Westlands
Cyber Insurance in Kenya – Cyber Liability, Ransomware & Data Breach Cover
Protect your business against the financial consequences of cyber attacks, data breaches, ransomware, cyber crime, and digital security incidents.
A cyber attack can do far more than damage a computer. It can interrupt your operations, expose confidential customer information, corrupt or destroy data, trigger legal claims, create regulatory obligations, and result in significant recovery expenses.
Cyber liability insurance, cyber risk insurance & cyber security insurance in Kenya.
Protection tailored for data exposure, technology dependence, and industry exposures.
Expert guidance from Oakman Insurance Agency to determine appropriate policy limits.
What is Cyber Insurance?
Commercial Risk SafeguardCyber insurance (also known as cyber liability insurance, cyber risk insurance, or cyber security insurance in Kenya) is a commercial insurance policy designed to protect a business against specified financial losses, expenses, and liabilities arising from covered cyber events.
Unlike conventional property or general liability policies, a dedicated cyber insurance policy in Kenya is specifically engineered around risks associated with computer systems, networks, electronic data, digital operations, privacy regulations, and cyber-related liability.
Cyber Incident & Forensic Investigation
Data & System Restoration Expenses
Business Interruption & Revenue Losses
Cyber Extortion & Ransomware Losses
Data Breach Response & Customer Notification
Legal Defence & Privacy Liability Claims
Regulatory Investigations & Compliance Fines
Crisis Management & Public Relations
BEC & Social Engineering Cyber Crime
Third-Party Network Security Liability
Tailored Policy Extensions:
The precise scope of protection depends on the insurer, exact policy wording, selected sub-limits, deductibles, exclusions, and specific policy extensions purchased. Oakman Insurance Agency structures policies to reflect your business's specific digital risk profile.
What is Cyber Insurance?
Commercial Risk SafeguardCyber insurance (also known as cyber liability insurance, cyber risk insurance, or cyber security insurance in Kenya) is a commercial insurance policy designed to protect a business against specified financial losses, expenses, and liabilities arising from covered cyber events.
Unlike conventional property or general liability policies, a dedicated cyber insurance policy in Kenya is specifically engineered around risks associated with computer systems, networks, electronic data, digital operations, privacy regulations, and cyber-related liability.
Cyber Incident & Forensic Investigation
Data & System Restoration Expenses
Business Interruption & Revenue Losses
Cyber Extortion & Ransomware Losses
Data Breach Response & Customer Notification
Legal Defence & Privacy Liability Claims
Regulatory Investigations & Compliance Fines
Crisis Management & Public Relations
BEC & Social Engineering Cyber Crime
Third-Party Network Security Liability
Tailored Policy Extensions:
The precise scope of protection depends on the insurer, exact policy wording, selected sub-limits, deductibles, exclusions, and specific policy extensions purchased. Oakman Insurance Agency structures policies to reflect your business's specific digital risk profile.
Cyber Insurance and Cyber Security Are Not the Same
Critical Risk DistinctionUnderstanding the distinction between IT controls and financial risk transfer is vital for business leadership. While cyber security in Kenya builds technical defenses to prevent intrusions, cyber insurance provides the financial safety net when a breach or system failure inevitably occurs.
Cyber Security Protects Your Systems
Technical controls, safeguards, and protocols deployed to prevent unauthorized digital access, malware infections, and data loss:
- Firewalls & network perimeter security
- Antivirus & endpoint detection/response (EDR)
- Multi-factor authentication (MFA) & access controls
- Secure offline & immutable backups
- Data encryption at rest and in transit
- Employee security awareness & phishing training
- Vulnerability management & patch controls
Cyber Insurance Protects the Business Financially
Financial risk transfer policy that absorbs crippling operational, legal, and recovery expenses after a covered cyber event:
- Forensic IT investigations & breach discovery
- Specialized legal advice & regulatory compliance
- Data restoration & system rebuild costs
- Business interruption revenue loss recovery
- Customer breach notification & credit monitoring
- Cyber extortion response & negotiation costs
- Third-party privacy liability claims & defense
Cyber Insurance Does Not Replace Cyber Security Controls:
Cyber insurance is designed to complement—not replace—strong IT defenses. Insurers in Kenya thoroughly assess your existing cyber-security posture (such as active MFA implementation and backup protocols) before issuing terms, and may incorporate minimum security warranties into the policy wording. Oakman Insurance Agency guides you through pre-underwriting IT assessments to ensure compliance.
