• By Raymond Momanyi

Cyber Insurance Claims Kenya: Incident Response Guide

Learn how to file a cyber insurance claim in Kenya after ransomware, data loss, cybercrime, business interruption or a personal-data breach.

A cyber incident moves quickly.

Within minutes, criminals can encrypt files, redirect payments, copy customer information and spread through connected systems. Within hours, the business may face operational disruption, customer questions and regulatory reporting decisions.

What an organisation does during those first hours can determine both the scale of the damage and whether its cyber insurance claim proceeds smoothly.

Quick answer: After discovering a cyber incident, activate the organisation’s response plan, contact the cyber insurer immediately, preserve digital evidence, isolate affected systems, engage approved specialists and begin assessing regulatory notification duties. Do not delete logs, rebuild systems, contact attackers or pay a ransom without professional guidance.

Imana Insurance Agency Kenya Ltd helps businesses notify cyber insurers, understand claims requirements and coordinate communication during the claims process.

Start a claim through the Imana Claims Request Page.

What is a cyber insurance claim?

A cyber insurance claim is a request for an insurer to meet eligible costs or liabilities arising from a cyber incident covered by the policy.

An incident may involve:

• Ransomware
• Data breach
• Malware
• Business-email compromise
• Phishing
• Social-engineering fraud
• Unauthorised fund transfer
• Data destruction
• System interruption
• Privacy liability
• Network-security failure
• Cyber extortion
• Failure of a technology provider
• Lost or stolen equipment containing data

Not every computer problem is an insured cyber incident.

Ordinary hardware failure, gradual deterioration, planned system maintenance and known problems existing before the policy began may be excluded.

The insurer must examine the incident against the policy wording, limits, exclusions and declarations made when the cover was purchased.

The first hour after discovering a cyber incident

The first hour should focus on containment, evidence and notification.

1. Activate the incident-response plan

Notify the people responsible for:

• Information technology
• Cybersecurity
• Legal and compliance
• Data protection
• Finance
• Senior management
• Business continuity
• Communications
• Insurance

Appoint one incident coordinator. Uncontrolled decision-making can produce inconsistent instructions and destroy evidence.

2. Contact the cyber insurer immediately

Use the emergency telephone number or reporting channel shown in the policy.

Provide the available facts:

• Policyholder’s name
• Policy number
• Date and time the incident was discovered
• Systems affected
• Nature of the suspected event
• Whether operations have stopped
• Whether personal data may be involved
• Whether money has been lost
• Whether a ransom demand has been received
• Immediate containment steps taken

Do not wait until the investigation is complete. The full nature of a cyber incident may take days to understand.

3. Contact Imana Insurance Agency

Imana can help the policyholder:

• Confirm insurer notification details
• Locate the policy schedule
• Obtain the claim form
• Open communication with the insurer
• Identify required documents
• Follow up on appointment of specialists
• Maintain a claims correspondence record

Imana cannot replace the organisation’s IT, legal or forensic advisers, but it can help coordinate the insurance pathway.

4. Isolate affected systems

The IT or cybersecurity team may need to disconnect affected devices from the network to prevent further spread.

Possible immediate actions include:

• Disconnecting compromised devices
• Restricting remote access
• Disabling affected user accounts
• Blocking malicious domains
• Suspending compromised credentials
• Separating clean backups
• Restricting unnecessary network connections

Do not wipe, reformat or dispose of affected devices unless authorised by the incident-response specialists. Isolation preserves evidence; destruction can erase it.

5. Protect unaffected backups

Confirm whether backups are:

• Available
• Recent
• Separated from the compromised network
• Free from malware
• Capable of being restored

Do not connect clean backups to infected systems prematurely. Attackers sometimes compromise backups before activating ransomware.

Preserve digital evidence

Evidence helps determine what happened, how the attacker entered, what information was accessed and whether the claim is covered.

Preserve:

• System logs
• Firewall logs
• Email headers
• Suspicious emails
• Screenshots
• Ransom notes
• Malicious attachments
• Affected devices
• Access records
• Login histories
• Bank-payment instructions
• CCTV where relevant
• Security alerts
• Backup records
• Communications with the attacker
• Employee statements
• Service-provider correspondence

Record who collected each item, when it was collected and where it is stored.

Do not forward malicious attachments casually. The incident-response team should provide a secure evidence-transfer process.

Do not admit liability publicly

A serious breach can attract questions from customers, employees, journalists, regulators and business partners.

Avoid speculative statements about:

• Who caused the incident
• How much information was stolen
• Whether customers are safe
• Whether the business was negligent
• Whether a ransom will be paid
• When every system will return
• Whether the insurer will pay

Public communication should be coordinated with legal, privacy and communications specialists.

Be truthful, but do not announce conclusions before the forensic investigation establishes the facts.

Use insurer-approved incident-response specialists

Cyber policies often provide access to an approved response panel.

This may include:

• Digital-forensics investigators
• Cybersecurity specialists
• Privacy lawyers
• Ransomware negotiators
• Data-restoration professionals
• Customer-notification providers
• Public-relations advisers
• Credit-monitoring services

Before appointing an external provider, ask the insurer:

• Is prior approval required?
• Is the provider on the insurer’s panel?
• What rates are approved?
• Which policy section will pay the cost?
• Does a sublimit apply?
• Will the cost erode the overall limit?

Emergency action may be necessary to prevent further loss, but all decisions and reasons should be documented.

