What policies usually cover
Incident response, legal, notification, and sometimes business interruption. Read sublimits carefully.
What underwriters ask
MFA, backups, vendor lists, and prior incidents. Honesty beats a rejected claim later.
Pair with controls
Insurance without offboarding and patching is theater. Show both in security reviews.