What Does Cyber Insurance Cover in Kenya?
First-Party & Third-Party ProtectionA comprehensive cyber insurance policy in Kenya combines first-party financial protection (covering your own immediate operational losses and recovery expenses) with third-party liability protection (covering legal claims and regulatory actions brought against your business). Specific scope depends on the insurer, wording, and extensions selected.
1
Cyber Incident Response & Forensics
Engages specialized forensic experts after a breach to investigate technical root causes and contain threats:
- Determining attack vector & breach origin
- Identifying affected systems & compromised data
- Detecting residual malware inside the network
- Executing emergency incident containment protocols
2
Data Breach Response & Legal Obligations
Absorbs costs incurred when confidential, personal, or financial information is accessed or stolen.
- Legal counsel & breach notification expenses
- Crisis management & public relations expenses
- Customer communication & identity monitoring
ODPC Kenya Statutory Compliance: Kenya's Data Protection Act (Section 43) mandates that data controllers notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of a breach posing real risk of harm.
3
Ransomware & Cyber Extortion Cover
Responds to incidents where cyber criminals encrypt network assets or threaten data disclosure for money.
- Extortion response & specialist negotiation fees
- Data restoration & ransom payments (where lawful)
- Resulting business interruption income loss
Policy Note: Ransom payments are not automatically covered and require strict underwriting compliance, sub-limits, and legal approvals.
4
Data & System Restoration
Covers reasonable costs associated with repairing, restoring, or recreating corrupted, encrypted, or destroyed digital assets:
- Corporate databases, files & electronic records
- Proprietary software & business applications
- Core operational network systems
5
Business Interruption Cyber Insurance
Reimburses lost income and extra operational expenses if a covered cyber attack halts business operations (e.g., an e-commerce platform shut down by ransomware):
- Lost net profit during operational downtime
- Continuing fixed operating costs & payroll
- Increased cost of working to minimize disruption
6
Dependent / Contingent Business Interruption
Protects your revenue if a major third-party technology vendor suffers a cyber outage that paralyzes your operations:
- Cloud providers & hosting infrastructure
- Payment processors & API gateways
- Managed Service Providers (MSPs) & ISPs
7
Network Security Liability Insurance
Defends against legal claims if your compromised network security causes damage to third parties (e.g., your servers accidentally propagate malware to a client's system):
- Third-party legal defense & attorney fees
- Court-ordered settlements & judgments
8
Privacy Liability Insurance
Protects against lawsuits brought by individuals (customers, employees, patients, students) whose private records were exposed in a security lapse:
- Customer & employee privacy breach lawsuits
- Defense costs & damages for breach of confidentiality
9
Regulatory Investigation & Defense
Responds to formal inquiries and proceedings initiated by regulatory authorities (such as the ODPC) following a data exposure incident:
- Legal representation for regulatory hearings
- Regulatory investigation & defense costs
- Insurable administrative fines (where permitted under Kenyan law)
10
Cyber Crime & Computer Fraud Cover
Specific extensions protecting against direct financial theft resulting from fraudulent electronic manipulation:
- Computer fraud & funds-transfer fraud
- Electronic theft & unauthorized wire transfers
- Phishing & social engineering financial losses
11
Business Email Compromise (BEC) Insurance
Safeguards against sophisticated social engineering scams where hackers impersonate executives or vendors:
- Fraudulent supplier bank account change scams
- Executive impersonation (CEO/MD fraud)
- Fake invoice scams & compromised employee emails
Important Verification: BEC cover must be explicitly verified and added via endorsement; it is not automatic in basic cyber policies.
12
Crisis Management & Reputation Protection
Funds professional communications specialists to preserve customer trust and mitigate brand damage following a major breach:
- Crisis public relations & media management
- Stakeholder & customer communication campaigns
- Brand restoration & reputation mitigation
13
Cyber Media Liability Insurance
Protects businesses publishing online content (websites, blogs, social media) against digital publishing liabilities:
- Online defamation, libel & slander claims
- Digital copyright & intellectual property infringement
- Online privacy violations in digital publishing
What Types of Cyber Attacks Can Cyber Insurance Respond To?
Threat Matrix ResponseDepending on the specific policy wording, sub-limits, and endorsements selected, a commercial cyber security insurance policy in Kenya can absorb financial losses, recovery costs, and legal liabilities arising from a wide spectrum of digital attack vectors targeting businesses in Kenya:
Ransomware Insurance Kenya
Responds when malicious extortion software encrypts critical servers or data databases, and cyber criminals demand payment to restore system access or prevent data destruction.
