Condition precedent: the gate a claim has to pass first

SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state.

Definition

In insurance the phrase usually describes something the insured must do before the carrier owes anything: report the claim within the stated period, obtain consent before incurring defence or forensic costs, cooperate with the investigation. Some cyber policies extend it further, attaching the application answers or a schedule of minimum security practices as ongoing conditions of coverage.

It is not an exclusion. An exclusion says a particular loss is outside the cover. A condition precedent says the machinery of the policy has not started.

How it works in a cyber policy

A cyber policy bundles several covers into one contract, and each brings its own conditions. Four recur, and they cut in both directions.

Notice. A cyber policy is not a single trigger. Its third-party liability sections are ordinarily written claims-made, so what counts is when a claim is first made against you and reported to the insurer, not when the underlying act happened. The first-party sections a smaller organisation is far likelier to claim on, breach response, extortion, and business interruption, are usually triggered instead by discovery of the incident and reporting it, often within a short stated period. Both routes turn on a deadline in the wording, and some of those deadlines are measured in days. An extended reporting period bought at expiry lengthens the time you have to report, not the period in which the wrongful act may occur, so it is not a cure for a missed first-party discovery clause. Late notice is a recurring way an otherwise covered cyber claim runs into difficulty, and it is worth knowing that many states apply a notice-prejudice rule, which makes the insurer show the delay actually harmed it, to occurrence policies while declining to apply it to the reporting condition of a claims-made one. That asymmetry is part of why applications ask whether you are aware of any circumstance that could give rise to a claim.

Consent. Cyber policies fund panel counsel, forensics, and negotiation. Engaging your own firm before the carrier's consent is given can put those costs outside the cover regardless of how reasonable the spend was.

Minimum practices. Some forms attach the controls described in the application as a continuing requirement. The Columbia Casualty policy at issue in the Cottage Health dispute carried an exclusion for loss arising out of "[a]ny failure of an Insured to continuously implement the procedures and risk controls identified in the Insured's application." That wording turns control drift after binding into a coverage question, not just an underwriting one.

Dispute resolution. Conditions precedent bind the carrier too. Many cyber policies require the parties to work through an alternative dispute resolution clause, non-binding mediation or arbitration, before either can sue, and this is where the Cottage Health litigation actually turned.

What these two disputes actually show

The clearest illustration is Columbia Casualty Co. v. Cottage Health System, where the policy required the parties to work through an alternative dispute resolution clause before either could sue. The insurer sued without doing so, and its own case was dismissed without prejudice in July 2015 on that ground, before any question about the application answers was reached. According to the complaint, the same policy did the ongoing-condition thing twice over: a Minimum Required Practices exclusion for any failure to continuously implement the controls the application described, and a condition in which the insured "warrants, as a condition precedent to coverage under this Policy," that it shall maintain all risk controls identified in its application. That is the pattern this page is about, in the carrier's own drafting.

Nothing in that matter, or in the Travelers stipulation that is usually cited alongside it, was decided on the merits. The full record is on the rescission page.

What this means for the answer you are about to sign

Two things follow for an organisation preparing an application.

Read the conditions before you read the limit. A policy with a high headline limit and a 30-day notice condition, a consent requirement, and a minimum practices clause is a different product from one without them, and the difference only becomes visible on the worst day. This is a conversation to have with your broker and coverage counsel at quote stage, not at claim stage. Comparing policy terms and negotiating wording are activities for your licensed broker and coverage counsel; SecValley does not advise on the selection, terms, or placement of insurance.

Then treat any minimum practices clause as a monitoring obligation rather than a signing obligation. If the policy requires you to continuously implement the controls the application described, an exclusion an administrator opens for a migration in month four is a coverage issue in month nine. Continuous measurement exists precisely because that drift is otherwise invisible until an adjuster finds it.

Where the evidence for that answer lives

Where a policy makes stated controls an ongoing condition, the useful artefact is not a screenshot taken at binding. It is a series of dated readings across the policy period showing the control held. Multi-factor coverage, EDR deployment, backup immutability, and log retention are all readable on a schedule.

Frequently asked

What is a condition precedent in a cyber policy?

It is a requirement that has to be met before the insurer owes performance. Common examples are notice of a claim within a defined period, obtaining the carrier's consent before incurring defence or forensic costs, and, in some forms, continuously maintaining the security controls the application described. Failing a condition precedent can defeat a claim that would otherwise have been covered.

Are application answers conditions precedent?

Sometimes. Some cyber forms incorporate the application and attach its statements as conditions or as a minimum practices requirement; others treat the answers as representations only. The wording differs by carrier and by form, so it is worth checking rather than assuming.

Does a condition precedent bind the insurer as well?

Yes. In Columbia Casualty v. Cottage Health System the policy required the parties to work through an alternative dispute resolution clause, non-binding mediation or arbitration, before either could sue. The insurer sued without doing so and its case was dismissed without prejudice in July 2015 on that ground, before any question about the application answers was reached.

What is the difference between a condition precedent and an exclusion?

An exclusion carves a category of loss out of the cover. A condition precedent leaves the cover intact but suspends the insurer's obligation until the requirement is met. In practice both can end a claim, but they are argued differently.

How short are cyber notice periods?

They vary widely and some are very short. The liability sections are ordinarily claims-made, so the reporting window is set by the policy rather than by when the loss occurred, and a claim reported after it closes can fall outside cover entirely. The first-party sections usually run on discovery and prompt reporting instead, sometimes within days of discovering the incident. An extended reporting period extends the time to report, not the period covered. Read the notice clause of your own policy; do not generalise from another one.

Sources

Every statement about a court case on this page is drawn from the documents and reporting below. Links open on the publisher's own site.

• Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432 (C.D. Cal.), docket CourtListener, RECAP
• Columbia Casualty complaint filed 7 May 2015, pleading the Risk Control Self Assessment, the Minimum Required Practices exclusion and the matching condition precedent (docket entry 1) CourtListener, RECAP
• Order granting the motion to dismiss for failure to exhaust the policy’s alternative dispute resolution clause, entered 17 July 2015 (docket entry 22) CourtListener, RECAP
• Columbia Casualty Co. v. Cottage Health System, No. 2:16-cv-03759 (C.D. Cal.), refiled action docket: stayed 2 December 2016, dismissed by stipulation 25 January 2018 CourtListener, RECAP
• Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016) Covington, Inside Privacy
• Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill.), docket CourtListener, RECAP
• Order granting the agreed motion for rescission and dismissal, entered 30 August 2022 (docket entry 5) CourtListener, RECAP
• Travelers complaint filed 6 July 2022, pleading the application and the signed MFA attestation (docket entry 1) CourtListener, RECAP
• Travelers, policyholder agree to void current cyber policy (30 August 2022) Insurance Journal
• Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022) Lockton

Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015 by Pregerson, J.), refiled as No. 2:16-cv-03759-JAK-AGR (C.D. Cal., filed 31 May 2016, stayed 2 December 2016 by Kronstadt, J., dismissed by stipulation 25 January 2018); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145-CSB-EIL (C.D. Ill., Urbana Division, filed 6 July 2022, agreed order of rescission and dismissal entered 30 August 2022 by Bruce, J.). Every docket and filing cited below is linked directly.

Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship.

Related terms

Back to the glossary