Send the bill for a cyber incident to the right address.

A policy is tested before the incident

The hard truth about cyber policies: coverage is determined on the day of purchase, not the day of the incident. Ransom payments, business interruption, data-breach costs and administrative fines — each item has its own terms, deductibles and security warranties. The declared controls (MFA, backups) not actually working is the most common ground for denial.

A claim file requires documenting the loss items, a business-interruption calculation and mapping to the policy wording — against the insurer’s adjuster, it is your file that speaks. In parallel, the chain of fault is examined: the IT supplier that left a system unpatched, the poorly configured cloud, the negligent software provider. The liability limits in their contracts are tested and a recourse action strategy is built.

The annual cycle and the incident file

In peacetime, the work is an annual cycle: the policy wording is stress-tested against your realistic incident scenarios, declared controls are cross-checked with IT so the security-warranty trap is closed before renewal, and a coverage-gap report goes to management. On incident day, the protocol takes over: notifications leave within policy deadlines, approved vendors are engaged, and every expense is documented for the claim. The claim file itself is built like a pleading — loss items, the business-interruption calculation and the mapping to policy wording — while the recourse track runs in parallel against the suppliers whose failures contributed. Deliverables: the gap report, the incident-day protocol and the claim-and-recourse file.

The Turkish frame around the policy

Policy interpretation and claim disputes sit within the insurance book of the Turkish Commercial Code (Law No. 6102): the duties of notification, the aggravation of risk and subrogation — the claim that passes to an insurer who has paid, against the third party at fault — are the backbone of any recourse. The company’s own recourse then runs on two further tracks: the undertakings and liability provisions of the supplier contract, and liability under the Turkish Code of Obligations (No 6098). On both, the limitation calendar has to be set early. Whether administrative fines under the KVKK can be met from the policy turns on the policy wording and the governing law — which makes it a question to ask when the cover is bought, not on the day of the loss. Typical clients: e-commerce and SaaS companies, manufacturers with connected production lines, and Türkiye subsidiaries insured under a German group master policy — where the interplay between the local policy and the group tower must be mapped before the incident. The preventive layer is completed through our ISMS legal framework and the wider Cybersecurity focus.