Malware Infections
Covers IT remediation and forensic cleanup when malicious code, spyware, or trojans infect corporate computers, local servers, or cloud networks.
Phishing Attacks
Protects against losses when criminals use deceptive emails, fake login portals, or malicious messages to harvest login credentials or gain unauthorized network access.
Spear Phishing
Responds to highly targeted, customized phishing campaigns crafted specifically around high-value individuals, key executives, or finance managers within an organization.
BEC Insurance Kenya
Helps recover financial losses when criminals hijack executive email accounts or spoof vendor identities to trick staff into transferring funds to fraudulent accounts.
Social Engineering Fraud
Covers direct financial theft resulting from psychological manipulation where staff are tricked into bypassing security controls or authorizing fraudulent transactions.
Data Breach Insurance Kenya
Absorbs legal fees, forensic costs, customer notification expenses, and regulatory proceedings when protected personal or commercial records are stolen or leaked.
Denial-of-Service (DDoS)
Reimburses lost income and IT restoration expenses when attackers flood servers or web applications with traffic to paralyze transactional availability.
Network Intrusion
Responds when unauthorized individuals breach firewalls, exploit software vulnerabilities, or gain unauthorized access to internal corporate networks.
Cyber Extortion
Provides expert crisis management and negotiation support when criminals threaten to disrupt operations or release confidential data unless extortion demands are met.
Tailoring Coverage Extensions for Your Risk Profile:
Not every cyber insurance policy covers all 10 attack vectors automatically. Social engineering, BEC, and funds-transfer fraud frequently require specific policy endorsements or cyber crime insurance in Kenya extensions. Oakman Insurance Agency reviews your digital operations to ensure your policy covers the exact threats your business faces.
Who Needs Cyber Insurance in Kenya?
Universal Digital ProtectionCyber insurance in Kenya is not limited to tech startups or IT companies. Any commercial enterprise, non-profit, or professional practice that relies on computers, cloud software, mobile applications, online banking, email communications, digital payment gateways, or customer data storage carries real cyber exposure.
Data Breach Expenses
Covers legal fees, breach investigation costs, customer notification, and credit monitoring expenses following data exposure.
Business Interruption
Reimburses lost net income, ongoing fixed operational expenses, and payroll while systems are offline.
Data Restoration
Pays reasonable costs required to repair, rebuild, or restore corrupted databases, accounting files, and business software.
Legal Defense Costs
Covers specialized legal defense, regulatory investigation representation, and third-party privacy liability claims.
Cyber Extortion
Provides expert crisis management, negotiation support, and extortion response when ransomware strikes.
Incident Response Costs
Funds 24/7 IT forensic investigators, system containment specialists, and public relations crisis advisors.
Industry-Specific Cyber Insurance Exposure in Kenya
Tailored Sector CoverageEvery commercial sector carries distinct digital liability profiles, regulatory obligations, and technological dependencies. Oakman Insurance Agency structures sector-specific cyber insurance policies in Kenya aligned with your industry's operational realities.
Technology & Software Firms
Tech companies have complex exposures because they host sensitive client data, manage cloud software, connect directly to corporate networks, and deploy SaaS products.
- Managed Service Providers (MSPs) & Cloud Hosting
- Software Developers & SaaS Solutions
Cyber Liability vs. Technology E&O:
Tech businesses must evaluate Cyber Liability alongside Professional Indemnity / Tech Errors & Omissions (E&O). These policies cover distinct yet overlapping risks and should be reviewed together.
Banks, SACCOs & Fintechs
Financial institutions rely heavily on digital transactions, customer databases, mobile apps, online banking portals, and M-Pesa payment gateways. They require rigorous underwriting and higher policy limits.
- Digital Payment Platforms & Mobile Banking
- High-Value Electronic Funds Transfer Exposure
Law Firms & Legal Practices
Law firms store highly confidential client records, corporate contracts, M&A documents, financial details, and intellectual property—making them prime targets for cyber criminals.
- Complements Professional Indemnity Insurance
- Protects Client Data Confidentiality & Privilege
Accountants & Audit Practices
Accounting practices, audit firms, and consultancies increasingly manage electronic client tax filings, financial statements, and cloud databases that carry substantial regulatory liabilities.
- Cloud Accounting System Cyber Interruption
- Protection Against Client Data Extortion
Healthcare Providers & Clinics
Hospitals, diagnostic clinics, laboratories, and pharmacies process sensitive patient health records and depend on digital systems for operations and billing.
