Cyber, Aviation, and Other Specialty Lines
Key Takeaways
- Cyber liability splits into first-party coverage (the insured's own losses - breach response, business interruption, cyber extortion) and third-party coverage (liability to others for a data breach)
- Standard CGL and property forms largely exclude cyber via the ISO data-breach exclusion (CG 21 06/07/08 series), which is why standalone cyber policies exist
- Aviation insurance is a specialty manuscript line outside ISO; hull (physical damage) and liability are the core covers, and aircraft are excluded under standard CGL and commercial auto
- Other specialty lines tested include directors & officers (D&O), employment practices liability (EPLI), professional liability (E&O / malpractice), and umbrella/excess coverage that sits above primary limits
- Umbrella policies provide excess limits plus drop-down coverage for some claims excluded by underlying policies, subject to a self-insured retention (SIR)
Cyber Liability: First-Party vs. Third-Party
Standard property and CGL forms were never designed for data-driven losses. ISO added a data-breach exclusion (the CG 21 06 / 21 07 / 21 08 access-or-disclosure endorsements) that strips most cyber exposure out of the CGL, and property forms exclude electronic data as covered property. The result: a dedicated cyber liability policy.
Cyber coverage divides into two halves, and the exam expects you to sort a loss into the right one:
| First-Party (the insured's OWN losses) | Third-Party (liability TO others) |
|---|---|
| Breach-response costs (forensics, notification, credit monitoring) | Liability for failing to protect others' data |
| Business interruption from a network outage | Regulatory fines and defense (where insurable) |
| Cyber extortion / ransomware payments | Media/content liability (libel, IP) |
| Data restoration | Payment-card (PCI) assessments |
Quick Answer: Did the insured lose its own money/data (first-party) or get sued by someone else (third-party)? That single question routes most cyber claims.
Aviation Insurance: A Manuscript Specialty Line
Aircraft are excluded under both the standard CGL (aircraft, auto, watercraft exclusion) and commercial auto (an aircraft is not an 'auto'), so aviation insurance is its own specialty market written on manuscript (non-ISO) forms by specialist underwriters.
The two core aviation coverages parallel auto:
- Hull coverage - physical damage to the aircraft itself. Often split into in-motion and not-in-motion terms, and written on an agreed-value basis given the difficulty of valuing aircraft.
- Aviation liability - bodily injury and property damage to others, frequently split into passenger liability, public (non-passenger) liability, and property damage.
Limits are commonly written as a combined single limit (CSL) or with a per-passenger sublimit. Underwriting weighs pilot experience and ratings, aircraft type, and use (private, commercial, instructional). Ground risks and product/completed-operations for repair stations are handled by related aviation forms.
Management Liability and Professional Liability
Several specialty liability lines protect against exposures the CGL's bodily-injury/property-damage trigger never reaches - because these are financial-injury and wrongful-act claims:
- Directors & Officers (D&O) - protects the personal assets of directors and officers (and the entity) for alleged wrongful acts in managing the organization. Written on a claims-made basis.
- Employment Practices Liability (EPLI) - covers wrongful termination, discrimination, harassment, and retaliation claims by employees. The CGL excludes these.
- Professional Liability (Errors & Omissions / malpractice) - covers negligence in rendering professional services (accountants, agents, physicians, attorneys). The CGL excludes the rendering or failure to render professional services, which is why E&O is mandatory for many professionals.
Most of these are claims-made policies, so the retroactive date and the availability of an extended reporting period (tail) are recurring exam points - a claim is covered only if both the wrongful act (after the retro date) and the claim (during the policy or tail) fall within the right windows.
Cyber: First-Party vs. Third-Party
Cyber coverage splits into first-party loss (the insured's own costs: breach notification, forensics, business interruption, cyber extortion/ransomware, data restoration) and third-party liability (claims by customers/partners for a privacy breach, plus regulatory defense and fines where insurable). Standard property and CGL forms generally treat electronic data as intangible, so they do not cover a data breach — the gap cyber fills.
Aviation and Other Manuscript Lines
Aviation is a manuscript specialty line: hull (physical damage, in-motion/in-flight/not-in-motion), liability (passenger and third-party bodily injury/property damage), and admitted vs. non-admitted distinctions matter. Because exposures are large and unique, aviation, kidnap & ransom, and event cancellation are individually underwritten rather than ISO-standard.
Specialty-Line Recap
| Line | Core gap it fills |
|---|---|
| Cyber | Data breach, ransomware, privacy liability (excluded by CGL/property) |
| Aviation | Aircraft hull and aviation liability |
| Kidnap & ransom | Extortion/ransom and crisis response |
| Event cancellation | Lost revenue from a cancelled event |
| Difference in Conditions (DIC) | Fills gaps (flood/quake) the primary excludes |
The most-tested takeaway is the first-party vs. third-party split in cyber and the rule that standard forms exclude data-breach exposure, which is why a separate cyber policy — not a CGL endorsement — is the correct answer for a retailer worried about a customer-data hack.
A retailer suffers a ransomware attack. It pays $40,000 in extortion, loses $90,000 of income while systems are down, and is later sued by customers whose card data was stolen. Which classification is correct?
Umbrella and Excess Liability
When primary limits are inadequate, the insured buys umbrella or excess liability for catastrophic claims:
- Excess liability simply adds limits on top of a scheduled underlying policy and follows its terms (follow-form).
- Umbrella liability does more: it provides excess limits over underlying CGL, auto, and employers liability AND can drop down to cover some claims the underlying policy excludes - subject to a self-insured retention (SIR) the insured pays before umbrella coverage applies.
Worked example - umbrella over a CGL
A business carries a CGL with a $1,000,000 occurrence limit and a $5,000,000 umbrella. A liability judgment is $3,500,000. The CGL pays its $1,000,000 limit, and the umbrella pays the remaining $2,500,000 as excess. If instead the claim were a covered umbrella-only exposure that the CGL excluded, the insured first pays the SIR (say $10,000), then the umbrella responds - this drop-down feature is the key difference examiners test between a true umbrella and plain excess.
A business has a $1,000,000 CGL occurrence limit and a $5,000,000 commercial umbrella. A covered liability judgment totals $3,500,000. How is the judgment paid?