What is typically not covered in data recovery costs under cyber risk insurance?

Data recovery costs under cyber risk insurance generally focus on mitigating the impact of a cyber incident, which primarily includes the electronic recovery of data, addressing business interruption losses, and handling expenses related to cyber extortion.

Manually recreating records from paper files is not typically included in these coverage types because it is seen as a less direct response to the data breach incident itself. Insurance for cyber risks is designed to cover expenses incurred in the recovery of data that has been electronically compromised or lost, which aligns with the nature of the risk these policies are insuring against. The costs associated with manually recreating records could involve significant labor and resources, but they fall outside the purview of what is generally covered by cyber risk policies, which focus on electronic formats and immediate recovery needs.

Business interruption losses are covered under such policies because they relate directly to the impact of the incident on operational continuity, while cyber extortion expenses involve costs related to threats against organizational data. Thus, the emphasis on electronic formats and technology-driven solutions distinguishes the typical coverage areas from those that require much higher levels of manual recovery efforts.