- Patient Records & Medical Billing Systems
- Appointment & Lab Systems Business Interruption
E-Commerce & Digital Merchants
Online stores depend completely on active web portals, payment gateways, delivery integrations, and customer databases. An outage halts sales instantly.
- Immediate Revenue Loss & Business Interruption
- Payment Gateway & Cloud Host Outage Cover
Schools & Educational Institutions
Schools, colleges, and universities maintain vast databases of student records, parent contact details, employee payrolls, fee payments, and academic files.
- Student & Employee Personal Data Breach Cover
- Ransomware & Fee Management Portal Protection
NGOs & Non-Profit Organizations
Non-governmental organizations, membership associations, and donor agencies process significant personal, financial, and confidential field data carrying strict ODPC compliance obligations.
- Donor & Beneficiary Data Privacy Safeguards
- Regulatory Defense & Breach Response Expenses
Cyber Insurance, Data Protection & Policy Structure in Kenya
Regulatory & Insurance Alignment
What is the Difference Between Cyber Insurance and Cyber Crime Insurance?
While often used interchangeably, Cyber Liability Insurance and Cyber Crime Insurance address different financial risks. Do not assume a standard cyber liability policy automatically covers every financial crime.
Cyber Insurance / Cyber Liability
Focuses primarily on operational losses, data compromise, system outages, and third-party liabilities resulting from cyber attacks:
- Data breach investigation & customer notifications
- Network security & privacy liability defense
- Business interruption income recovery
- Data restoration & ransomware extortion response
Cyber Crime Insurance Extension
Focuses specifically on direct financial losses caused by dishonest electronic activity and social engineering scams:
- Computer fraud & fraudulent system access
- Funds-transfer fraud & unauthorized wire transfers
- Social engineering fraud & BEC (executive spoofing)
- Electronic theft & fraudulent invoice scams
Cyber Insurance vs Professional Indemnity Insurance
Professional Indemnity (PI)
Responds to financial losses suffered by clients due to professional negligence, errors, omissions, or breach of professional duty in rendering advice or services.
Cyber Insurance
Addresses specific external or internal cyber security events, data breaches, system interruptions, and associated first-party and third-party operational losses.
Structuring Dual Coverage for Technology & Professional Firms:
For technology developers, law firms, consultancies, financial institutions, and medical practices, Professional Indemnity and Cyber Insurance address different but complementary risks. Oakman Insurance Agency assists in reviewing both policies together to eliminate coverage gaps and avoid duplicate deductibles.
What is Not Covered by Cyber Insurance?
Standard Policy ExclusionsCyber insurance is an essential risk transfer mechanism, but it is not an unlimited guarantee against every digital or operational loss. Insurers incorporate standard policy exclusions, sub-limits, and minimum security conditions into policy wordings in Kenya.
Prior Known Incidents
Losses originating from vulnerabilities, ongoing intrusions, or compromised systems that were already known to the business prior to policy inception.
Deliberate or Fraudulent Acts
Wilful, criminal, malicious, or illegal acts committed directly by the insured company, its directors, or executive officers.
Contractual Liabilities
Assumed liabilities or financial guarantees under commercial contracts that exceed standard legal obligations in the absence of such agreements.
Infrastructure & Hardware Failures
General telecommunication outages, widespread power grid failures, or mechanical wear and tear not caused by a targeted cyber attack.
Unencrypted or Unprotected Systems
Losses occurring when mandatory policy conditions—such as active Multi-Factor Authentication (MFA), patch protocols, or backups—are breached.
Losses Outside Policy Period
Incidents occurring or claims formally lodged outside the active policy term, retroactive date, or extended reporting period specified in the schedule.
Excluded Territories & Sanctions
Operations, servers, or business activities located in trade-sanctioned jurisdictions or international regions explicitly excluded under policy terms.
War & Cyber Warfare Exclusions
Hostile cyber operations directly launched or declared as acts of war by sovereign nations or state-sponsored military entities.
Losses Exceeding Policy Limits
Financial claims, recovery expenses, or extortion demands that exceed the aggregate sum insured or specific sub-limits set in the policy.
Deductibles & Self-Insured Retentions
The initial portion of any financial loss or business interruption period falling within the agreed policy deductible or waiting period.
Uninsurable Fines & Penalties
Statutory fines or criminal penalties levied by regulatory bodies (such as the ODPC) that are legally uninsurable under Kenyan law.
