Skip to main content
Readiness Authority
Category: Policy Exclusions

Systemic Event Exclusion

Also known as: Systemic Risk Exclusion, Systemic Cyber Exclusion
Simply put

A systemic event exclusion is policy wording that removes coverage for losses arising from large-scale events that can affect many policyholders at once, such as widespread cyber-attacks, pandemics, or natural catastrophes. Insurers use these exclusions because such events can accumulate into losses that make the underlying coverage unaffordable or unavailable to offer. Whether a particular loss falls within the exclusion depends on how the specific event and the exclusion are defined in the policy.

Formal definition

A systemic event exclusion is a policy provision or endorsement that carves out losses stemming from correlated, large-scale events capable of triggering widespread simultaneous claims across an insurer's portfolio, thereby limiting accumulation and tail risk. In the cyber context, supervisory bodies have identified systemic events such as large cyber-attacks, pandemics, and natural catastrophes as categories where broad coverage may become unaffordable or unavailable, prompting insurers to define and exclude them. The scope and application of such an exclusion are entirely dependent on the specific wording, including how a 'systemic event' is defined, any thresholds or triggers, related exclusions (for example infrastructure or war exclusions), and the governing jurisdiction. This term denotes a coverage-restricting mechanism and should not be confused with resilience concepts or with regulatory constructs that share similar terminology; for instance, a financial-sector 'systemic risk exception' permitting extraordinary intervention is a distinct legal concept and not an insurance exclusion. Note that actual events meeting a 'systemic' characterization have to date been described as rare, so the practical reach of a given exclusion may remain untested and subject to dispute over wording.

Why it matters

Systemic event exclusions sit at the point where the economics of insurance meet the limits of what a private market can absorb. Ordinary insurance works by pooling uncorrelated risks, but a single large-scale event, a widespread cyber-attack, a pandemic, or a natural catastrophe, can trigger simultaneous claims across an insurer's entire portfolio. European supervisory guidance has noted that as the frequency of systemic events increases, there is a risk that insurance products covering them become unaffordable or unavailable. Exclusions of this kind are the mechanism insurers use to manage that accumulation and tail risk, and their presence directly shapes what protection a buyer actually holds.

For the insured, the practical significance is that a loss which feels catastrophic and clearly cyber-related may nonetheless fall outside cover if it is characterized as systemic. Whether that happens depends entirely on how the specific policy defines a 'systemic event,' what thresholds or triggers apply, and how the exclusion interacts with related carve-outs such as infrastructure or war exclusions. Because meaningfully large-scale failures that would be described as 'systemic' have to this point been described as exceedingly rare, the practical reach of any given exclusion often remains untested. That untested quality is itself a risk: the boundaries of coverage may only become clear during a dispute, at the worst possible moment for the policyholder.

This term should not be confused with similarly named concepts from other domains. A financial-sector 'systemic risk exception,' for example, is a distinct legal construct, a recognition that financial stability concerns can sometimes justify extraordinary intervention, and is not an insurance policy exclusion. It is also worth stressing that an exclusion restricts coverage; it does nothing to reduce the likelihood or severity of the underlying event. Buying insurance is a form of risk transfer, and where systemic losses are excluded, that transfer simply does not occur, leaving the exposure with the insured unless addressed through mitigation, avoidance, or acceptance.

