16.3 Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Standard CGL excludes electronic data and privacy claims, so cyber liability is written stand-alone on a claims-made basis with first-party (notification, ransomware, business interruption) and third-party (lawsuits, regulatory) coverage.
- Sublimits cap specific perils (e.g., cyber extortion) below the policy aggregate; settlement is the lesser of the loss or sublimit, minus the deductible.
- Aviation hull coverage is written In-Motion, Not-In-Motion, or All-Risk Ground and Flight; liability is often split between passenger and non-passenger exposures.
- Split limits cap each injured person at the per-person figure before the per-occurrence cap applies (e.g., 100/300/100).
- Specialty lines exist because standard forms exclude the exposure: DIC adds flood/earthquake, ocean and inland marine cover transit, E&O covers professional acts, and D&O covers management liability.
Cyber Liability Coverage
Standard CGL and commercial property forms do not adequately address data breaches. The ISO CGL excludes electronic data as "property" under Coverage A, and the Access or Disclosure of Confidential or Personal Information exclusion (added broadly in 2014) bars privacy-related claims under Coverage B. That gap is filled by a stand-alone cyber liability policy, written on a claims-made basis with a retroactive date like other professional lines.
Cyber policies split coverage into two halves that exams contrast:
- First-party coverage — Pays the insured's own costs: forensic investigation, breach notification to affected individuals, credit monitoring, public relations, data restoration, cyber extortion / ransomware payments, and business interruption from a network outage.
- Third-party (liability) coverage — Pays defense and damages owed to others: lawsuits by customers whose data was exposed, regulatory fines and penalties where insurable, and media/content liability.
A worked sublimit example: A retailer carries a $1,000,000 cyber policy with a $250,000 sublimit on cyber extortion and a $10,000 deductible. A ransomware demand of $300,000 is paid. The insurer pays the lesser of the demand or the sublimit, minus the deductible: $250,000 − $10,000 = $240,000; the insured absorbs the remaining $60,000 of the demand plus the deductible. Watch for stems where the demand exceeds a sublimit even though the policy aggregate is far higher.
Because cyber is claims-made, two dates govern coverage. The retroactive date sets the earliest point a wrongful act can have occurred and still be covered; an act before it is excluded even if the claim arrives during the policy period. The extended reporting period (ERP), or tail, lets the insured report claims after expiration for acts that occurred before it. Producers should also distinguish cyber from a technology E&O policy: cyber responds to data breaches and network failures of the insured's own system, while tech E&O responds to a software or IT vendor's failure to deliver a contracted service to a client.
Aviation Insurance
Aircraft are excluded under both the Personal Auto Policy and the CGL, so aviation risks require specialty coverage written by aviation underwriting pools. The two principal coverage parts mirror auto:
- Hull coverage — First-party physical damage to the aircraft. Written three ways tested on exams: In-Motion (loss while taxiing or in flight), Not-In-Motion (loss while parked/at rest), and All-Risk Ground and Flight (broadest, covers both).
- Liability coverage — Bodily injury and property damage to others. Aviation liability is frequently split into admitted (passenger) liability versus non-passenger (public) liability, and limits are often shown as split limits or a single limit.
A split-limit hull-and-liability worked problem: A policy reads 100/300/100 for non-passenger liability and a $1,500,000 hull value. After a runway excursion injures two bystanders ($120,000 and $90,000) and destroys the aircraft, liability pays $120,000 + $90,000 = $210,000, within the $300,000 per-occurrence cap and with each claimant under the $100,000 per-person cap.
The hull then pays up to the $1,500,000 agreed value less the hull deductible. A common trap: each injured person is capped at the per-person figure ($100,000) before the per-occurrence cap even applies, so a single $150,000 injury would recover only $100,000.
Other Specialty Lines to Recognize
The national exam expects you to match these niche products to their exposure:
| Specialty line | What it covers | Trigger / note |
|---|---|---|
| Ocean marine | Hull, cargo, freight, and Protection & Indemnity (P&I) liability on the open seas | Includes general average and sue-and-labor clauses |
| Inland marine | Property in transit, instrumentalities of transportation, and movable/floater property | Grew from the "nationwide marine definition" |
| Umbrella / excess liability | Coverage above primary limits, plus some drop-down coverage | Requires a self-insured retention (SIR) where primary does not respond |
| Difference in Conditions (DIC) | Broadens standard property by adding flood and earthquake | Wraps around an underlying property policy |
| Errors & Omissions (E&O) | Professional negligence for non-medical professionals | Claims-made with retroactive date |
| Directors & Officers (D&O) | Liability of corporate management for wrongful acts | Often paired with EPLI |
The recurring theme across specialty lines is that they exist precisely because a standard form excludes the exposure — flood and earthquake (DIC), aircraft and watercraft (aviation/ocean marine), professional acts (E&O), and electronic data (cyber). When a stem describes an exposure a homeowners or CGL form would bar, the correct answer is almost always the matching specialty product.
A few numeric and structural points recur on the exam. An umbrella sits above primary auto, CGL, and employer's liability limits; where the primary policy does not respond to a covered claim, the umbrella drops down but the insured must first satisfy a self-insured retention (SIR), commonly $10,000.
Ocean marine policies remain partly governed by admiralty (maritime) law and the centuries-old principle of general average, under which all parties to a sea venture share proportionally in a loss voluntarily incurred to save the whole — a concept unique to marine coverage.
Finally, both E&O and D&O are claims-made and almost always include defense within limits, meaning legal costs erode the policy limit rather than being paid in addition to it. That erosion feature is a frequent distractor: candidates assume defense is always supplementary, as it is under the occurrence-based CGL, but on these professional and management lines it usually is not.
A business holds a $1,000,000 cyber liability policy with a $250,000 cyber-extortion sublimit and a $10,000 deductible. It pays a $300,000 ransomware demand. How much does the insurer reimburse?
Which specialty coverage is purpose-built to broaden a standard commercial property policy by adding flood and earthquake perils?