credit monitoring, public relations	Panel vendor requirement; sublimits; per-person caps on notification
First-party	Business interruption	Lost net income and continuing expenses after a covered outage	Waiting period (hours before coverage starts), definition of an outage, whether a vendor's outage counts (dependent business interruption)
First-party	Data restoration and system recovery	Cost to restore or recreate data and software	Often excludes upgrades or improvements ("betterment")
First-party	Cyber extortion	Negotiation and, in some policies, the ransom payment	Sanctions screening; requirement to notify law enforcement; consent before paying
First-party	Funds transfer fraud and social engineering	Money sent to a fraudster	Usually a sublimit; verification (call-back) conditions; may sit on a different form such as a crime policy
Third-party (claims against you)	Privacy and network liability	Defense and settlements when customers, partners or others sue after a breach	Contractual liability exclusions; limits shared with other parts
Third-party	Regulatory proceedings	Defense costs and, where allowed by law, fines and penalties	Insurability of fines depends on the jurisdiction and the policy wording
Third-party	PCI assessments	Card brand fines and assessments tied to a compromise	Often sublimited; check whether contractual assessments are covered
Third-party	Media liability	Claims over online content	Rarely the reason you buy the policy

Common exclusions and conditions

Read the exclusions page before the coverage page. The ones that most often surprise policyholders are the following.

Exclusion or condition	What it does	What a manager should check
War and state-backed attack	Removes coverage for losses from war, hostile acts or cyber operations attributed to states	Exact wording, the attribution test, whether it removes coverage when a state is suspected rather than proven
Failure to maintain controls	Reduces or removes coverage if the insured did not maintain security measures it said it had	Whether the wording ties coverage to the application's representations, and whether the standard is "reasonable" or "as stated"
Prior knowledge and prior acts	Excludes incidents that began or were known before the policy period or retroactive date	The retroactive date, and the claims-made reporting rule
Infrastructure outages	Excludes failures of power, internet or telecom not under your control	Whether you can buy this back
Contractual liability	Excludes liability you took on in a contract beyond what the law would impose	Whether customer indemnities are covered, since many customer contracts demand them
Unencrypted devices or unpatched systems (some forms)	Adds conditions or sublimits for losses linked to missing basic controls	Whether the condition applies to the whole policy or one coverage part
Betterment	Pays to restore, not to improve	Whether upgrades required for security are covered

On war exclusions, a court decision and a market bulletin shape today's wording. In Merck v. ACE, the New Jersey Appellate Division held in 2023 that the "hostile or warlike action in time of peace or war" exclusion in Merck's property insurance did not bar coverage for NotPetya damage, because the exclusion required military action or a clear connection to war. The insurers' remaining exposure was about $700 million, and Merck reportedly reached a deal with them in January 2024 (DAC Beachcroft; DataBreaches.net). The settlement terms are not public. In response, Lloyd's issued Market Bulletin Y5381 on August 17, 2022, requiring standalone cyber policies written at Lloyd's from March 31, 2023 to include a clause excluding state-backed cyber attacks, with minimum content: exclusion of war-related losses where no separate war exclusion exists, exclusion of state-backed attacks that significantly impair a state's ability to function or its security capabilities, a clear statement on systems outside the affected state, a basis for attributing attacks, and defined terms (Lloyd's). The practical result is that clearer, narrower and sometimes broader exclusions now appear in policies sold by many insurers. Read yours.

The application is a statement of fact

Insurers ask what controls you run. Typical application questions, based on common carrier forms rather than any single source I could verify here, cover multifactor authentication on email, remote access and administrator accounts, endpoint detection and response, backups (offline or immutable, tested), patching speed, email filtering, training, an incident response plan, privileged access management and the number of records held. Because the insurer relies on the answers to price and accept the risk, an answer that turns out to be wrong can lead to a denied claim or an attempt to rescind the policy.

The best-known example is Travelers v. International Control Services (ICS). Travelers sued in the U.S. District Court for the Central District of Illinois on July 6, 2022. It alleged that ICS's application said multifactor authentication was required for employees and third parties accessing email, remote network access, endpoints, servers, network infrastructure and directory services, and that MFA was in fact used only on the firewall, not on the servers hit by ransomware. Travelers asked the court to rescind the $1 million policy and declare no coverage (Reed Smith). Lockton reports that ICS agreed to a judgment rescinding the policy, entered on August 26, 2022, so no court ruled on the merits of the MFA dispute. Treat the case as an example of the risk and not as a holding (Lockton).

The lesson for management is procedural. The person who signs the application should not be the only one who checked the answers. A short sign-off sheet works: for each control question, the name of the technical owner, the evidence (a console screenshot or report) and the date. If an answer is "partly," say so on the form, and ask the broker how the carrier will treat partial coverage. Update the insurer when facts change materially mid-term if the policy requires it.

Limits, retentions, waiting periods and sublimits

Claims process

Most policies are claims-made and reported: they cover claims first made and reported during the policy period or a short extended reporting window. A late report can void cover. Read the notice provision and put the insurer's claim hotline on the incident card. In a live event the order is usually: call the hotline or broker, receive a breach coach and approved vendor list, get consent before spending on non-panel vendors, keep invoices and the incident log, and submit proof of loss on the insurer's forms. Use of the insurer's panel is often a condition for response costs to be reimbursed in full, and those panels can include forensic, notification, public relations and restoration firms. If your own forensic firm or your IT provider's incident team is your preferred choice, ask the broker before you buy whether they can be added to the panel, and get that in writing. Also confirm in the policy how it treats extortion payments and what it requires on sanctions screening, because OFAC's strict liability rule (lesson 11) applies to the payer and to the firms that facilitate the payment.