Ensuring Compliance with Policy Warranties:
Actual exclusions depend strictly on specific policy wordings and endorsements. Oakman Insurance Agency helps businesses across Kenya audit policy conditions, minimum security requirements, and sub-limits to ensure full protection when claims arise.
Ransomware, Phishing & Business Email Compromise (BEC) Coverage
Specific Threat BreakdownYes, cyber insurance in Kenya can cover ransomware, phishing, and Business Email Compromise (BEC), but the exact response depends heavily on policy wordings, endorsements, and underwriting preconditions. Understanding how insurers classify these threat vectors ensures your business avoids unexpected coverage gaps during a crisis.
Ransomware & Cyber Extortion
Cyber insurance policies with extortion extensions respond to eligible costs and operational losses caused by malicious encryption attacks:
- Forensic investigation & 24/7 incident response
- Specialist negotiation & cyber extortion management
- Data recovery & full system restoration
- Business interruption income loss reimbursement
Ransom Payment Provision: Ransom payments are not automatically indemnified. Reimbursement is subject to strict policy sub-limits, legal requirements, anti-money laundering (AML) compliance, sanctions checks, and prior insurer authorization.
Phishing Attacks
Coverage for phishing depends on the resulting mechanism of loss. Insurers differentiate between network intrusions and direct financial theft:
Path A: Network Intrusion (Cyber Liability)
Phishing email → Stolen credentials → System breach → Data loss or ransomware. (Covered under standard Cyber Liability).
Path B: Direct Financial Theft (Cyber Crime)
Phishing email → Employee manipulated into wiring funds to criminals. (Requires a specific Social Engineering or Funds-Transfer Fraud extension).
Underwriting Key: Confirming whether your policy includes both Cyber Liability AND Social Engineering extensions is critical when protecting against phishing.
Business Email Compromise (BEC)
BEC (such as CEO impersonation or fraudulent supplier account changes) can be covered via Cyber Crime or Funds-Transfer Fraud endorsements, subject to strict underwriting controls:
- Dual-Authorisation Controls: Mandatory double-verification on payments
- Out-of-Band Call Verification: Phone verification of new bank details
- Sub-Limits & Deductibles: Specific lower caps applied to BEC fraud claims
Important Action: Never assume BEC is automatically included in standard cyber insurance. Oakman Insurance Agency verifies your internal payment controls to ensure BEC endorsements are fully operative.
Cyber Insurance Cost & Quotation Requirements in Kenya
Underwriting & Rating GuidanceThere is no single standardized cyber insurance price that applies universally to every enterprise in Kenya. Premium rates are dynamically calculated based on individual operational exposures, data sensitivity, and technical vulnerability profiles.
Key Premium Rating Factors in Kenya
Annual Turnover & Revenue
Commercial Industry Sector
Number of Employees & Users
Volume & Type of Sensitive Data
Operational IT Dependence
Physical & Remote Locations
Cybersecurity Controls (MFA, Backups)
Use of Cloud & Vendor Infrastructure
Previous Cyber Incidents & Breach History
Claims History Profile
Requested Overall Policy Limit
Selected Policy Deductible / Excess
Cyber Crime & BEC Coverage Extensions
Information Required to Get a Cyber Insurance Quote
Specialist cyber insurers conduct preliminary underwriting evaluations before issuing terms. Providing accurate operational details ensures competitive pricing and valid policy coverage:
1. Business Information
- Registered company name & primary industry sector
- Annual turnover & staff count in Kenya
- Operating locations & international presence
2. Technology Infrastructure
- IT infrastructure, cloud hosting & web portals
- Remote access protocols & critical system dependence
- Third-party technology providers & MSP contracts
3. Data Exposure & Sensitivity
- Customer, employee & supplier personal records
- Financial, health & payment card data (PCI-DSS)
- Sensitive personal data handled under Kenya's DPA
4. Cybersecurity Defenses
- Multi-Factor Authentication (MFA) & firewalls
- Antivirus, EDR, data encryption & backups
- Patch management, staff training & breach plans
5. Claims & Incident History
- Prior cyber attacks, ransomware or extortion events
- Data breaches & social engineering wire losses
- Previous cyber insurance claims over the last 3-5 years
Get an Accurate Cyber Insurance Quotation in Kenya:
Rather than relying on generic advertised rates, Oakman Insurance Agency conducts a tailored risk evaluation for your business, helping you gather the necessary information and securing competitive quotations from top cyber underwriters in Kenya.
What Cyber-Security Controls Can Insurers Look For?
