--- title: "Has the Applicant experienced any partial or total network interruption lasting more than 8 hours?" url: https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than category: "Incident response and claims history" canonical_key: q_ir_006 evidence_state: attested updated: 2026-08-24 --- # Has the Applicant experienced any partial or total network interruption lasting more than 8 hours? URL: https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than Section: Incident response and claims history Evidence state: Attested, not tenant-verifiable This one is not about attacks. It asks how your business behaves when systems are unavailable, whatever the cause. ## What the carrier is actually asking The carrier is asking whether you have experienced a partial or total network interruption beyond a threshold, commonly eight hours, in the stated period. Cause is usually not limited: hardware failure, a provider outage, a failed change, or an attack all count. ## Why it is underwritten Business interruption cover is priced on how long you go down and what that costs. A history of extended outages, whatever the cause, indicates fragility that will apply equally in a cyber event. It also gives the underwriter a real data point about your resilience, rather than a plan. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Outage history comes from operational records, so this is attested. The cloud estate can show availability configuration that supports whichever answer you give. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Operations records | Incident and outage log for the period, with durations | Actual durations, including partial outages affecting a business unit. Attested | | Provider records | Cloud and telecommunications provider outage notifications | Third-party outages that affected you, which count and are often forgotten | | Azure | Availability zone and region design for critical workloads | Redundancy configuration, which is the forward-looking part of the answer | | Network | Redundant connectivity at critical sites | Single points of failure identified, since a single circuit is the most common cause of a long site outage | | Post-incident reviews | What was changed after each extended outage | Remediation, which turns a disclosed outage into evidence of learning | **Disclose with the remediation attached** An outage disclosed alongside what caused it and what changed afterwards reads as operational maturity. The same outage disclosed bare invites the underwriter to assume it could happen again tomorrow. ## What a defensible yes requires - The answer comes from operational records rather than memory. - Partial outages affecting significant business functions are included. - Provider-caused outages are included. - Each disclosed outage has a cause and a remediation. - Known single points of failure are identified, whether or not they have failed yet. ## How this answer goes wrong Only attack-related events are considered, so a two-day outage caused by a failed storage upgrade is omitted. The question does not usually limit cause, and that outage is exactly the resilience signal the underwriter is looking for. ## If this answer turns out to be wrong The claims and circumstances questions connect directly to the notice conditions in the policy, which have to be satisfied before the insurer owes anything at all. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what a condition precedent has to satisfy first](https://insuranceposture.com/glossary/condition-precedent). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Does a planned outage count? Usually not, if it was scheduled and communicated. A planned change that overran badly is a different matter and is worth disclosing with the explanation. ### Does a provider outage count? Yes, and it is worth disclosing with what you have changed since. Dependency on a single provider is a real exposure and carriers understand it. ### Will disclosure raise our premium? It can affect the business interruption terms. It also lets the carrier structure cover that matches your actual risk, which is the point of the exercise. ### What if we cannot reconstruct the history? Say what you can establish and how you established it. A qualified answer is defensible; an unqualified no that records contradict is not. ## Related questions - [Does the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually?](https://insuranceposture.com/questions/incident-response/applicant-written-business-continuity-plan-disaster-recovery-plan-tested) - [Estimated time to restore essential functions in widespread ransomware attack?](https://insuranceposture.com/questions/backup-and-recovery/estimated-time-restore-essential-functions-widespread-ransomware-attack) - [Has any service provider with access to Applicant's network sustained outage longer than 4 hours?](https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer) - [In last 3 years, any cyber event, claim, loss, security breach, or extortion demand?](https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.