Skip to main content
Readiness Authority
Category: Cyber Threats & Attacks

Business Interruption Event

Also known as: BI Event, Business Interruption, BI
Simply put

A business interruption event is an unexpected disruption that forces a business to stop or reduce its operations, causing it to lose income. Business interruption insurance is a type of first-party coverage that can help replace lost income and pay ongoing fixed expenses while the business is unable to operate normally. Whether a particular event is covered depends on the specific policy wording, including which perils or events the policy treats as triggering coverage.

Formal definition

A business interruption event is an occurrence that causes an interruption of the insured's business operations, giving rise to a first-party claim for resulting loss of income and continuing fixed expenses. In many traditional property forms, coverage is triggered by an interruption arising from a covered peril, and available benefits may include lost income and ongoing fixed expenses, including costs incurred while operating at an offsite location during the period the property is closed for repairs. Whether a given event qualifies as a triggering "event" is subject to the specific policy wording, including the definition of covered perils, any requirement for physical damage to insured property, applicable waiting periods and period-of-indemnity provisions, sublimits, retentions, exclusions, and conditions precedent. This entry addresses business interruption as an insurance coverage concept and does not by itself describe operational resilience metrics such as RTO or RPO, which are defined separately.

Why it matters

A business interruption event goes to the heart of why many organizations purchase cyber and property insurance: the largest financial consequence of a disruption is often not the physical or digital damage itself, but the income lost while operations are halted or degraded. First-party business interruption coverage is designed to replace that lost income and help pay ongoing fixed expenses, which can include costs incurred while operating at an offsite location while the damaged property is closed for repairs. For risk managers and finance leaders, this coverage can determine whether a prolonged outage is a survivable event or an existential one.

The critical caveat is that not every disruption qualifies as a covered business interruption event. Whether a particular event triggers coverage depends on the specific policy wording, including how the policy defines covered perils, whether it requires physical damage to insured property, and any applicable waiting periods, period-of-indemnity provisions, sublimits, retentions, exclusions, and conditions precedent. Two businesses facing similar operational losses can reach very different coverage outcomes based solely on the language of their respective forms. This makes careful reading of the trigger and the definition of "event" essential before a loss occurs, not after.

It is equally important to recognize what this coverage does not do. Business interruption insurance is a risk transfer mechanism: it can help recover lost income after an interruption, but it does not reduce the likelihood of a disruption and does not by itself constitute operational resilience. Purchasing coverage is not a substitute for continuity planning, and the presence of a policy says nothing about how quickly a business can actually restore operations. Insurance and resilience are complementary, not interchangeable.

Who it's relevant to

Risk Managers
Risk managers use business interruption coverage to transfer the financial consequences of operational downtime. They need to understand the trigger, any physical-damage requirement, waiting periods, sublimits, and the period of indemnity to assess how well the coverage matches the organization's exposure, and to recognize that the policy does not itself reduce the likelihood of an interruption.
Insurance Brokers and Underwriters
Brokers and underwriters must align policy wording with the insured's actual exposure, paying close attention to how the form defines covered perils and the qualifying event, whether physical damage is required, and how exclusions, retentions, and conditions precedent interact. Differences in wording across insurer forms can produce materially different coverage outcomes for otherwise similar losses.
Resilience and Continuity Planners
Continuity planners should treat business interruption insurance as a complement to, not a replacement for, continuity and recovery planning. Insurance may help recover lost income and fixed expenses after a covered event, but it does not restore operations; resilience metrics and recovery capabilities remain the responsibility of the planning function and are assessed separately from coverage.
Legal and Compliance Professionals
Legal and compliance teams are often central to interpreting whether a given interruption qualifies as a covered event, particularly where the policy hinges on the definition of covered perils, a physical-damage requirement, or conditions precedent. They should note that coverage determinations are conditional on the specific wording and may vary by jurisdiction.

Inside BI Event

Triggering Event
The underlying cause that initiates the interruption, typically a security failure or system failure such as a ransomware event, network outage, or unauthorized access. Whether a given trigger falls within coverage depends on the specific policy wording, and many forms distinguish covered cyber triggers from excluded causes such as physical perils or infrastructure failures.
Waiting Period (Time Retention)
A qualifying period, often expressed in hours, that must elapse before business interruption loss begins to accrue as a covered loss. It functions similarly to a deductible expressed in time rather than money and is distinct from the monetary retention. Losses during the waiting period are typically borne by the insured, subject to the specific wording.
Period of Restoration (Indemnity Period)
The window during which lost income and extra expense are measured, generally beginning after the waiting period and continuing until systems or operations are restored, or until a specified maximum period ends. Its boundaries depend on policy definitions and may differ from the actual time an organization takes to fully recover.
Business Interruption Loss (First-Party)
The insured's own loss of net income and continuing operating expenses resulting from the covered interruption. This is a first-party coverage element and is separate from third-party liability arising from the same incident, such as privacy claims or regulatory defense.
Extra Expense
Additional costs incurred to reduce or avoid the interruption, such as temporary workarounds or expedited restoration. Coverage for extra expense may be provided within the business interruption grant or as a distinct component, subject to the specific wording and any applicable sublimits.
Sublimits and Retentions
Financial boundaries that cap or condition recovery. Business interruption is frequently subject to a sublimit lower than the aggregate policy limit and to a monetary retention in addition to the waiting period. These are coverage terms, not resilience metrics such as RTO or RPO.
Contingent (Dependent) Business Interruption
An extension addressing interruption caused by an event affecting a third party the insured relies on, such as a service provider. Whether such dependency losses are covered depends on endorsements, scheduling of providers, and the specific wording; it is commonly distinguished from direct business interruption.
Proof of Loss and Quantification
The documentation and calculation required to establish the amount of interruption loss, typically involving financial records used to model income that would have been earned absent the event. Conditions precedent in the policy may govern notice, cooperation, and substantiation.

