Cyber insurance guide
Regulatory defense and PCI coverage
Regulatory coverage pays to defend investigations and proceedings that follow a privacy or security event.
Regulatory defense and penalties
After a breach, state attorneys general may investigate whether notification was timely and whether security was reasonable. Industry regulators may also be involved, such as health privacy regulators for health care providers. Cyber policies typically cover defense costs and, where insurable by law, civil fines and penalties.
Breach notification laws
Every state in our footprint has a breach notification statute with its own definition of personal information, deadlines, and requirements for notifying the attorney general. See data breach notification laws by state.
Payment card industry exposure
- Card brand fines and assessments passed through by your processor
- Costs of a forensic investigation required by the card brands
- Card reissuance and fraud recovery assessments
- Costs to return to compliance
Reducing exposure
Use a processor that tokenizes card data, avoid storing card numbers, keep payment systems patched and segmented, and complete your annual PCI self-assessment. These steps reduce both breach likelihood and the size of any assessment.
Frequently asked questions
Are regulatory fines covered?
Policies cover regulatory defense and may cover fines and penalties where insurable under applicable law. Insurability varies by state and type of penalty.
What is PCI coverage?
Coverage for fines, assessments, and costs imposed under your merchant services agreement after a payment card data breach, typically sublimited.
Who investigates breaches?
State attorneys general enforce breach notification and consumer protection laws, and federal agencies may be involved depending on your industry.
More coverage and guides
- First-party cyber coverage
- Third-party cyber liability
- Ransomware and cyber extortion coverage
- Social engineering and funds transfer fraud
- Cyber business interruption
- Regulatory defense and PCI coverage
- Data breach notification laws by state
- Security controls cyber insurers look for
- Cyber insurance application checklist
- What affects cyber insurance cost
- Building a cyber incident response plan
Last updated October 15, 2026 · How we research