Who it's relevant to

Risk managers and insurance buyers
Buyers need to understand that a systemic event exclusion can remove cover precisely when a widespread, high-impact event occurs. Reviewing how 'systemic event' is defined, what thresholds apply, and how the exclusion interacts with war and infrastructure carve-outs is essential to knowing what exposure is genuinely transferred and what remains retained. Where coverage is excluded, the residual risk must be managed through mitigation, avoidance, or deliberate acceptance rather than assumed away.
Brokers and underwriters
Underwriters use these exclusions to limit accumulation and tail risk across a portfolio, since a single large-scale event could otherwise generate correlated claims that make coverage unaffordable or unavailable to offer. Brokers must be able to explain to clients how a given insurer's wording defines and triggers the exclusion, and to flag genuine differences between forms. Because the reach of these exclusions is often untested, there is legitimate room for disagreement over how specific wording would apply to a real event.
CISOs and resilience planners
A systemic event exclusion is a coverage mechanism, not a resilience measure, and should not be mistaken for one. It does not reduce the likelihood or severity of a widespread cyber-attack or other systemic event. Security and continuity leaders should treat any excluded exposure as one that resilience planning, not insurance, must address, and should coordinate with risk management so that gaps between what is insured and what is controlled are understood.
Legal and compliance professionals
The precise construction of a systemic event exclusion, its definitions, thresholds, and interaction with other exclusions, determines its scope, and application varies by jurisdiction. Compliance teams should also be careful to distinguish this insurance exclusion from similarly named constructs in other fields, such as the financial-sector systemic risk exception, which is a separate legal concept concerning extraordinary intervention rather than a limit on insurance coverage.

Inside Systemic Event Exclusion

Triggering Scope
The defined category of large-scale or correlated events the exclusion targets, which may include widespread software vulnerabilities, cascading supply-chain compromises, or events affecting many insureds simultaneously. The precise reach depends entirely on the specific wording, and different insurer forms describe the triggering scope differently.
Definitional Language
The contractual definition of what constitutes a 'systemic' or 'widespread' event, often tied to thresholds such as the number of affected entities, geographic spread, or a common root cause. Because there is no single industry-standard definition, the operative meaning varies between forms and must be read in the context of the whole policy.
Relationship to Other Exclusions
How the systemic event exclusion interacts with adjacent exclusions such as war, hostile cyber operations, and critical-infrastructure exclusions. These can overlap or be drafted to operate together, and whether a given loss falls under one, several, or none depends on the specific wording and the facts.
Affected Coverage Lines
The exclusion may apply across both first-party coverages (such as business interruption or data restoration) and third-party coverages (such as privacy liability or regulatory defense), or it may be limited to certain grants. Which lines are affected is determined by where and how the exclusion is placed within the policy.
Carve-Backs and Sublimits
Some forms restore limited coverage for otherwise-excluded systemic events through carve-backs, sublimits, or specific endorsements. The availability and dollar scope of any such carve-back is subject to negotiation and the specific wording, and cannot be assumed to exist.
Burden and Application
As an exclusion, it typically operates to remove coverage that would otherwise apply, and questions of who must demonstrate its applicability and how it is interpreted may vary by jurisdiction and the surrounding policy conditions.

Common questions

Answers to the questions practitioners most commonly ask about Systemic Event Exclusion.

