Skip to main content
Readiness Authority
Category: Breach Response Services

Public Relations Costs

Also known as: PR Costs, Public Relations Expenses, Crisis Communications Costs
Simply put

Public relations costs are the expenses of hiring communications professionals to protect or restore an organization's reputation, often after a cyber incident or data breach. These can include agency retainers, hourly consulting fees, and crisis communications support. In a cyber insurance context, some policies may reimburse these costs as part of an insured's own first-party expenses, though whether they are covered depends on the specific policy wording.

Formal definition

Public relations costs refer to fees paid to PR agencies or in-house communications staff for reputation management, media handling, and crisis communications. Based on the evidence, such costs are commonly structured as monthly retainers or hourly rates, with crisis communication work often commanding higher rates than routine PR work. In cyber insurance, PR or crisis-communications costs are typically addressed as a first-party coverage element (the insured's own expense to mitigate reputational harm following an incident), frequently subject to a sublimit, a requirement that the provider be pre-approved or drawn from an insurer panel, and a trigger tied to a covered event such as a data breach or network security failure. This is distinct from third-party liability coverage, which responds to claims made against the insured by others. Whether PR costs are recoverable, and to what extent, depends on the specific policy wording, endorsements, conditions precedent, and applicable exclusions; general business PR expenses unrelated to a covered incident are ordinarily out of scope. The evidence packet addresses general PR pricing and tax treatment but does not establish specific cyber policy figures, sublimits, or coverage terms.

Why it matters

A cyber incident or data breach is often as much a reputational event as a technical one. Customers, regulators, business partners, and the media may all react to news of a breach, and the way an organization communicates during those first hours and days can influence customer retention, regulatory scrutiny, and the long-term standing of the brand. Public relations costs represent the first-party expense of managing that communications challenge, and they are a distinct budget line from the technical work of investigating and remediating the incident itself.

For buyers of cyber insurance, understanding how PR costs are treated matters because coverage is conditional rather than automatic. In many policies these costs are addressed as a first-party element and are frequently subject to a sublimit, a requirement to use a pre-approved or panel provider, and a trigger tied to a covered event such as a data breach or network security failure. An organization that assumes crisis communications will be fully reimbursed may discover after an incident that the amount available is capped, that the provider it wanted to use was not on the insurer's panel, or that the expense fell outside the covered trigger. Reading the specific wording before an incident, not during one, is what turns this coverage element into a usable resource.

It is also important to keep the limits of this coverage in perspective. Insurance for PR costs is a form of risk transfer that helps fund the response to reputational harm; it does not reduce the likelihood of an incident, and reimbursing communications fees does not by itself restore a damaged reputation or constitute organizational resilience. General, ongoing business PR unrelated to a covered incident is ordinarily out of scope for cyber policies. The evidence available here addresses general PR pricing and its tax treatment as an ordinary business expense, but does not establish specific cyber policy figures, sublimits, or coverage terms, so buyers should verify these details against their own policy documents.

Who it's relevant to

Risk Managers and Insurance Buyers
Risk managers need to confirm whether their cyber policy addresses PR costs as a first-party element, what sublimit applies, and whether the amount is realistic given the organization's size and public profile. They should also check for panel or pre-approval requirements, since these can constrain provider choice at the worst possible moment.
Brokers and Underwriters
Brokers should set accurate expectations about the conditional nature of this coverage, including any sublimit, trigger, and provider requirements, and should compare how different forms treat crisis communications. Underwriters weigh the reputational exposure of an applicant and the terms on which PR costs are offered as part of the first-party section of the policy.
Chief Information Security Officers and Incident Responders
CISOs coordinating a breach response should recognize that communications is a workstream distinct from technical investigation and remediation. Knowing in advance whether the policy funds a crisis communications provider, and whether that provider must come from a panel, allows the response team to engage the right help quickly rather than during the incident.
Legal, Compliance, and Communications Teams
These teams manage the messaging, regulatory notifications, and stakeholder communications that follow an incident, and they benefit from understanding which of their engaged advisers' fees may fall within covered PR costs. They should be aware that general business PR unrelated to a covered event is ordinarily out of scope.

Inside Public Relations Costs

Crisis Communications Expense
Costs incurred to engage public relations or crisis communications firms following a covered cyber event, typically treated as a first-party coverage element intended to help manage reputational harm arising from an incident.
Reputational Harm Mitigation
Spending directed at limiting damage to the insured's brand or standing after an incident, such as messaging strategy and media handling. Whether such costs are reimbursed depends on the specific policy wording, applicable sublimits, and the definition of a covered event.
Notification and Communication Support
PR-related support that may accompany affected-party notification or public statements. This is distinct from the separate breach notification cost coverage found in many policies, and the two should not be conflated.
Sublimit and Retention Application
Public relations costs are commonly subject to a sublimit that is lower than the overall policy limit, and may be subject to a retention. These are coverage terms, not resilience metrics, and their availability is conditional on the policy structure.
Trigger and Eligibility Conditions
Reimbursement typically depends on the costs arising from a covered trigger, being reasonable and necessary, and in many policies requiring insurer consent or the use of approved vendors before expenses are incurred.

