How does a cyber insurance policy change the way you respond to an incident?

It decides your first phone call, and it puts conditions on the calls after that. The cyber policies we have read come with a hotline, a lawyer who coordinates the response with you, usually called a breach coach, and a list of approved firms. They also set rules about notice and about spending. One Canadian policy wording we read lets you spend without the insurer’s written consent only in the first 72 hours after discovery, and anything you pay a third party in that window has to go to its approved firms. A carrier’s Canadian services form says that calling its hotline does not count as notifying it of a claim. Find out which rules are yours while nothing is on fire.

What is a breach coach?

A lawyer, usually from a firm on the insurer’s approved list, who runs the response alongside you.

Chubb’s Canadian material describes an Incident Response Coach from a pre-approved law firm who checks whether the event is real, handles the legal side if sensitive information has been exposed, and brings in other specialists as needed (Chubb Canada, Chubb Cyber Did You Know? infographic, 2018). Coalition’s Canadian panel lists the same role as breach and privacy counsel: firms that guide the breach response process, engage the forensic investigators, and advise policyholders about their legal duties after a breach (Coalition, Notice of Available Panel Providers, Canada, 2026).

Not every policy uses the name. The CFC wording for Canada routes the response through a cyber incident manager, named in the declarations, who will coordinate the initial response (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019). The wording never says that person is a lawyer. It is the same seat with a different title.

The useful way to think about it is sequence. The coach coordinates who examines the systems, who drafts the notices, who speaks publicly, and in what order. The coach advises. Your people still decide whether to tell a client today, whether to take a system offline, and what the board hears. A plan that does not name who works with the coach leaves that seat to whoever happens to pick up the phone.

What does a panel or approved vendor mean?

A list of firms the insurer has approved in advance: breach counsel, forensic investigators, notification services, public relations. How tightly the list binds you depends entirely on the document.

Chubb’s Canadian services form makes its panel optional. A policyholder is under no obligation to contract for services with any of the Cyber Incident Response Team service providers (Chubb Canada, Cyber Services for Incident Response, Form 14-01-1244, 2020).

Coalition’s Canadian panel notice is about timing. Policyholders may engage its panel firms upon written notice of a claim or incident (Coalition, Notice of Available Panel Providers, Canada, 2026). Notice comes first. Then the panel.

The CFC wording for Canada ties the panel to money. In the first 72 hours after discovery you can spend without written consent, but any third-party costs in that window must be with a company forming part of the approved claims panel providers. After that, every cost needs the incident manager’s prior written consent (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019).

Same word, three different meanings.

	Chubb Canada	Coalition Canada	CFC, Canadian wording
What we read	Services form, and the current Canadian web page	Panel notice, updated April 2026	Policy wording, version 3.0
Does a call to the hotline count as notice?	No. The form says the hotline does not satisfy the policy’s claim notification requirements	The panel notice says notice can be given by phone or by email	Yes. A call to the response line constitutes notification
Do you have to use the panel?	No. The choice is the policyholder’s	Panel firms are engaged on written notice	Third-party costs in the first 72 hours must be with panel firms
Do you need written consent to spend?	This document does not say	This document does not say	Not in the first 72 hours. For every other cost, yes

None of these is your policy. Coalition, for one, says specimen copies of its policies are available to appointed insurance brokers (Coalition, North American Servicing help centre, Where can I find Coalition's policy language?, 2025). Ask your broker for your wording.

What do you have to do before you call anyone?

Read four clauses in your own policy, now.

Start with notice: who you tell, how, and how fast. The CFC wording asks you to notify the cyber incident manager as soon as is reasonably practicable and follow their directions, and says the insurer is not liable for any part of a claim caused by unreasonable delay in notifying (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019).

Next, whether the hotline counts as that notice. Chubb’s form says its hotline is for initial triage and does not satisfy the claim notification requirements of your policy (Chubb Canada, Cyber Services for Incident Response, Form 14-01-1244, 2020). Its current Canadian page still lists the coach line and the claims address under separate headings (Chubb Canada, Cyber Incident Response Solutions page, 2026). If your policy works that way, the plan needs both steps written down, with a name against each.

