Monitor
At agreed intervals, we check that the measures the insurer requires are in place, and that crisis contacts are up to date.
Deliverables- Recurring check of the required measures
- Verified crisis directory
- Alerts ahead of the policy renewal
Domain · Cyber insurance and incident response
On the day of the incident, everything is already planned.
We prepare what cannot be improvised: an accurate insurance file, the measures the insurer requires, an incident response provider under contract, up-to-date crisis contacts and a notification schedule.
Situations
You are in the right place if…
- Your insurer sends you a renewal questionnaire and you hesitate over some answers.
- Your premium rises, or your cover shrinks, for want of measures deemed sufficient.
- You do not know whom to call on a Saturday night if your servers are encrypted.
- Your insurer imposes a panel of providers you have never met.
- You do not know which authorities to notify, nor by when.
Our conviction
On the day of the incident, neither cover nor reinforcements can be improvised.
An inaccurate answer to the insurer’s questionnaire can weaken your cover when you need it. An incident response provider found in an emergency mobilises slowly, on a contract signed under pressure.
So we prepare beforehand: verified answers, the required measures actually in place, a provider chosen calmly and accepted by the insurer, and a crisis directory everyone knows where to find.
Our approach
From the insurance policy to a crisis under control.
Insurance and incident response are prepared together: one pays, the other acts, and both must be aligned.
- 01Make the file reliableEach answer to the insurer’s questionnaire is checked on your systems, with evidence.
You getAn accurate, documented questionnaire
- 02Put the required measures in placeThe measures the insurer makes a condition (often strong authentication, offline backups, detection) are checked and tracked.
You getAn action plan and its evidence
- 03Contract the responseAn incident response provider selected, accepted by the insurer, under contract, with its response times.
You getAn incident response contract ready to activate
- 04Prepare for the crisisCrisis contacts, decision tree, notification schedule, tabletop exercise.
You getA tested crisis kit
What the texts say
What the texts expect of the response.
Depending on your status, several texts govern incident response and set notification deadlines that run from the moment you become aware.
- DORADORA art. 17(1) · DORA art. 11(2), point (c) · DORA art. 19(1)
Financial entities must have an ICT-related incident management process, activate without delay containment plans suited to each type of incident, and report major incidents to the competent authority.123
- NIS 2 · ReCyFNIS 2 art. 21(2), point (c) · NIS 2 art. 23(4), point (a) · ReCyF v2.5, objectif 14
The directive lists business continuity and crisis management among the measures Member States must require of entities, and provides for an early warning within 24 hours of a significant incident; the ReCyF (working version) sets them the objective of preparing for cyber crises.456
- GDPRRGPD art. 33(1) · RGPD art. 33(2)
The controller notifies a personal data breach to the supervisory authority where feasible within 72 hours, unless it is unlikely to result in a risk to individuals; the processor informs the controller without undue delay.78
- CNIL guideGuide CNIL sécurité, fiche 18, F18-PE-02
The CNIL recommends making sure that users, providers and processors know whom to alert in case of an incident.9
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
Our engagementLevel 01 Level 02 Level 03
The same topic, at three levels of engagement.
You choose the level; the scope and deliverables are set by contract.
Advise
We prepare the insurer’s file, and help you choose and contract your incident response provider.
Deliverables- Insurer’s questionnaire verified and documented
- Analysis of the cover against your scenarios
- Specification for the incident response provider
Drive
We run the preparation with your teams, your broker and your provider, without making the changes in your systems.
Deliverables- Management of the plan to meet the requirements
- Notification schedule and message templates
- Tabletop crisis exercise and lessons learned
AcceleratorsAnnotated insurer questionnaires Provider selection Crisis kit
What we bring from day one.
The questions insurers ask most, with the evidence behind each answer and the wording traps.
With the Expert Connect option, we shortlist incident response providers; you choose and you mandate.
Crisis directory, decision tree, notification schedule and message templates, to adapt to your organisation.
Frequently asked questions
Before we start.
Do you replace our broker or insurer?
No. We prepare your file and your measures, together with your broker, who remains your contact for the policy and the cover.
Do you step in during the incident?
We are not an incident response provider. We help you contract one before the incident, then, during the crisis, coordinate the parties and keep to the notification schedule.
Whom must we notify, and by when?
It depends on your texts. A personal data breach that poses a risk to individuals is notified to the supervisory authority where feasible within 72 hours; a NIS 2 entity sends an early warning within 24 hours under the directive, pending the French transposition; a financial entity reports its major incidents to its authority under DORA. We prepare this schedule with you; have it confirmed by your legal counsel or lawyer.753
What if the insurer imposes its own panel of providers?
We take it into account from the selection: the provider chosen must be accepted by the insurer, or the exception agreed with it in writing, before the incident.
Start before the next renewal.
Describe your current cover and its due date. We come back to you with a first reading of the questionnaire and the required measures.
Sources
The excerpts quoted.
Exact text, in its original language, from the frameworks extracted from the official text.
Show the 9 excerpts quoted
- 1DORA art. 17(1)
32022R2554-a17-p1Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 2DORA art. 11(2), point (c)
32022R2554-a11-p2-3activate, without delay, dedicated plans that enable containment measures, processes and technologies suited to each type of ICT-related incident and prevent further damage, as well as tailored response and recovery procedures established in accordance with Article 12;
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 3DORA art. 19(1)
32022R2554-a19-p1Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 in accordance with paragraph 4 of this Article. Where a financial entity is subject to supervision by more than one national competent authority referred to in Article 46, Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article. Credit institutions classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB. For the purpose of the first subparagraph, financial entities shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authority. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means. The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts. Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authority, Member States may additionally determine that some or all financial entities shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authorities or the computer security incident response teams (CSIRTs) designated or established in accordance with Directive (EU) 2022/2555.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 4NIS 2 art. 21(2), point (c)
32022L2555-a21-p2-3business continuity, such as backup management and disaster recovery, and crisis management;
- Normative force
- EU law to be transposed (directive): not directly applicable, requires national transposition
- Source
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
- Version
- CELEX 32022L2555 — ELI dir/2022/2555
- 5NIS 2 art. 23(4), point (a)
32022L2555-a23-p4-1without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;
- Normative force
- EU law to be transposed (directive): not directly applicable, requires national transposition
- Source
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
- Version
- CELEX 32022L2555 — ELI dir/2022/2555
- 6ReCyF v2.5, objectif 14
recyf:obj-14Les entités [importantes ou essentielles] mettent en œuvre une organisation, des processus et des outils adaptés pour se préparer et réagir à des crises d’origine cyber et tiennent à la disposition des autorités nationales compétentes et en particulier de l’autorité nationale de sécurité des systèmes d’information les informations relatives aux parties prenantes externes à l’entité pertinente dans la gestion de la crise. Les [entités essentielles] mettent en œuvre des retours d’expérience permettant d’identifier les axes d’amélioration et les mesures associées à mettre en œuvre suite à un entraînement, un exercice ou une crise réelle.
- Normative force
- obligation (decree, resilience bill)
- Source
- ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
- Version
- 2.5 du 17/03/2026 (version de travail)
- Status
- Working version: not binding until the transposition is enacted
- 7RGPD art. 33(1)
32016R0679-a33-p1In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Version
- CELEX 32016R0679 — ELI reg/2016/679
- 8RGPD art. 33(2)
32016R0679-a33-p2The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Version
- CELEX 32016R0679 — ELI reg/2016/679
- 9Guide CNIL sécurité, fiche 18, F18-PE-02
F18-PE-02S’assurer que les utilisateurs, prestataires et sous-traitants savent qui alerter en cas d’incident.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)