Category: Policy Structure & Terms

Self-Insured Retention

Also known as:

Simply put

A self-insured retention is a set dollar amount that an insured organization must pay out of its own funds toward a covered loss before its liability insurance policy begins to respond. It functions as a self-insurance mechanism that some organizations use to help manage their insurance costs. Whether and how it applies depends on the specific policy wording.

Formal definition

A self-insured retention (SIR) is a dollar amount specified in a liability insurance policy that the insured must pay toward a claim before the insurer's coverage obligation is triggered. It operates as a form of retained risk (risk acceptance) rather than risk transfer, and it is typically associated with third-party liability coverage. The rights and duties of the insured and insurer with respect to defense, claim handling, and the point at which the policy responds are governed by the specific policy terms, and the SIR is generally distinguished from a deductible in how these obligations are allocated. The precise mechanics, including exhaustion, defense responsibilities, and interaction with limits, are subject to the individual policy wording and applicable jurisdiction.

Why it matters

For organizations buying cyber and other liability coverage, the self-insured retention determines how much of a loss the organization absorbs directly before any insurance responds. Because an SIR is a form of retained risk, risk acceptance rather than risk transfer, it directly shapes an organization's exposure and its cash flow when a claim arises. Selecting an SIR is a deliberate trade-off: accepting a larger retained amount is one way some organizations seek to manage their insurance costs, but it also means the organization must be financially prepared to fund that amount from its own resources when a covered event occurs.

The SIR also affects how a claim is handled, not just who pays first. Unlike a deductible, which insurers commonly manage as part of their own claim payment and then recover, an SIR is generally structured so that the insured is responsible for amounts within the retention, and the policy may allocate defense and claim-handling duties differently as a result. Whether the insurer or the insured controls defense, when the insurer's obligation is triggered, and how the SIR interacts with policy limits are all governed by the specific policy wording. Two policies with the same SIR figure can therefore behave quite differently in practice.

Because the mechanics turn on the individual policy terms and applicable jurisdiction, risk managers and coverage counsel should read the SIR provisions closely rather than assume standard behavior. Disputes can arise over questions such as how the SIR is exhausted, who directs the defense within the retention, and how the retention interacts with other coverage, issues that depend heavily on the precise language of the form.

Who it's relevant to

Risk Managers

Risk managers evaluate SIR levels as part of structuring a liability program, weighing the retained exposure against premium cost. Because the SIR represents risk the organization accepts rather than transfers, they must confirm the organization can fund the retention from its own resources when a claim occurs, and understand how the SIR interacts with limits and defense obligations under the specific policy.

Insurance Brokers and Underwriters

Brokers advise clients on selecting an appropriate SIR and on how the retention is documented in the policy, including how it differs from a deductible in the allocation of defense and claim-handling duties. Underwriters use the SIR as a factor in pricing and in defining the point at which the insurer's obligation attaches.

Legal and Compliance Professionals

Coverage counsel focus on the precise wording governing exhaustion of the SIR, the allocation of defense responsibility within the retention, and the point at which the insurer's duties are triggered. These questions are subject to the individual policy terms and applicable jurisdiction, and are a recurring source of coverage disputes.

Finance and Treasury Teams

Because an SIR must be paid from the organization's own funds before insurance responds, finance teams need to account for this retained exposure in liquidity and reserving decisions, treating it as risk the organization has accepted rather than transferred.

Inside SIR

Retained Loss Layer

The portion of a covered loss the insured must bear itself before the insurer's obligation to indemnify attaches. Unlike a deductible, which the insurer typically pays and then seeks reimbursement, a self-insured retention (SIR) is generally satisfied directly by the insured, subject to the specific policy wording.

Attachment Point

The threshold at which insurer coverage begins. Losses below the SIR amount are the insured's responsibility; amounts above it, up to applicable limits and sublimits, may be covered depending on triggers, conditions, and exclusions.

Application Across Coverage Parts

In cyber policies, a SIR may apply to first-party components (such as business interruption, data restoration, or cyber extortion) and to third-party components (such as privacy liability or regulatory defense). Whether one aggregate SIR or separate retentions apply, and to which coverage parts, depends on the specific form and endorsements.

Relationship to Waiting Periods

For first-party business interruption, a SIR (a monetary threshold) is distinct from a waiting period (a time-based qualifier that must elapse before BI coverage responds). Both may operate on the same claim, and they should not be treated as interchangeable.

Control of Defense and Claims Handling

Because the insured funds losses within the SIR, policy wording often addresses who controls incident response, vendor selection, and defense within the retention. Terms vary, and some forms require insurer consent or panel vendors even below the attachment point, subject to the specific wording.

Risk-Transfer Boundary

The SIR marks the line between risk retained (a form of risk acceptance funded by the insured) and risk transferred to the insurer. It defines the insured's own financial exposure per claim or in aggregate, subject to how the policy aggregates losses.

Common questions

Answers to the questions practitioners most commonly ask about SIR.

Is a self-insured retention the same thing as a deductible?

