Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber, aviation, ocean marine, and umbrella/excess are stand-alone lines because the CGL and standard property forms exclude or cap these exposures.
- Cyber splits into first-party (insured's own breach/BI/ransomware costs) and third-party (liability/regulatory); most forms are claims-made with sublimits and an hours-based BI waiting period.
- Aviation uses agreed-value hull coverage and often split passenger/occurrence liability limits; the per-occurrence cap controls total payout.
- Ocean marine has four parts - Hull, Cargo, Freight, P&I - and uses General Average; TRIA/TRIPRA (through 2027) requires insurers to offer terrorism coverage above a certified-act threshold.
- An umbrella adds limits, drops down, and can broaden coverage over a self-insured retention; letting required underlying coverage lapse leaves the insured self-insured for that amount.
Why Specialty Lines Exist
Standard ISO commercial forms intentionally exclude or narrowly limit certain catastrophic or technical exposures - data breaches, aircraft, ocean cargo, terrorism, and umbrella-level severity. These exposures are placed in specialty (surplus and standard) lines with their own forms, triggers, and limits.
Quick Answer: Cyber, aviation, ocean marine, and umbrella/excess are stand-alone coverages because the CGL and standard property forms exclude or cap the underlying risk.
Many specialty placements occur in the surplus lines market (non-admitted carriers) when admitted insurers will not write the risk; the surplus lines broker must perform a diligent search of admitted markets first and the policy is not protected by the state guaranty fund.
Cyber Liability
The CGL excludes most data and electronic-information losses (the Access or Disclosure of Confidential or Personal Information exclusion and the electronic data exclusion), so cyber is written stand-alone. Cyber policies split into:
| Coverage | Pays For |
|---|---|
| First-party | The insured's own costs: breach response, forensics, notification, credit monitoring, business interruption, cyber-extortion/ransomware, data restoration |
| Third-party | Liability to others: privacy/network-security liability, regulatory fines/defense, media liability |
Most cyber forms are claims-made, written on stated sublimits (e.g., a $1M policy with a $250,000 ransomware sublimit and a 12-hour BI waiting period). Watch the trap: cyber business interruption uses a waiting-period (hours) retention, not a calendar deductible.
Aviation Insurance
Aircraft are excluded from the CGL (aircraft/auto/watercraft exclusion) and from personal auto/homeowners, so aviation is a specialty line. Core parts:
- Hull coverage - physical damage to the aircraft. Written as in-motion, not-in-motion, or all-risk ground and flight; valued on an agreed value basis.
- Aircraft liability - bodily injury and property damage to others, often split into passenger liability and public (non-passenger) liability.
- Admitted (medical) coverage - no-fault medical for occupants.
Worked Split-Limit Example
A policy reads $1,000,000 per passenger / $5,000,000 per occurrence, seating 6. After a crash injuring all 6 passengers with $1.4M of harm each, each claimant is capped at the $1M per-passenger limit = $6M demanded, but the $5M occurrence cap controls: the insurer pays $5,000,000 total, prorated among claimants. The per-seat and per-occurrence caps both apply, and the lower aggregate governs.
Ocean Marine, Inland Marine, and Terrorism
Ocean marine covers waterborne cargo and hulls and has four traditional parts: Hull, Cargo, Freight, and Protection & Indemnity (P&I) (liability). It is largely unregulated as to forms/rates and uses concepts like General Average (shared sacrifice) and particular average (partial loss to one interest).
Inland marine evolved from ocean marine to cover property in transit and floaters (jewelry, fine arts, contractors equipment) under the Nationwide Marine Definition.
Terrorism: the Terrorism Risk Insurance Act (TRIA), reauthorized through 2027 under TRIPRA, creates a federal backstop. Insurers must offer terrorism coverage; the program triggers only after a certified act exceeding a $5 million program threshold, with a $200 million aggregate industry trigger before federal sharing applies.
Umbrella and Excess Liability
A commercial umbrella sits above scheduled underlying policies (CGL, auto, employers liability) and does three things: (1) provides higher limits over the underlying, (2) drops down when underlying aggregates are exhausted, and (3) provides broader coverage for some claims the underlying excludes - subject to a self-insured retention (SIR).
| Feature | Umbrella | Excess (Following Form) |
|---|---|---|
| Limits | Adds limits over underlying | Adds limits only |
| Broader than underlying? | Yes (with SIR for gaps) | No - mirrors underlying |
| Drop-down | Yes | Generally no |
The insured must maintain required underlying limits; if they let underlying coverage lapse, the umbrella treats the insured as self-insured for that amount.
More Specialty Lines and Exam Traps
Several additional specialty exposures appear on the national portion:
- Difference in Conditions (DIC) - a broad all-risk form that fills gaps in a standard property program, often adding flood and earthquake the underlying policy excludes.
- Builders risk - inland-marine-style coverage for a structure under construction, typically written on a completed-value basis covering materials on site and in transit.
- Errors & Omissions (E&O) and Directors & Officers (D&O) - professional and management liability, almost always claims-made with a retroactive date that bars prior-acts claims.
Key specialty-line traps:
- Surplus lines carriers are non-admitted: not rate/form regulated by the state and not backed by the guaranty fund; the broker must document a diligent search of admitted markets first.
- A claims-made trigger requires the claim to be made during the policy period (after the retro date); an occurrence trigger requires the injury to happen during the period - confusing the two is a classic miss.
- An agreed value hull settlement pays the stated amount without depreciation - unlike an ACV property loss.
- TRIA's mandatory offer means the insurer must offer terrorism coverage, but the insured may reject it; the federal backstop only engages after a certified act exceeds the program thresholds.
Cyber, Aviation, and Specialty Coverage Gaps
Modern exposures created lines that fill gaps in traditional property and liability forms:
| Line | Covers |
|---|---|
| Cyber liability | First-party: breach response, notification, data restoration, business interruption, cyber-extortion. Third-party: liability for the insured's failure to protect data |
| Aviation hull & liability | Aircraft physical damage (hull) and bodily-injury/property-damage liability; excluded by CGL and PAP |
| Watercraft / yacht | Hull, P&I, and liability for larger boats excluded by homeowners |
| Surplus lines (E&S) | Hard-to-place/high-hazard risks placed with non-admitted insurers through surplus-lines brokers |
Surplus lines are written by non-admitted carriers when admitted markets decline a risk; they are not protected by the state guaranty fund, and the broker must hold a surplus-lines license and confirm a diligent admitted-market search.
Exam trap: Cyber policies provide both first-party (the insured's own breach costs) and third-party (liability to others) coverage - candidates often forget the first-party side (notification, restoration, extortion, business interruption). Surplus-lines (non-admitted) insurers are NOT backed by the state guaranty association, so an insolvency leaves policyholders unprotected; this is the key risk producers must disclose when placing E&S business in Mississippi.
A business is hit by ransomware and must pay forensic, notification, and extortion costs, plus loss of income while systems are down. Which cyber coverage segment responds to these costs of the insured's own organization?
A commercial umbrella sits above a CGL with a $1,000,000 limit. The insured lets the CGL lapse, and a covered $1,500,000 loss occurs. How does the umbrella respond?