Cyber insurance for hotels: what a policy covers and what insurers will ask

Cyber insurance for hotels is a policy that pays for some of the costs of a digital incident: restoring data, lost business, claims from guests and the response team. It is not a security product, and the wording decides what is paid. Insurers underwrite it with a questionnaire about sign-in, backups and updates.

Two quotes arrive, both called cyber, both with a limit on the front page, and neither says what happens if the reservation system is encrypted on a Saturday night in August. The difference is in the wording and in the questionnaire attached to it. After reading this article you will know the four cover groups, the clauses that decide claims, the security questions insurers ask, and how to compare two offers on one written scenario instead of on price alone.

What does cyber insurance cover for a hotel?#

A typical cyber policy pays for four kinds of cost: the hotel's own losses, the business it loses while systems are down, claims from other people, and the specialists who handle the incident.

The first group covers the hotel's own costs: restoring or rebuilding data and systems, hiring replacement equipment, and the extra expense of running the front desk on paper while the system is unavailable. The second, business interruption, covers revenue and extra expense lost while an insured system is unusable, usually calculated from the hotel's own figures and usually starting only after a waiting period. The third, liability, covers claims from guests, agencies or staff whose data was exposed, plus the cost of notifying them and of legal defence, all inside a limit and subject to exclusions. The fourth, incident response, brings in a forensics team, a lawyer, a negotiator and a communications adviser, often supplied from the insurer's panel of firms rather than chosen freely by the hotel.

Two further covers need attention. Cyber extortion and funds transfer fraud are often separate covers or separate sub-limits, so ask where they sit rather than assuming they are inside the main limit. And remember that the policy responds to incidents it defines, so the first question is not "are we covered" but "which of our systems are named in the definition".

The four cover groups in plain words#

What does a standard property policy leave out?#

Property and contents policies are built around physical damage, so a digital incident often falls outside them or lands in a narrow sub-limit that will not carry the loss.

Ask the broker to show, in writing, where the property policy stands on cyber: silent, excluded, or sub-limited, and for how much. A fire policy may pay for a burned server room and not for the encrypted data on the server, because the data itself is not physical property. Business interruption in a property policy is usually triggered by physical damage, so a system outage with no damage may not trigger it at all.

Crime and fidelity covers sometimes respond to a fraudulent payment, which is a different trigger from a cyber policy's funds transfer fraud cover; check which one the hotel actually holds. Where a cyber policy and a property policy both exist, ask which one pays first and how the two limits interact, so the hotel is not left arguing between insurers. This is a question for the hotel's own broker and legal adviser: this article sets out what to ask, not what any particular wording says.

Which cyber insurance exclusions and conditions should you read first?#

Read the waiting period, the prior-incident exclusion, the social engineering condition and the maintenance conditions on backups and updates, because these four decide most claims.

The waiting period matters because business interruption usually starts paying after a stated number of hours or days, so a two-day outage may cost the hotel money and produce no claim. Prior known facts matter because an incident or a weakness the hotel already knew about before the policy started is normally excluded, which is why buying cover after a breach rarely helps. Social engineering matters because a fraudulent payment is often covered only if the hotel followed a stated procedure, such as calling a known number to verify a change of bank details. Maintenance conditions matter because many policies require kept backups, supported software and applied updates, and a claim can be reduced or refused if those conditions were not met.

Three more clauses deserve a reading. War and state-linked attack exclusions are common and can be broad, so ask how the insurer reads them for a criminal group operating from abroad. The policy may require the insurer's agreement before the hotel hires a forensics firm, which is why the first call matters. Fines, penalties and contractual penalties are treated differently from policy to policy; ask directly rather than assuming, and take advice on the legal side.

Conditions that behave like exclusions#

If the clauses above read like a foreign language, start with the plain-word explanations of phishing, ransomware and two-step sign-in before going back to the wording.

What does the insurer's questionnaire ask?#

It asks for evidence that the hotel is hard to attack and quick to recover: two-step sign-in, tested backups, current software, separated networks and a plan for the first hour.

Two-step sign-in should be on email, on the property management system and on every administrator account, because a stolen password is a common way in. On backups, the insurer wants to know how often they run, whether one copy is kept offline or immutable, and when the hotel last restored from one successfully, not just whether a backup job reports success. On patching, how quickly security updates reach servers, front-desk machines and the router, and who is responsible for checking. On networks, guest Wi-Fi, the property management system, payment terminals and staff email should not sit on one flat network where one infected laptop reaches everything.

The questionnaire also asks about people. Access control means a list of who holds administrator rights, how accounts are closed when staff leave, and whether remote access requires two-step sign-in. An incident response plan with named people, an out-of-hours number and a printed copy matters, since the plan is unreadable exactly when it is needed. Training and phishing exercises come next, plus a list of the suppliers who touch guest data, because the insurer is underwriting the hotel's weakest link, not its best one.

The questionnaire as a working checklist#

Two companion articles expand the two heaviest items: the hotel cybersecurity checklist for owners and general managers and the guide to backups for hotel systems.

Who do you call first when an incident happens?#

Call the insurer's incident line before the team starts rebuilding, because the policy may require approval of costs and because the evidence needed for a claim is destroyed by a fast cleanup.

Keep the number off the network: a printed card at the front desk and in the general manager's wallet, because email and the intranet may be exactly what is unavailable. The insurer's line routes the hotel to its panel of forensics and legal firms; using an unapproved firm can put the cost outside the cover. Preserve before you repair: do not wipe the affected machines, keep logs, and record the timeline of what was noticed and when.

In parallel, the hotel's own duties run. Personal data law has its own notification route, and the timing and addressees should be confirmed with legal counsel rather than guessed during the incident. Tell guests and staff only what is known and confirmed; a wrong reassurance costs more trust than a short, honest holding statement. Write down what the insurer asks for and when: the claim file is built from the first hours, not from the final report.

For the full sequence, see ransomware at a hotel: the first 24 hours, step by step.

How do you compare two cyber insurance offers on the same scenario?#

Write one incident scenario in a paragraph, send it to both insurers, and ask each to state in writing what would be paid, what would wait and what would not be paid at all.

Use a realistic scenario for the property: the reservation system encrypted on a Saturday night in high season, check-ins running on paper, guest identity data possibly exposed. Ask for the answer in money terms against that scenario: which costs fall inside the limit, which sit in a sub-limit, and where the deductible and time deductible bite. Ask who chooses the response firm and how fast it can be on site, since a panel that answers in three days is a different product from one that answers in three hours.

Then compare the conditions, not only the premium. Ask what the hotel must keep doing to stay covered: the questionnaire answers become conditions, and a hotel that stops testing backups may lose the cover it paid for. Two-step sign-in, an offline backup and a patching routine cost money and staff time, and they are part of the price. Finally, ask what happens at renewal if the hotel has a small incident below the deductible, because the answer affects how incidents get reported.

What to do next#

Answer the questionnaire honestly, before shopping for a policy, because those answers are the price, the conditions and the claim. Fix what you cannot answer, write the Saturday-night scenario, and put it in front of a broker: a hotel that can evidence two-step sign-in, a tested offline backup and a patching routine buys better cover and needs it less.