Not exactly, though the two are often used loosely as synonyms. In many policy structures, the practical distinction is in how each operates: with a self-insured retention (SIR), the insured is typically responsible for handling and paying covered losses up to the retention amount before the insurer's obligations attach, and in some forms the insured manages the claim within that layer. A deductible is generally an amount the insurer subtracts from a loss it is otherwise administering, meaning the insurer may still control the claim from the outset and then seek reimbursement or net out the deductible. The exact mechanics, including who controls defense and settlement and when the insurer's duties are triggered, depend on the specific policy wording, so the label alone does not determine how it functions.

Does taking on a self-insured retention mean I'm making my organization more resilient?

No. A self-insured retention is a risk-financing and risk-retention decision, not a resilience measure. It determines how much of a loss your organization absorbs before insurance responds; it does not reduce the likelihood of an incident, shorten recovery times, or improve your ability to continue operations. Genuine resilience comes from controls, business continuity and disaster recovery planning, incident response capability, and similar measures. An SIR sits on the financing side of the equation and should not be confused with the operational capabilities that reduce or manage loss.

How should we decide what SIR amount to accept?

The choice generally reflects a trade-off between premium cost and retained risk: a higher retention typically lowers premium but increases the amount your organization must fund out of pocket per claim. Relevant considerations often include your available liquidity and reserves, your tolerance for volatility, the frequency and severity profile of the exposures being covered, and cash-flow implications if multiple claims arise. Because the appropriate level is specific to an organization's financial position and risk appetite, it is commonly evaluated with input from finance, risk management, and a broker rather than set by a rule of thumb.

Do we have to pay the full retention before the insurer does anything on a cyber claim?

This depends on the policy wording. In many arrangements the insurer's indemnity obligations attach only after the retention is exhausted, and the insured may be expected to fund and sometimes manage covered costs within the retained layer. However, cyber policies frequently provide access to breach-response services, such as forensics, legal, and notification vendors, and whether those services are available before the retention is satisfied, and whether their cost erodes the retention, is governed by the specific terms and endorsements. Review the wording to confirm how the retention interacts with panel services and the insurer's duties.

How does a self-insured retention interact with a waiting period on business interruption cover?

These are two distinct thresholds that can both apply to a first-party business interruption claim. The waiting period is a time-based qualifier that typically must elapse before business interruption loss begins to accrue for coverage purposes, while the retention is a monetary amount the insured absorbs. Depending on the wording, an insured may need to satisfy both: the interruption must persist beyond the waiting period, and the covered loss must exceed the retention before the insurer indemnifies. Because their interaction varies by form, it is important to check whether the waiting period is expressed in hours or days and how it is measured relative to the retention.

Who controls the defense and settlement of a third-party claim within the retention?

This varies by policy structure and should be confirmed in the wording. Under some self-insured retention arrangements, the insured retains control of defense and settlement decisions for claims falling within the retained layer, subject to conditions such as the insurer's consent for settlements that could reach its coverage. Other forms give the insurer a duty to defend from the first dollar while the retention operates more like a deductible. Because control of defense affects both cost and strategy on privacy and regulatory-defense exposures, identify precisely how the policy allocates these responsibilities and any consent or cooperation conditions precedent.

Common misconceptions

A self-insured retention is just another name for a deductible.

They function differently. With a deductible, the insurer typically pays the full covered loss and recovers the deductible from the insured. With a SIR, the insured generally satisfies the retained amount directly before coverage attaches, and the SIR may affect who controls defense and vendor engagement within that layer. The exact mechanics depend on the specific policy wording.

The SIR is a resilience metric that reflects how quickly an organization can recover.

A SIR is a monetary insurance term describing a retained loss layer. It is not a resilience metric and is distinct from RTO, RPO, or a business-interruption waiting period. It says nothing about likelihood of an incident or speed of recovery; it only allocates financial responsibility for losses.

Choosing a lower SIR always improves the insured's position.

A lower SIR reduces the amount retained but is typically reflected in premium and may interact with insurer control provisions and conditions. The trade-off between retained exposure, premium, and control is a genuine point of judgment among underwriters, brokers, and risk managers, and depends on the insured's balance sheet, loss history, and the specific form.

Best practices

Read the policy wording carefully to confirm whether the retention operates as a true SIR or a deductible, and how it is satisfied, since this affects claim mechanics and control of response.

Map which coverage parts the retention applies to, distinguishing first-party components (business interruption, data restoration, cyber extortion) from third-party components (privacy liability, regulatory defense), and confirm whether retentions are separate or aggregated.

Clarify how the SIR interacts with any first-party business-interruption waiting period, treating the monetary threshold and the time-based qualifier as separate conditions rather than one and the same.

Confirm who controls incident response, vendor selection, and defense within the retention layer, including any consent or panel-vendor requirements, to avoid gaps or disputes during an actual event.

Size the retention against the organization's ability to fund retained losses, recognizing that the SIR represents risk acceptance and does not reduce the likelihood of an incident or substitute for resilience measures.

Involve broker, risk management, finance, and legal or compliance stakeholders when negotiating the SIR, and document the rationale for the retained amount relative to premium and control trade-offs.