Not necessarily. A waiting period can exclude early losses as a time deductible or act as a duration threshold after which eligible losses may be counted from the start. At cyber renewal, confirm which wording applies, when the clock begins, and whether a separate monetary deductible remains.
Identify what the waiting period actually does
Do not compare policies by the hours figure alone. Determine whether that figure removes an initial loss window or simply requires the interruption to last long enough.
Coalition’s public explanation describes its waiting period as a duration trigger rather than a deductible. Its January 2018 blog separately explains that the coverage described there can count losses from the outset once the threshold is met, subject to a policy deductible. These are Coalition examples, not confirmation of any current renewal terms.
- Time-deductible reading: eligible loss measurement begins after the specified hours, leaving the initial loss window outside that measurement.
- Duration-threshold reading: the interruption must satisfy the specified duration; then inspect whether the loss definition includes eligible losses incurred from the beginning.
Sources: 10 costs your cyber insurance policy may not cover (unless it’s with Coalition) · DDoS Attacks: Business Interruption Intervention
Test both readings against one hypothetical outage
Hypothetical example: a SaaS company’s interruption runs from 9 a.m. to 9 p.m., and its policy shows eight hours. Assume the event, affected systems and losses otherwise qualify. Set aside monetary deductibles and limits solely to compare timing.
If the hypothetical interruption instead ended after five hours, neither assumed structure would produce eligible business-interruption hours.
This is a wording test, not a payout calculation. Ask for the eligible loss window to be marked on a timeline so finance and operations are working from the same interpretation.
- If eight hours operate as a time deductible, the 9 a.m.–5 p.m. window is excluded; the 5 p.m.–9 p.m. window can be considered.
- If eight hours are a duration threshold and the wording reaches back to the start, the 12-hour interruption can satisfy the threshold and all 12 hours can enter the eligible-loss assessment.
Sources: 10 costs your cyber insurance policy may not cover (unless it’s with Coalition) · DDoS Attacks: Business Interruption Intervention
Resolve the clock and coverage trigger together
Corvus’s 2020 explainer identifies waiting periods, coverage triggers and restoration periods as separate terms to examine. It also distinguishes interruption of internally managed IT from contingent interruption involving a third-party provider. A favorable time clause does not make an otherwise ineligible outage covered.
For renewal comparison, request answers tied to the proposed policy form and endorsements—not an informal summary of how cyber insurance generally works.
- Start: Is time measured from actual interruption, first discovery or another defined event?
- Severity: Does partial degradation qualify, or must there be a complete interruption?
- Continuity: How does the wording treat intermittent service or repeated disruptions?
- End: What ends the covered restoration period, and is there a maximum duration?
- Scope: Which time condition applies to your systems, dependent providers, income loss and extra expenses?
Passing the threshold does not establish the amount payable
Even when early hours can enter the assessment, the loss definition still matters. Coalition’s January 2018 explainer includes lost profit and continuing normal operating expenses, including payroll, in the coverage described there. That is a historical product example—not confirmation that payroll or every unproductive hour will be reimbursed under your renewal.
For a subscription business, organize missed sales, continuing costs, avoided costs and recovery spending separately. Do not turn every unproductive working hour directly into claimed income loss. This is a preparation worksheet, not an insurance calculation formula.
- Check any separate monetary deductible or retention alongside the time condition.
- Locate the business-interruption limit, any sublimit and applicable exclusions.
- Ask how normal payroll and claimed extra expenses are assessed under the proposed wording.
Sources: 10 costs your cyber insurance policy may not cover (unless it’s with Coalition) · Cyber Coverage Explained: Business Interruption
Prepare evidence without delaying incident response
CISA’s ransomware response checklist recommends documenting the initial understanding of an incident with the response team and preserving forensic evidence. Treat the insurance timing question as separate from containment and recovery actions; a waiting period is not an instruction to leave compromised systems running.
For renewal preparation, pair an engineering timeline template with a finance worksheet. Include first observed disruption, discovery, containment actions, restoration milestones and business-impact evidence. Use consistent time zones and label assumptions. These are practical preparation steps, not universal claim-proof requirements.
When requesting a cyber quote from Atlas Risk Partners, identify the early-loss question the proposal needs to answer. Compare the actual form and endorsements, not just the hour count. Availability varies by carrier, state and risk. This is general education: it does not bind or establish coverage, and policy wording controls.
Sources: Ransomware Response Checklist · Cyber Coverage Explained: Business Interruption
Your preparation checklist
- Locate the waiting-period definition, business-interruption insuring agreement, loss definitions, restoration-period definition and relevant endorsements.
- Record whether initial losses are excluded or potentially counted once the duration threshold is satisfied.
- List any separate monetary deductible, business-interruption limit and sublimit.
- Choose one hypothetical outage and mark its start, end and eligible loss window under each proposed form.
- Separate your company’s systems from hosting and other service providers; identify the applicable coverage part and time condition for each.
- Prepare a timeline template with consistent time zones and identify engineering and finance owners.
- Organize financial-record categories internally, including missed sales, continuing costs, avoided costs and extra expenses.
- Keep incident-response contacts accessible so containment and recovery actions do not wait for the business-interruption threshold.
Sources and editorial approach
Atlas publishes practical insurance education using public regulatory and insurer materials. Insurer examples describe their own products and do not establish Atlas market access. Your policy and endorsements determine actual coverage. This article is general information; it does not bind coverage or replace advice about your particular business.
- 10 costs your cyber insurance policy may not cover (unless it’s with Coalition)
January 30, 2018 insurer explanation of early-loss treatment, a separate policy deductible, and continuing operating expenses including payroll. Historical product example, not evidence of current quoted terms.
- DDoS Attacks: Business Interruption Intervention
Successfully opened public-page version of the supplied Coalition explanation. Cited only for its description of a waiting period as a duration trigger, not for the customer story or confirmation of current policy terms.
- Cyber Coverage Explained: Business Interruption
Updated March 6, 2020. Identifies waiting periods, coverage triggers and restoration periods as distinct terms to inspect, and distinguishes internally managed IT interruption from contingent interruption.
- Ransomware Response Checklist
U.S. agency response guidance on documenting incident understanding, coordinating response teams and preserving forensic evidence. It does not establish insurance coverage requirements.
Have a correction or a question? Contact Atlas.
