16.3 Cyber, Aviation, and Other Specialty Lines

Cyber Insurance

Standard CGL and property policies were never designed for data breaches; ISO even added the CG 21 06 exclusion barring coverage for access-to/disclosure-of confidential information. Dedicated cyber policies fill the gap and split coverage into two buckets:

• First-party cyber: the insured's own losses — breach notification, forensics, data restoration, business interruption / extra expense, cyber extortion (ransomware), and public relations.
• Third-party cyber: liability to others — privacy liability, regulatory fines and penalties, network security liability, and media/content liability.

Trap: cyber policies are written on a claims-made basis with a retroactive date; a breach that occurred before the retro date is not covered even if the claim is filed during the policy period.

Cyber Sublimits Worked Example

Cyber policies layer sublimits and a retention (deductible) under the aggregate limit. Suppose a policy has a $1,000,000 aggregate, a $250,000 ransomware sublimit, and a $25,000 retention.

A ransomware event causes:

• Ransom payment: $200,000
• Forensics and restoration: $120,000
• Business interruption: $90,000

The ransom is capped at the $250,000 sublimit, so all $200,000 is eligible. Forensics and BI fall under the full aggregate. Total eligible = $410,000, less the $25,000 retention = $385,000 paid, well under the $1,000,000 aggregate. The sublimit, not the aggregate, is the operative cap on the ransom piece.

Aviation Insurance

Aircraft are excluded from personal auto and most CGL forms, so they need a dedicated aviation policy. Coverage parts mirror auto but use aviation terminology:

• Single limit vs. split limit: aviation liability is often written as a Combined Single Limit (CSL) or split as BI/PD with a per-passenger sublimit, e.g., $1,000,000 each occurrence with a $100,000 each-passenger limit.
• Warranties matter: pilot qualification and airworthiness warranties can void coverage if breached.

Aviation Split-Limit Worked Example

A policy reads $1,000,000 each occurrence / $100,000 each passenger for admitted liability. A crash injures 6 passengers, each with $90,000 of damages (total $540,000).

• Per-passenger cap: $100,000 — each $90,000 claim is fully within it.
• Occurrence cap: $1,000,000 — total $540,000 is within it.
• All $540,000 is payable.

Now suppose 8 passengers each suffer $150,000 (total $1,200,000). Per passenger is capped at $100,000 → 8 × $100,000 = $800,000, and the occurrence cap of $1,000,000 is not reached. $800,000 payable — the per-passenger limit binds first.

Other Specialty Lines

• Boiler & Machinery / Equipment Breakdown (ISO): covers sudden mechanical or electrical breakdown of pressure vessels, boilers, and equipment — perils property forms exclude. Includes inspection services.
• Professional liability (E&O / D&O): claims-made coverage for negligent acts in rendering professional services or directors'/officers' decisions; no bodily-injury requirement.
• Employment Practices Liability (EPLI): wrongful termination, discrimination, harassment.
• Difference in Conditions (DIC): fills gaps — often adds flood and earthquake to a property program.
• Surplus lines: non-admitted carriers writing hard-to-place risks; placed by a surplus lines broker with a diligent-search affidavit; not protected by the state guaranty fund.

Trap: surplus lines policyholders cannot turn to the guaranty association if the non-admitted insurer becomes insolvent.

Claims-Made vs. Occurrence on Specialty Forms

Many specialty lines — cyber, E&O, D&O, and EPLI — are written claims-made, while CGL and most property forms are occurrence. The distinction decides which policy responds:

• Occurrence: the policy in force when the injury or damage happens responds, even if the claim arrives years later.
• Claims-made: the policy in force when the claim is made responds, provided the wrongful act occurred on or after the retroactive date.

When a claims-made policy is replaced or the insured retires, an Extended Reporting Period (ERP), or tail, lets claims filed after expiration still attach to the expired policy. A consultant who switches carriers without buying tail coverage and without matching the prior retroactive date can create a coverage gap for old work — a frequently tested fact pattern. Equipment Breakdown and DIC, by contrast, are property-style forms triggered by the event itself, not the claim.

Equipment Breakdown Worked Example and Admitted-Market Notes

Equipment Breakdown fills the gap left by the property policy's exclusion of mechanical/electrical breakdown. Suppose a manufacturer's transformer suffers an internal electrical arc:

• Transformer repair: $60,000
• Spoiled raw materials from the outage: $15,000
• Business income lost during 5-day shutdown: $40,000
• Equipment Breakdown deductible: $10,000

The form covers the breakdown plus resulting property damage, spoilage, and business income. Total covered = $60,000 + $15,000 + $40,000 = $115,000, less the $10,000 deductible = $105,000 paid — losses the standard property form would have denied as wear/breakdown.

When placing any specialty coverage, agents must confirm whether the carrier is admitted (rate/form filed with the state, backed by the guaranty fund) or non-admitted/surplus lines (greater flexibility, surplus-lines tax, no guaranty-fund backstop). Disclosing this status to the insured is both an exam point and a real-world duty.