# How much cyber liability insurance do i need (7 figures)

> The Cyber Cover Requirement Rules carries 7 published figures read from 2 sources' own pages, from 15 to 90 day, read 17 October 2026.

Insurance by Profession · https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/ · computed 2026-10-24

**Range of the published figures:** 15 to 90 day (range 15 to 90 day; 7 published figures; 2 of 8 sources read publish one).

2 of the 8 named sources read in full publish a figure; 6 publish none, read 17 October 2026.

## By duty

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| duty substitute-notice | 90 day | 90 to 90 day | 1 |
| duty toll-free-line | 90 day | 90 to 90 day | 1 |
| duty media-notice | 60 day | 60 to 60 day | 1 |
| duty notify-secretary-500-or-more | 60 day | 60 to 60 day | 1 |
| duty notify-secretary-under-500 | 60 day | 60 to 60 day | 1 |
| duty business-associate-notice | 60 day | 60 to 60 day | 1 |
| duty state-privacy-notification | 15 day | 15 to 15 day | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 90 day | substitute-notice | 2026-10-17 |
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 90 day | toll-free-line | 2026-10-17 |
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 60 day | media-notice | 2026-10-17 |
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 60 day | notify-secretary-500-or-more | 2026-10-17 |
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 60 day | notify-secretary-under-500 | 2026-10-17 |
| [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) | 60 day | business-associate-notice | 2026-10-17 |
| [Alliance Risk: cyber insurance requirements](https://joinalliancerisk.com/cyber-insurance-requirements/) | 15 day | state-privacy-notification | 2026-10-12 |

## The sentence each figure was read from (7)

- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "If the covered entity has insufficient or out-of-date contact information for 10 or more individuals, the covered entity must provide substitute individual notice by either posting the notice on the home page of its web site for at least 90 days or by providing the notice in major print or broadcast media where the affected individuals likely reside."
- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "The covered entity must include a toll-free phone number that remains active for at least 90 days where individuals can learn if their information was involved in the breach."
- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "Like individual notice, this media notification must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include the same information required for the individual notice."
- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach."
- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "Reports of breaches affecting fewer than 500 individuals are due to the Secretary no later than 60 days after the end of the calendar year in which the breaches are discovered."
- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), read 2026-10-17: "A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach."
- [Alliance Risk: cyber insurance requirements](https://joinalliancerisk.com/cyber-insurance-requirements/), read 2026-10-12: "Notification: 15 days."

## Read in full, publishes no figure

- [FTC Gramm-Leach-Bliley Act guidance (Safeguards Rule)](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), read 2026-10-24: read in full and no accepted figure on the page
- [California Attorney General: data security breach reporting](https://oag.ca.gov/privacy/databreach/reporting), read 2026-09-12: read in full and no accepted figure on the page
- [ICO: report a personal data breach](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/), read 2026-10-17: read in full and no accepted figure on the page
- [Data Protection Act 2018](https://www.legislation.gov.uk/ukpga/2018/12/contents), read 2026-10-24: read in full and no accepted figure on the page
- [OAIC notifiable data breaches scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches), read 2026-09-11: read in full and no accepted figure on the page
- [OPC Canada: respond to a privacy breach at your business](https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/), read 2026-09-26: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 8 named sources that could be read published a usable figure; 6 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 7 figures, never sentences; 16 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per duty - who is covered, the notification deadline, the penalty ceiling, and any control the regulator mandates - quoted verbatim from the authority with its effective date; joined to the contract minimums brokers publish, it gives the minimum defensible limit per buyer type, which is the question 'how much do I need' actually asks; changed-since each amendment

## Sources

- [HHS HIPAA breach notification rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html) (the publisher's own terms; quoted for reporting and comment)
- [FTC Gramm-Leach-Bliley Act guidance (Safeguards Rule)](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act) (the publisher's own terms; quoted for reporting and comment)
- [California Attorney General: data security breach reporting](https://oag.ca.gov/privacy/databreach/reporting) (the publisher's own terms; quoted for reporting and comment)
- [ICO: report a personal data breach](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/) (the publisher's own terms; quoted for reporting and comment)
- [Data Protection Act 2018](https://www.legislation.gov.uk/ukpga/2018/12/contents) (the publisher's own terms; quoted for reporting and comment)
- [OAIC notifiable data breaches scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches) (the publisher's own terms; quoted for reporting and comment)
- [OPC Canada: respond to a privacy breach at your business](https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/) (the publisher's own terms; quoted for reporting and comment)
- [NYDFS cybersecurity (23 NYCRR Part 500)](https://www.dfs.ny.gov/industry-regulation/cybersecurity) (the publisher's own terms; quoted for reporting and comment)
- [NYDFS Part 500 second amendment (PDF)](https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf) (the publisher's own terms; quoted for reporting and comment)
- [Alliance Risk: cyber insurance requirements](https://joinalliancerisk.com/cyber-insurance-requirements/) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Cyber Cover Requirement Rules carries 7 published figures read from 2 sources' own pages, from 15 to 90 day, read 17 October 2026.
- 2 of the 8 named sources read in full publish a figure; 6 publish none, read 17 October 2026.
- Cyber Cover Requirement Rules, duty substitute-notice: median 90 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty toll-free-line: median 90 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty media-notice: median 60 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty notify-secretary-500-or-more: median 60 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty notify-secretary-under-500: median 60 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty business-associate-notice: median 60 day across 1 source, read 17 October 2026.
- Cyber Cover Requirement Rules, duty state-privacy-notification: median 15 day across 1 source, read 17 October 2026.

Cite as: "Insurance by Profession Cyber Cover Requirement Rules", updated 2026-10-24, https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/.

CSV: https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules.csv
JSON: https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules.json
Embed (plain HTML, static link back): see https://insurancebyprofession.com/datasets/cyber-cover-requirement-rules/#median