Common questions

Answers to the questions practitioners most commonly ask about BI Event.

Does business interruption coverage reimburse third-party losses, such as claims from customers who couldn't access our services during an outage?
No. Business interruption coverage is a first-party coverage that responds to the insured's own income loss and related expenses resulting from a covered interruption. Liability to others, such as customers or partners who suffer their own losses because your services were unavailable, falls under third-party coverage rather than the business interruption insuring agreement. Whether any such third-party exposure is covered depends on other parts of the policy and its specific wording, and should not be assumed from the presence of business interruption cover.
Isn't a business interruption event essentially the same as a resilience metric like RTO, so that having the coverage means our recovery is handled?
No. A business interruption event is an insurance concept concerning when and how a policy responds to income loss, while a recovery time objective (RTO) is a resilience planning target for how quickly operations should be restored. They are distinct: insurance is a risk transfer mechanism that may reimburse certain financial losses after the fact, but it does not reduce the likelihood of an incident, does not restore operations, and does not by itself constitute resilience. Business continuity and disaster recovery capabilities remain necessary regardless of coverage, and the two should be planned separately even where they interact.
How does a waiting period affect what we can recover for a business interruption event?
In many cyber policies, a waiting period (sometimes structured as a time-based retention) sets a threshold duration that must elapse before business interruption loss begins to accrue for coverage purposes. Interruptions shorter than the waiting period may not trigger indemnification at all, and in some forms the period functions as a deductible in time. The exact mechanism, whether losses during the waiting period are excluded entirely or only the initial hours are borne by the insured, depends on the specific wording, so the definition and application of the waiting period should be confirmed on the applicable form.
What documentation should we maintain to support a business interruption claim?
Because business interruption recovery typically hinges on demonstrating a quantifiable income loss attributable to a covered event, contemporaneous records generally matter. This often includes historical financial statements establishing a baseline of expected revenue, records of the interruption's timing and duration, evidence tying the loss to a covered cause, and documentation of any extra expenses incurred to mitigate the disruption. Requirements vary by policy, and conditions such as proof-of-loss provisions and cooperation clauses may apply, so the specific policy conditions should be reviewed with a broker or claims professional.
How does the choice of a specific interruption trigger influence whether a loss is covered?
Coverage typically depends on how the triggering event is defined in the insuring agreement, for example, whether the policy responds to a security failure, a system failure, or both, and whether it extends to interruptions arising from a third-party service provider. Two policies can treat the same operational disruption very differently based on this wording. Exclusions (such as war, infrastructure, or failure-to-maintain-standards exclusions) and conditions precedent can further affect the outcome. The scope should be assessed against the exact policy language rather than assumed from the general concept.
How should business interruption coverage be coordinated with our continuity and recovery planning?
The two serve different purposes and are best aligned rather than substituted for one another. Business continuity and disaster recovery capabilities aim to reduce the duration and impact of an interruption, while business interruption insurance is a risk transfer mechanism that may reimburse certain resulting financial losses. Coordinating them can involve mapping the policy's waiting period and any sublimits against realistic recovery timelines, ensuring recovery efforts and their costs are documented in a way that supports a potential claim, and recognizing that faster recovery may reduce both operational impact and the indemnifiable loss. Insurance does not lower the likelihood of an incident, so mitigation and planning remain essential alongside coverage.

Common misconceptions

Business interruption coverage begins the moment systems go down.
Most cyber policies impose a waiting period (a time-based retention) that must elapse before covered loss accrues, and loss is then measured over a defined period of restoration. The onset and duration of covered loss depend on the specific wording rather than the literal moment of outage.
The period of restoration equals the actual time it takes the organization to fully recover.
The indemnity period is defined by the policy and may end at restoration, at a stated maximum, or on other conditions. It is a coverage definition, not a resilience metric, and it may be shorter than the real-world recovery timeline. It should not be confused with an RTO.
Business interruption cover, being first-party, also handles the claims others bring against the insured after the same incident.
Business interruption is first-party coverage for the insured's own income and expense loss. Liability to third parties, such as privacy claims or regulatory defense, is a separate third-party category and is not addressed by the business interruption grant.

Best practices

Confirm how the policy defines the triggering event, the waiting period, and the period of restoration, and reconcile these coverage boundaries against your internal recovery expectations rather than assuming they align with your RTO or RPO.
Identify the applicable business interruption sublimit and monetary retention separately from the time-based waiting period, so the total self-borne loss is understood before an incident occurs.
Review exclusions and conditions precedent that could apply to interruption losses, such as war, infrastructure, or failure-to-maintain-standards exclusions, recognizing that coverage outcomes depend on the specific wording and jurisdiction.
Evaluate whether contingent or dependent business interruption cover is needed for critical service providers, and verify any scheduling or endorsement requirements for those dependencies.
Maintain financial records and a documented methodology for quantifying lost income and extra expense in advance, to support proof of loss and meet cooperation obligations.
Treat this insurance as risk transfer, not risk reduction; pair it with mitigation and continuity measures, since coverage does not lower the likelihood of an interruption or by itself constitute resilience.
Promotional banner for the Pentest Readiness checklist download