Then the consent clause. What you can spend, with whom, and for how long, before somebody at the insurer has to agree in writing.

Last, who approves the letters to the people affected. The CFC wording says any privacy breach notification must be done with our prior written consent (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019). Your legal duty to report runs on its own clock. Under federal privacy law, where it is reasonable to believe a breach creates a real risk of significant harm to someone, the report to the Privacy Commissioner is due as soon as feasible after you determine the breach happened (Personal Information Protection and Electronic Documents Act, subsection 10.1(1), 2018). Settle in advance who gets the insurer’s sign-off, and how fast.

Who do you call first?

The order depends on your wording. This is the order the documents above imply.

Call	Why it comes here	What we read
The insurer’s response line	It is the fastest route to the insurer’s response team, and under some wordings it is your notice	Chubb’s line reaches a coach from a pre-approved law firm. CFC counts the call as notice. Chubb does not
The insurer’s claims notice, if separate	Notice can be a separate step, and delay can cost you	Chubb lists a separate claims address
Your broker	They placed the policy and can reach the insurer	Chubb’s form says you can contact your broker or give notice directly
Forensics, through the coach	The coach engages them	Coalition’s panel notice: breach counsel engage the forensic firms
Police and the Cyber Centre	The Cyber Centre suggests reporting rather than requiring it	Its ransomware playbook names local police, the Canadian Anti-Fraud Centre and the Cyber Centre
The Privacy Commissioner	Required where there is a real risk of significant harm, as soon as feasible	PIPEDA

If money moved, call your bank before any of them. Getting a transfer back depends on the bank acting quickly.

Where does the tested-plan requirement sit in the policy?

Usually not in the policy itself. In the application, which the policy relies on.

The CFC wording grants its cover in reliance upon the information that you have provided to us prior to the commencement of this insurance (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019). The application is where the tested-plan question lives. Beazley’s Canadian form asks whether you have an incident response plan, then offers Have a plan and, as a separate box, Tested in last year (Beazley Cyber Application, Canada, 2026).

What happens if that answer turns out to be wrong depends on the document, and the two we have read sit far apart. Cowbell’s US application warns that Misrepresentation of any material fact in this Application may be grounds for the rescission of this Policy (Cowbell Cyber Risk Insurance Application, Prime 250, 2020). The CFC wording says it will not void the policy or reject a claim over misrepresentation except where the non-disclosure or misrepresentation was reckless or deliberate (CFC Underwriting, Cyber Private Enterprise policy wording v3.0, Canada, 2019).

Whichever kind you have, the tested-plan box is where the record behind the answer matters most. It describes an event, not a setting, and an event needs a witness.

Should your plan name the carrier’s hotline?

Yes, and more than the number. The page of your plan that covers the insurer should hold the policy number, the hotline, the notice address if it is different, who is authorized to call, what counts as notice under your wording, and how much can be spent before consent is needed.

Put the broker’s after-hours contact on the same page. Chubb’s form says that after an incident you can contact your broker or provide notice to Chubb (Chubb Canada, Cyber Services for Incident Response, Form 14-01-1244, 2020).

Keep that page somewhere that still opens when company email does not.

How do you rehearse the first call?

Make it the first inject. The scenario opens, and the first decision the room faces is not technical. Who rings the insurer, on which line, and does that call count as notice under our policy? Then the coach asks what has been spent so far, and with whom. Then a draft notification letter arrives, and somebody has to get consent for it before it goes.

In the exercises we have run, a room under pressure falls back on two people: legal counsel and communications. Executives and technical staff alike defer to that pair. The breach coach, and the communications firm a coach may bring in, are the outside version of it. Rehearsing the first call is how you find out whether your inside pair knows the outside one exists.

That is a 3-hour exercise, and the after-action report it produces is the record behind the tested-plan box.