Premium trends

Cyber insurance was costly and tight in 2021 and 2022, and prices have since fallen. Marsh's Global Insurance Market Index for the second quarter of 2026 reported global cyber rates down 4 percent, the twelfth straight quarterly decrease, after a 5 percent drop in the first quarter, with U.S. cyber down 2 percent and U.S. rates declining since the second quarter of 2023 (Insurance Journal). On a $30,000 premium, a 2 percent decrease is $600. A buyer should not read that as a reason to cut limits, since a soft market is the best time to buy higher limits or broader coverage at stable cost, and the cycle can turn. Reported rate change does not equal what your firm will pay: your own controls, claims history, revenue and industry move the quote more than the market average does.

Checklist: reading a cyber policy

Where insurance sits in the risk decision

Lesson 03 lists four ways to handle a risk: treat it, transfer it, accept it or avoid it. Insurance is the transfer option for the leftover loss after you have done what you can. It does not change the likelihood of an incident, and insurers increasingly price on controls. A firm that cannot show MFA, endpoint detection, tested backups and an incident plan pays more, gets sublimits, or is turned down. In that sense the insurance application is the cheapest outside audit you will get, and the answers on it are one more piece of evidence in the board's risk file. See lesson 03.

The point about conditions bears repeating. A policy that excludes losses from controls you said you had will not respond the way the board expects if the controls were not there. That is why the sign-off sheet matters, and why the answers belong in the same register as the rest of your compliance evidence from lesson 10 and the vendor lessons in lesson 09.

Questions and answers

How do we pick RTO and RPO numbers when nobody knows what an outage costs?

Start with revenue per operating hour, apply gross margin, add idle labor, and check the contracts for penalties. The result will be rough. A rough number, agreed by finance and operations and written down, beats a precise one nobody believes. Review it once a year.

How often should we test restores?

At least once a year for each critical system, and after any major change. Single-file restores can run monthly. Record the time it took and the age of the data you got back, and compare both to the targets.

Is immutable backup the same as offline backup?

No. Offline means the copy is disconnected from the network. Immutable means it is connected but locked against changes for a set period. Either can serve, and many firms use both. CISA's guide specifically says offline, encrypted backups.

Does cyber insurance require us to have EDR and MFA?

Many insurers ask about them on the application and may price or decline on the answers. There is no single industry rule. Ask your broker which controls your carrier treats as minimums. My description of typical application questions comes from common practice, not from a primary source I could cite.

Will the policy pay a ransom?

Some policies cover extortion payments and negotiation, with conditions, and some exclude or limit the ransom. OFAC's advisory applies regardless of who pays, so sanctions screening has to happen before any payment. Lesson 11 covers the decision table.

What is dependent business interruption?

Coverage for lost income when an outage at a supplier you depend on, such as a cloud service, stops your business, rather than an outage in your own systems. It is often sublimited or excluded unless added. Ask for it by name.

What if our insurer is slow to approve a vendor?

Get the consent in writing, and record the time you asked. Keep your own incident log and invoices. Many disputes over reimbursement turn on whether the insurer consented before the spend.

Should a 15-person company buy cyber insurance?

A small firm often has less cash to absorb a fraud loss or a multi-week outage. A policy with modest limits and the right sublimits can be sensible, and the application process itself tells you which controls to fix. The decision is the owner's, based on the BIA and the firm's risk appetite.

Hard questions

"We have insurance, so why spend on backups and recovery testing?"

Insurance pays money, not uptime. It has a waiting period, a retention and limits, and it will not bring back a customer who left during an outage. It may also be contested if the controls on the application were not in place. Backups and restore tests shorten the outage that insurance only partly covers. The two work together.

"The insurance market is soft and rates are falling. Shouldn't we cut our limit to save money?"

A soft market is usually the time to look at higher limits or broader terms for the same money. Reported rate changes were down 2 percent for U.S. cyber in the second quarter of 2026, but individual quotes depend on your controls and claims. Cutting a limit locks in the loss if the market hardens. Compare the limit to your own BIA numbers and to the IBM average cost of $4.99 million before you decide.

"Our IT provider says backups are handled. Why do we need to look?"

Because your name is on the insurance application and the risk register. Ask for the evidence in the checklist above. If the provider has it ready, the request takes five minutes. If not, you have learned something before the incident. Outsourcing the work does not outsource the accountability (lesson 01).

"If we pay the ransom and the insurer reimburses us, isn't that the end of it?"

No. Payment does not remove notice duties if data was taken, and it may add reporting duties, such as the 24-hour NYDFS notice for covered entities. Coveware's Q2 2026 report notes cases where stolen data was kept despite promises to delete it. Sanctions risk remains with the payer under OFAC's strict liability rule, and a payment can make you a repeat target. Treat payment as a last-resort business decision with a memo, not a way to close the file.

"A full disaster recovery site is too expensive. Isn't it enough to just hope for the best?"

Hope is not a tier. The Blue Heron example shows that a modest, tested backup service can beat its expected loss, while a warm standby may not on pure arithmetic. Pick the tier per process from your BIA, test it, and document what you chose and why. If the board accepts a longer outage for a given system, record that as a signed risk acceptance. That is a legitimate decision. An unexamined gap is not.