Common questions

Answers to the questions practitioners most commonly ask about Public Relations Costs.

Does cyber insurance automatically pay for all our public relations costs after a breach?
Not necessarily. Public relations costs are typically covered under a specific insuring agreement or endorsement, often within crisis management or breach response coverage, and are commonly subject to a sublimit that may be lower than the overall policy limit. Whether a given expense is reimbursed depends on the specific wording, applicable exclusions, and conditions precedent such as the insurer's prior consent to engage a firm. Read the relevant insuring agreement rather than assuming blanket coverage.
Is PR coverage the same as covering the reputational or brand harm my organization suffers?
No, and it is important to keep these distinct. PR costs coverage typically reimburses the expense of engaging communications professionals to manage messaging after a covered incident. It generally does not indemnify the underlying reputational damage itself, such as lost customers, diminished brand value, or long-term revenue decline attributable to loss of goodwill. Those consequential losses are frequently excluded or fall outside the scope of the PR sublimit; check the wording for how reputational loss, if addressed at all, is defined and limited.
Do we need the insurer's approval before hiring a PR firm, and how does that work in practice?
In many policies, prior written consent from the insurer is a condition precedent to reimbursement of PR costs, and some forms require you to use pre-approved vendors from a panel. Engaging a firm before notifying the insurer or obtaining consent can jeopardize recovery of those costs. In practice, confirm the notice and consent requirements in your policy before an incident, understand whether a panel applies, and build the insurer's contact and approval step into your incident response plan.
How does the PR costs sublimit interact with the rest of my cyber policy limits?
PR costs are commonly provided within a sublimit that sits inside, and erodes, the overall policy aggregate in many forms, though structures vary. This means amounts paid for communications support may reduce what remains available for other first-party costs such as data restoration or business interruption. Review whether the PR sublimit is part of or in addition to the aggregate, whether a retention applies, and model how simultaneous demands on multiple coverages could exhaust limits, all subject to the specific wording.
What triggers PR costs coverage, and does it apply to any negative publicity?
Coverage is typically triggered by a covered event as defined in the policy, such as a security breach, privacy incident, or extortion event, rather than by reputational fallout generally. Negative publicity arising from a matter that is not itself a covered event may not trigger the coverage. Confirm exactly which events invoke the PR insuring agreement, since triggers differ across insurer forms, and do not assume that adverse media attention alone activates the benefit.
How should PR costs coverage fit into our broader crisis management and incident response planning?
Treat the coverage as one funding mechanism supporting communications workstreams, not as a substitute for a plan. Risk transfer through insurance reimburses eligible expenses but does not perform crisis communications or reduce the likelihood of an incident. Integrate the policy's notice timelines, consent requirements, and any approved-vendor panel into your incident response and crisis management procedures, keep the coverage terms distinct from your operational recovery objectives, and pre-establish relationships with firms consistent with your policy's requirements so that response is not delayed during an event.

Common misconceptions

Public relations costs are always covered whenever a cyber incident occurs.
Coverage is conditional. Whether PR costs are reimbursed depends on the specific policy wording, whether a covered trigger has been met, applicable sublimits and retentions, exclusions, and any conditions precedent such as prior insurer consent.
Public relations cost coverage is the same as breach notification cost coverage.
They are distinct coverage elements. Notification costs relate to informing affected parties or regulators, while PR costs relate to managing reputational harm and communications. Many policies address each separately, and the scope of one should not be assumed from the other.
Buying PR cost coverage reduces the reputational risk of an incident.
This coverage is a form of risk transfer, not risk mitigation. It may fund communications support after an event but does not by itself lower the likelihood of an incident or constitute resilience. Reducing reputational risk requires separate preparedness measures.

Best practices

Confirm whether public relations costs are provided as a standalone coverage element or bundled within another insuring agreement, and identify the applicable sublimit and retention.
Review the policy for consent and vendor-panel requirements, since many policies require insurer approval or use of approved firms before PR expenses are incurred.
Verify which triggers activate the coverage and check exclusions and conditions precedent that could limit or bar reimbursement, subject to the specific wording.
Keep public relations cost coverage conceptually distinct from breach notification cost coverage when assessing adequacy, and address any gaps between them.
Treat this coverage as risk transfer that funds response, and maintain separate crisis communications and reputational resilience planning that do not depend on the policy.
Document and preserve records demonstrating that incurred PR costs are reasonable, necessary, and tied to a covered event to support any subsequent claim.
Promotional banner for the Pentest Readiness checklist download