{ "name": "Insurance by Profession Cyber Cover Requirement Rules", "title": "Cyber Cover Requirement Rules", "url": "https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/", "csv": "https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules.csv", "markdown": "https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/index.md", "computed_at": "2026-10-24", "license": "https://insurancebyprofession.com/terms", "headline": "The Cyber Cover Requirement Rules carries 7 published figures read from 2 sources' own pages, from 15 to 90 day, read 17 October 2026.", "quotes": [ "The Cyber Cover Requirement Rules carries 7 published figures read from 2 sources' own pages, from 15 to 90 day, read 17 October 2026.", "2 of the 8 named sources read in full publish a figure; 6 publish none, read 17 October 2026.", "Cyber Cover Requirement Rules, duty substitute-notice: median 90 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty toll-free-line: median 90 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty media-notice: median 60 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty notify-secretary-500-or-more: median 60 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty notify-secretary-under-500: median 60 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty business-associate-notice: median 60 day across 1 source, read 17 October 2026.", "Cyber Cover Requirement Rules, duty state-privacy-notification: median 15 day across 1 source, read 17 October 2026." ], "citation": "\"Insurance by Profession Cyber Cover Requirement Rules\", updated 2026-10-24, https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/.", "changed_since": null, "national": { "unit": "day", "n": 7, "median": 60, "min": 15, "max": 90, "p25": 60, "p75": 90, "mean": 62.1429, "units": { "day": 7 }, "published_sources": 2, "named_sources": 10, "read_sources": 8, "not_published": 6, "published_share": 0.25 }, "by_axis": { "duty": { "substitute-notice": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "toll-free-line": { "day": { "n": 1, "median": 90, "min": 90, "max": 90, "p25": 90, "p75": 90, "mean": 90 } }, "media-notice": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "notify-secretary-500-or-more": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "notify-secretary-under-500": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "business-associate-notice": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 } }, "state-privacy-notification": { "day": { "n": 1, "median": 15, "min": 15, "max": 15, "p25": 15, "p75": 15, "mean": 15 } } } }, "rows": [ { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "duty": "substitute-notice" }, "retrieved_at": "2026-10-17", "quote": "If the covered entity has insufficient or out-of-date contact information for 10 or more individuals, the covered entity must provide substitute individual notice by either posting the notice on the home page of its web site for at least 90 days or by providing the notice in major print or broadcast media where the affected individuals likely reside.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "duty": "toll-free-line" }, "retrieved_at": "2026-10-17", "quote": "The covered entity must include a toll-free phone number that remains active for at least 90 days where individuals can learn if their information was involved in the breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "duty": "media-notice" }, "retrieved_at": "2026-10-17", "quote": "Like individual notice, this media notification must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include the same information required for the individual notice.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "duty": "notify-secretary-500-or-more" }, "retrieved_at": "2026-10-17", "quote": "If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "duty": "notify-secretary-under-500" }, "retrieved_at": "2026-10-17", "quote": "Reports of breaches affecting fewer than 500 individuals are due to the Secretary no later than 60 days after the end of the calendar year in which the breaches are discovered.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "HHS HIPAA breach notification rule", "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "duty": "business-associate-notice" }, "retrieved_at": "2026-10-17", "quote": "A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.", "source_class": "primary-government", "text_sha256": "3eef4d61280cb31a61b5f3018dbc2758625b7c17c12307456b373ace1a12a7a4" }, { "source": "Alliance Risk: cyber insurance requirements", "url": "https://joinalliancerisk.com/cyber-insurance-requirements/", "figure": "15 days", "value": 15, "unit": "day", "vat": null, "axis": { "duty": "state-privacy-notification" }, "retrieved_at": "2026-10-12", "quote": "Notification: 15 days.", "source_class": "primary-provider-own-site", "text_sha256": "98fc3a7648e8c79258088dd3acd49d66a98a7841074196d056860d445d68c956" } ], "not_published": [ { "source": "FTC Gramm-Leach-Bliley Act guidance (Safeguards Rule)", "url": "https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act", "retrieved_at": "2026-10-24", "reason": "read in full and no accepted figure on the page" }, { "source": "California Attorney General: data security breach reporting", "url": "https://oag.ca.gov/privacy/databreach/reporting", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO: report a personal data breach", "url": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Data Protection Act 2018", "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents", "retrieved_at": "2026-10-24", "reason": "read in full and no accepted figure on the page" }, { "source": "OAIC notifiable data breaches scheme", "url": "https://www.oaic.gov.au/privacy/notifiable-data-breaches", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "OPC Canada: respond to a privacy breach at your business", "url": "https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html", "label": "HHS HIPAA breach notification rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act", "label": "FTC Gramm-Leach-Bliley Act guidance (Safeguards Rule)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://oag.ca.gov/privacy/databreach/reporting", "label": "California Attorney General: data security breach reporting", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/", "label": "ICO: report a personal data breach", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents", "label": "Data Protection Act 2018", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/notifiable-data-breaches", "label": "OAIC notifiable data breaches scheme", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/", "label": "OPC Canada: respond to a privacy breach at your business", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.dfs.ny.gov/industry-regulation/cybersecurity", "label": "NYDFS cybersecurity (23 NYCRR Part 500)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf", "label": "NYDFS Part 500 second amendment (PDF)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://joinalliancerisk.com/cyber-insurance-requirements/", "label": "Alliance Risk: cyber insurance requirements", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 8 named sources that could be read published a usable figure; 6 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 7 figures, never sentences; 16 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per duty - who is covered, the notification deadline, the penalty ceiling, and any control the regulator mandates - quoted verbatim from the authority with its effective date; joined to the contract minimums brokers publish, it gives the minimum defensible limit per buyer type, which is the question 'how much do I need' actually asks; changed-since each amendment", "embed": "

15 to 90 day

7 published figures, Cyber Cover Requirement Rules, across 2 sources, read 17 October 2026

Source: Insurance by Profession Cyber Cover Requirement Rules
" }