Should I buy cyber insurance in India?
Key takeaways
- A mid-sized Indian manufacturer might secure Rs 5 crore of cover for Rs 4-8 lakh; a larger IT services firm might pay Rs 15-25 lakh for Rs 10 crore.
- A mature security posture, regular penetration testing and documented business continuity plans can reduce premiums by 20-30%.
- Ransomware exclusions are the most common reason an Indian claim fails, because policies often require specific backups that were never tested.
- Insurers expect you to notify within the CERT-In six-hour reporting window, so your incident process must feed the insurer without delay.
- DPDP Rule 7 notification obligations commence from May 2027, and a claim that hides a notifiable breach is likely to be contested.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does an Indian cyber policy actually cover?
Most Indian cyber policies today are written around three perils: ransomware and business interruption, breach of personal data including regulatory fines, and third-party liability. Limits are usually a combination of a per-event retention and an annual aggregate, commonly set against turnover. A policy will also carry a sub-limit for social engineering and business email compromise, because in the Indian market those events are frequent and insurers cap them. Read that sub-limit carefully. For most Indian firms, the difference between a 10 lakh and a 50 lakh social-engineering sub-limit matters more than the headline retention figure, because that is where the losses actually occur.
What do underwriters check before they price you?
Underwriters look for a documented security posture, and they will ask for evidence rather than claims. The items that consistently move the price are regular third-party penetration testing, documented and tested backups, endpoint protection with a managed response element, multi-factor authentication on remote and privileged access, and business continuity documentation that has been exercised. A mature posture with regular penetration testing and documented continuity plans can reduce premiums by 20-30%. Indian questions also cover data localisation and DPDP readiness, and 83% of Indian organisations have not begun comprehensive DPDP implementation, which many underwriters now treat as a pricing factor rather than a future concern.
What exclusions quietly void a ransomware claim?
Read the conditions, not just the perils. Common exclusions include failing to maintain offline or immutable backups, not reporting a known incident, using unsupported or unpatched systems, and failing to comply with a recommendation made in a previous penetration test report. Some policies also exclude incidents where the attacker used credentials obtained from a third party if the insured had no supplier security programme. The trap is that a condition can be breached unknowingly. If a finding from your last test is still open and the ransomware came through that path, the claim is at risk. Keep the remediation tracker, and treat the closed items as insurance assets.
How do you build a claim-ready incident process?
The insurer's clock and CERT-In's clock run together, and the second is the tighter one: listed incidents must be reported to CERT-In within six hours, on incident@cert-in.org.in or 1800-11-4949. Your policy will require notification of the insurer, often within 24 to 72 hours, and will want the same facts. So the incident runbook must record, in one place and in real time, when you became aware, what was affected, what you have done and what you need. Keep your policies, incident plan and penetration test evidence in the same folder structure. That is what makes a claim survive a review.
| Business profile | Indicative cover | Indicative annual premium |
|---|---|---|
| Mid-sized manufacturer | Rs 5 crore | Rs 4 lakh - 8 lakh |
| Larger IT services firm | Rs 10 crore | Rs 15 lakh - 25 lakh |
| Premium effect of mature controls | 20-30% reduction available | Regular pen testing, tested backups, BCP |
| Social engineering sub-limit | Often capped below the retention | Check the cap before buying |
| Ransomware conditions | Immutable or offline backups, tested restores | Unmet conditions can void the claim |
| Notification window | Often 24-72 hours | CERT-In window is 6 hours |
What are the frequently asked questions?
Get a straight answer on this
Ask us for a pre-underwriting security posture review, so you enter the insurance conversation with a current assessment report and a closed remediation list.
Send us the details See pricing