Does a systemic event exclusion mean any large or widespread cyber incident is automatically excluded from my policy?
Not necessarily. A systemic event exclusion is defined by the specific wording of the policy, not by the size of the loss or the number of organizations affected. An event being large or widely reported does not by itself trigger the exclusion; what matters is whether the event meets the definitional criteria set out in the clause, such as how the policy characterizes a systemic or widespread failure, the source of the disruption, and any thresholds or triggering conditions the insurer has drafted. Some incidents that are large in aggregate may still be covered if they fall outside the specific definition, and the scope varies materially between insurer forms. Always read the exclusion against its own defined terms rather than assuming breadth from the impact alone.
Is a systemic event exclusion just another name for a war exclusion?
No. They are distinct clauses that can appear in the same policy and may overlap in some fact patterns, but they address different concepts. A war exclusion typically turns on the character of the actor or act (for example hostile or state-backed action), while a systemic event exclusion typically turns on the scope and interconnected nature of the disruption (for example a widespread failure affecting many insureds simultaneously). A single incident could potentially implicate both, one, or neither, depending on the facts and the specific wording. Treating them as interchangeable can lead to misreading what is actually excluded, so each clause should be analyzed on its own terms.
How can I tell whether a particular incident falls within our policy's systemic event exclusion?
Start with the exclusion's own defined terms and any triggering criteria, then map the facts of the incident against them. Relevant questions typically include how the policy defines a systemic or widespread event, whether there is a threshold or qualifying condition, whether the exclusion is triggered by the cause of the disruption or by its downstream reach, and how it interacts with other exclusions and with any carve-backs. Because coverage under any exclusion depends on the specific wording, endorsements, and jurisdiction, an incident-specific determination usually requires coverage counsel and close reading rather than a general rule.
What should we ask a broker or underwriter about the systemic event exclusion during placement or renewal?
Ask for the exact wording of the exclusion and any associated definitions rather than a summary. Useful lines of inquiry include how the insurer defines the triggering event, whether there are carve-backs that preserve some coverage, whether sublimits apply to affected exposures, how the clause interacts with war, infrastructure, and failure-to-maintain exclusions, and whether alternative forms or endorsements with narrower wording are available. Comparing wording across quotes matters because these clauses are not standardized and differ materially between forms.
Does buying cyber insurance with a systemic event exclusion address our exposure to a widespread outage?
Insurance is a risk transfer mechanism, and an exclusion narrows what is transferred; it does not reduce the likelihood of an incident or improve recovery capability. If a systemic event exclusion applies to a widespread outage scenario, the financial exposure for that scenario may remain with your organization. Addressing that residual exposure is a matter of risk management decisions, which may include mitigation measures, resilience planning such as continuity and recovery capabilities, and consideration of risk acceptance or alternative transfer options. The exclusion should inform, not replace, those decisions.
How does a systemic event exclusion affect our residual risk and continuity planning?
Because the exclusion may leave certain widespread-disruption scenarios uninsured or subject to reduced limits, those scenarios represent residual risk that continuity and recovery planning may need to address directly rather than relying on the policy to respond. This is where resilience concepts stay distinct from coverage: recovery objectives, continuity arrangements, and incident and crisis response capabilities operate regardless of whether a loss is ultimately covered. Aligning the scenarios excluded under the policy with the scenarios your resilience program prioritizes helps identify gaps where the organization would bear both the operational and the financial impact.

Common misconceptions

A systemic event exclusion is the same thing as a war or cyber-terrorism exclusion.
They are distinct provisions that may overlap but are not interchangeable. A systemic event exclusion generally addresses the correlated, widespread nature of a loss, while war and hostile-operation exclusions address the nature or attribution of the causing act. Whether any of them applies to a given loss depends on the specific wording and the facts, and more than one could be implicated.
If an event affects many organizations, coverage is automatically excluded.
Application is not automatic. Whether the exclusion bites depends on how the policy defines the triggering scope and thresholds, whether any carve-backs or sublimits apply, and how the wording is interpreted in the relevant jurisdiction. Broad impact alone does not determine the outcome without reading the operative language.
Having cyber insurance means an insured is protected against, and prepared for, systemic cyber events.
Insurance is a risk-transfer mechanism and does not reduce the likelihood of a systemic event or by itself constitute resilience. A systemic event exclusion may in fact remove transfer for exactly the correlated scenarios an organization is most concerned about, making mitigation, continuity, and recovery planning essential complements rather than substitutes.

Best practices

Read the systemic event exclusion together with the war, hostile cyber operation, and critical-infrastructure exclusions to understand how they interact and where coverage gaps or overlaps arise under the specific wording.
Identify the exact definitional thresholds the policy uses for 'systemic' or 'widespread' events, and confirm how they are measured rather than relying on an intuitive understanding of the term.
Determine which coverage lines the exclusion reaches, distinguishing first-party impacts such as business interruption and data restoration from third-party impacts such as privacy liability and regulatory defense.
Negotiate and document any available carve-backs, sublimits, or endorsements, and confirm their scope in writing rather than assuming restored coverage exists.
Treat the exclusion as a driver of risk mitigation, business continuity, and disaster recovery planning, since transfer may be unavailable for correlated events the organization is most exposed to.
Engage brokers and legal or compliance advisers to assess how the exclusion may be interpreted in the applicable jurisdiction, recognizing that meaning and application can vary across insurer forms and regulatory regimes.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide