Condition precedent: the gate a claim has to pass first

SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state.

Definition

In insurance the phrase usually describes something the insured must do before the carrier owes anything: report the claim within the stated period, obtain consent before incurring defence or forensic costs, cooperate with the investigation. Some cyber policies extend it further, attaching the application answers or a schedule of minimum security practices as ongoing conditions of coverage.

It is not an exclusion. An exclusion says a particular loss is outside the cover. A condition precedent says the machinery of the policy has not started.

How it works in a cyber policy

Cyber policies contain more conditions precedent than most commercial lines, and they cut in both directions.

Notice. Cyber policies are typically claims-made, and many require notice of a claim or circumstance within a defined window, sometimes as short as the policy period plus a short tail. Late notice is the single most common way an otherwise covered cyber claim gets into trouble, which is why applications ask whether you are aware of any circumstance that could give rise to a claim.

Consent. Cyber policies fund panel counsel, forensics, and negotiation. Engaging your own firm before the carrier's consent is given can put those costs outside the cover regardless of how reasonable the spend was.

Minimum practices. Some forms attach the controls described in the application as a continuing requirement. The Columbia Casualty policy at issue in the Cottage Health dispute carried an exclusion for loss arising out of "[a]ny failure of an Insured to continuously implement the procedures and risk controls identified in the Insured's application." That wording turns control drift after binding into a coverage question, not just an underwriting one.

Dispute resolution. Conditions precedent bind the carrier too. Many cyber policies require the parties to work through an alternative dispute resolution clause, non-binding mediation or arbitration, before either can sue, and this is where the Cottage Health litigation actually turned.

What these two disputes actually show

The clearest illustration is Columbia Casualty Co. v. Cottage Health System, where the policy required the parties to work through an alternative dispute resolution clause before either could sue. The insurer sued without doing so, and its own case was dismissed without prejudice in July 2015 on that ground, before any question about the application answers was reached. According to the complaint, the same policy carried a Minimum Required Practices exclusion tying cover to the controls the application had described, which is the ongoing-condition pattern this page is about.

Nothing in that matter, or in the Travelers stipulation that is usually cited alongside it, was decided on the merits. The full record is on the rescission page.

What this means for the answer you are about to sign

Two things follow for an organisation preparing an application.

Read the conditions before you read the limit. A policy with a high headline limit and a 30-day notice condition, a consent requirement, and a minimum practices clause is a different product from one without them, and the difference only becomes visible on the worst day. This is a conversation to have with your broker and coverage counsel at quote stage, not at claim stage. Comparing policy terms and negotiating wording are activities for your licensed broker and coverage counsel; SecValley does not advise on the selection, terms, or placement of insurance.

Then treat any minimum practices clause as a monitoring obligation rather than a signing obligation. If the policy requires you to continuously implement the controls the application described, an exclusion an administrator opens for a migration in month four is a coverage issue in month nine. Continuous measurement exists precisely because that drift is otherwise invisible until an adjuster finds it.

Where the evidence for that answer lives

Where a policy makes stated controls an ongoing condition, the useful artefact is not a screenshot taken at binding. It is a series of dated readings across the policy period showing the control held. Multi-factor coverage, EDR deployment, backup immutability, and log retention are all readable on a schedule.

Frequently asked

What is a condition precedent in a cyber policy?

It is a requirement that has to be met before the insurer owes performance. Common examples are notice of a claim within a defined period, obtaining the carrier's consent before incurring defence or forensic costs, and, in some forms, continuously maintaining the security controls the application described. Failing a condition precedent can defeat a claim that would otherwise have been covered.

Are application answers conditions precedent?

Sometimes. Some cyber forms incorporate the application and attach its statements as conditions or as a minimum practices requirement; others treat the answers as representations only. The wording differs by carrier and by form, so it is worth checking rather than assuming.

Does a condition precedent bind the insurer as well?

Yes. In Columbia Casualty v. Cottage Health System the policy required the parties to work through an alternative dispute resolution clause, non-binding mediation or arbitration, before either could sue. The insurer sued without doing so and its case was dismissed without prejudice in July 2015 on that ground, before any question about the application answers was reached.

What is the difference between a condition precedent and an exclusion?

An exclusion carves a category of loss out of the cover. A condition precedent leaves the cover intact but suspends the insurer's obligation until the requirement is met. In practice both can end a claim, but they are argued differently.

How short are cyber notice periods?

They vary widely and some are very short. Because cyber policies are usually claims-made, the reporting window is defined by the policy rather than by when the loss occurred, and a claim reported after it closes can fall outside cover entirely. Read the notice clause of your own policy; do not generalise from another one.

Sources

Every statement about a court case on this page is drawn from the documents and reporting below. Links open on the publisher's own site.

• Columbia Casualty Co. v. Cottage Health System, complaint filed 7 May 2015 (copy via Internet Archive; docket available on PACER and CourtListener) Internet Archive
• Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016) Covington, Inside Privacy
• Travelers, policyholder agree to void current cyber policy (30 August 2022) Insurance Journal
• Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022) Lockton

Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015), refiled as No. 2:16-cv-03759 (C.D. Cal.); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill., stipulated judgment August 2022). Dockets are available on PACER and CourtListener.

Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship.

Related terms

Back to the glossary