What is the extent of cover for legal defence costs under Cyber Liability?

  • By definition, defence costs include all ‘reasonable and necessary fees, costs and expenses incurred in the investigation, adjustment, defence and appeal of a claim …”
  • The nature of cover for defence costs is mostly as follows:
    • Defence costs against a civil action are covered under insuring agreements 1, 2, 3 and 5.
    • Defence against a regulatory action is covered under insuring agreements 1 and 5.
      • Insuring Agreement 1 example: The insured’s software miscalculates the solvency ratio for insurance companies. As a result the FSB brings charges against the insured.
      • Insuring Agreement 5 example: The insured runs a policy administration system on behalf of brokers. When the system is hacked the information gets out and the FSB brings charges against insured.
  • It is common for liability polies draw a distinction between the legal costs of defending
    • A criminal action - which is prosecuted by the state. E.g. manslaughter.
    • A civil action – which is a matter between two persons. E.g. an unpaid debt.
  • In the case of this policy, these costs are not subject to any sub-limit. They simply form part of the policy’s overall limit.
    • Example: If the indemnity limit is R3m, the Insured could spend R1m on the legal defence costs, leaving R2m to cover the damages award.
  • The following do not form part of defence costs:
    • The Insured’s internal costs such as salaries and overheads.

The legal costs of the third party suing the Insured. Although these are covered, they form part of the damages award and are not defined as Defence Costs.

Cyber Risk