Underwriting Risk AssessmentBefore issuing terms or approving coverage, cyber insurance underwriters thoroughly evaluate an organization's technical maturity and defensive posture. Implementing strong security controls directly impacts policy eligibility, coverage extensions, deductible levels, and premium rates in Kenya.
Multi-Factor Authentication (MFA)
Enforced across email accounts, VPN/remote access, cloud portals, administrator accounts, and backup management consoles.
Regular & Tested Backups
Immutable, air-gapped, or offline 3-2-1 backups subjected to routine restoration testing to ensure rapid recovery from ransomware.
Endpoint Protection (EDR/MDR)
Centralized Endpoint Detection & Response software deployed across all laptops, workstations, and server environments.
Firewall Protection & Filtering
Enterprise next-generation firewalls, secure email gateways, web application firewalls, and network segmentation controls.
Strong Password Policies
Strict password complexity requirements, mandatory credential rotation rules, and centralized password management tools.
Privileged-Access Controls (PAM)
Least-privilege access enforcement, administrator account vaulting, and strict separation of superuser credentials.
Data Encryption Protocols
Full-disk encryption on portable devices, database encryption at rest, and TLS/SSL encryption for data transmitted across networks.
Patch & Vulnerability Management
Structured patch cadence for operating systems, critical software, internet-facing assets, and end-of-life hardware removal.
Employee Cyber-Awareness Training
Continuous security training, simulated phishing exercises, and clear reporting procedures for suspicious email communications.
Incident-Response Procedures
Documented breach response playbooks, designated response teams, and defined notification protocols for regulators and insurers.
Business Continuity Planning (BCP)
Tested disaster recovery strategies designed to maintain core operations during prolonged IT downtime or infrastructure outages.
Vendor-Risk Management
Security vetting and contractual oversight of third-party cloud providers, Managed Service Providers (MSPs), and software vendors.
Risk Management vs. Claims Coverage:
Having stronger cybersecurity controls does not guarantee that every claim will be automatically paid, but it significantly improves underwriting approval, unlocks broader extensions (such as BEC and Ransomware cover), and reduces premium costs. Oakman Insurance Agency assists businesses across Kenya in auditing their security controls before completing cyber insurance proposal forms.
Why Cyber Insurance Should Be Part of Your Business Risk Management
Enterprise Risk IntegrationCyber insurance should never be viewed as a substitute for prevention. Instead, a resilient cyber risk management strategy in Kenya combines defensive controls, active response protocols, and financial recovery mechanisms into a comprehensive three-layered framework.
1
PREVENT
Deploy appropriate technical cybersecurity controls, firewalls, MFA, encryption, and staff training to reduce the probability of a digital security incident occurring.
2
RESPOND
Maintain a documented, actionable incident-response playbook for rapidly identifying, containing, and managing a cyber attack when perimeter defenses are breached.
3
RECOVER
Utilize secure backups, business continuity plans, and comprehensive cyber insurance to absorb financial losses, restore systems, and protect ongoing cash flow.
What Happens When a Cyber Incident Occurs?
When a breach or network compromise is suspected, the immediate priority is to execute your incident-response plan and notify your insurer. A structured response follows seven critical operational steps:
STEP 1
IDENTIFY
Verify whether an actual cyber security incident, breach, or system intrusion has occurred across your network.
STEP 2
CONTAIN
Execute immediate containment measures to isolate compromised servers, disconnect affected devices, and stop further data exposure.
STEP 3
NOTIFY
Contact your insurer or designated 24/7 cyber incident-response team immediately as required under policy terms.
STEP 4
INVESTIGATE
Engage specialized forensic engineers to establish the attack vector, identify compromised records, and purge active malware.
STEP 5
RECOVER
Restore encrypted databases, recreate corrupted software systems from backups, and safely resume normal business operations.
STEP 6
MANAGE LEGAL & REGULATORY OBLIGATIONS
Acquire legal advice to fulfill statutory breach notifications to the Office of the Data Protection Commissioner (ODPC) in Kenya.
STEP 7
DOCUMENT THE LOSS
Maintain detailed records of IT recovery invoices, business interruption downtime, restoration costs, and third-party expenses for claim settlement.
Critical Policy Notification Requirement:
Do not wait for a cyber incident to escalate or attempt internal remediation before notifying your insurer. Policies contain strict timeframes for reporting potential claims. Oakman Insurance Agency provides 24/7 claims support to ensure prompt notification and immediate access to forensic panel response teams.