Reporting a cyber incident to KE-CIRT

The National Kenya Computer Incident Response Team Coordination Centre provides an official channel for reporting cyber incidents and seeking assistance.

KE-CIRT’s published reporting channels include its online portal, incidents@ke-cirt.go.ke, and dedicated telephone hotlines.

Reporting to KE-CIRT may be appropriate for incidents involving:

• Malware
• Ransomware
• Phishing
• Website compromise
• Distributed denial-of-service attacks
• System intrusion
• Online fraud
• Compromised accounts
• Critical infrastructure
• Threats affecting multiple organisations

Contacting KE-CIRT does not replace insurer notification or reporting to the Office of the Data Protection Commissioner.

Does a data breach need to be reported to the ODPC?

Kenya’s Data Protection Act contains notification requirements where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the affected data subject.

A qualifying breach should be reported to the Data Commissioner without delay and within 72 hours of the data controller becoming aware of it. Where notification is submitted after 72 hours, reasons for the delay are required.

Data processors have separate duties to notify the data controller.

The Office of the Data Protection Commissioner provides an official breach-reporting form for data controllers and processors. The form requests details about:

• The breach
• The information involved
• Affected people
• Immediate containment
• Planned corrective action
• Communication with data subjects
• Reports made to other regulators
• Supporting documents

(Office of the Data Protection ...)

Not every technical event triggers the same notification requirement. Obtain prompt legal and data-protection advice.

The insurer should be informed before regulatory submissions where possible, but waiting for insurance confirmation must not cause the organisation to miss a legal deadline.

How to make a ransomware claim

After discovering ransomware:

1. Disconnect affected systems where technically appropriate.
2. Contact the insurer’s incident-response hotline.
3. Preserve the ransom note and evidence.
4. Do not delete encrypted files.
5. Protect clean backups.
6. Engage approved forensic specialists.
7. Notify legal advisers.
8. Assess reporting obligations.
9. Record operational downtime.
10. Document every recovery expense.

Do not pay the ransom independently.

Ransom payment may be unlawful, uninsurable or prohibited by the policy. Payment can also expose the organisation to further demands without guaranteeing system recovery.

Where cyber-extortion cover applies, the insurer may appoint specialists to evaluate the demand, threat actor and available recovery options.

How to make a data-restoration claim

The organisation should document:

• Systems and data affected
• Date of the last known clean backup
• Restoration work required
• Providers appointed
• Labour hours
• Software licences
• Replacement configurations
• Data reconstruction
• Testing and verification
• Costs already incurred

The policy may pay the reasonable cost of restoring data and systems to their pre-incident condition.

It may not pay for:

• System improvements
• Unrelated technology upgrades
• Betterment
• Ordinary maintenance
• Pre-existing system problems
• Unsupported software
• Costs incurred without approval

Separate restoration work from general IT upgrades in quotations and invoices.

How to claim cyber business-interruption losses

Cyber business-interruption claims require detailed financial evidence.

Immediately begin recording:

• When the interruption started
• Which systems were unavailable
• When each system was restored
• Activities that could not be performed
• Orders lost
• Revenue affected
• Additional operating costs
• Temporary systems used
• Staff overtime
• Emergency vendor costs
• Customer cancellations
• Production delays
• Mitigation measures

The insurer may require:

• Audited financial statements
• Management accounts
• Sales records
• Bank statements
• Tax records
• Historical revenue
• Budgets and forecasts
• Daily transaction records
• Evidence of lost orders
• Additional-expense invoices
• Accountant’s report

The policy may include a waiting period. Losses arising during that initial period may remain with the insured.

The organisation must also take reasonable steps to reduce the interruption. Record every mitigation decision and its cost.

Claims involving an outsourced technology provider

If a cloud, payment, hosting, software or other technology provider suffers the incident:

• Notify the cyber insurer immediately
• Obtain the provider’s incident notice
• Preserve the service contract
• Request the incident timeline
• Record system unavailability
• Document financial loss
• Ask whether customer information was affected
• Request confirmation of restoration steps
• Preserve service-level reports

Cover will depend on whether dependent business interruption or outsourced-provider failure is insured.

The provider’s outage does not automatically make the organisation’s cyber policy respond.

How to claim social-engineering or funds-transfer losses

Where an employee sends money after receiving fraudulent instructions:

1. Contact the bank or payment provider immediately.
2. Ask for the transfer to be recalled or frozen.
3. Notify the police and other relevant authorities.
4. Inform the cyber or crime insurer.
5. Preserve the fraudulent email or message.
6. Preserve email headers and login records.
7. Suspend compromised accounts.
8. Contact the genuine supplier or executive through a trusted channel.
9. Document the verification procedure that was followed.
10. Record recovery attempts.

The insurer may ask:

• Who authorised the payment?
• How were the instructions received?
• Were bank details changed?
• Was a call-back verification required?
• Were two authorisations used?
• Was the employee’s account compromised?
• Was the transfer voluntary?
• How quickly was the bank informed?

Social-engineering losses are not automatically covered under every cyber policy. A specific extension and sublimit may be required.

Documents required for a cyber insurance claim

Requirements will depend on the incident, but the insurer may request:

• Completed claim form
• Policy schedule
• Incident timeline
• Internal incident report
• Forensic report
• System and access logs
• Ransom note
• Suspicious emails
• Screenshots
• Police report
• KE-CIRT report
• ODPC notification
• Correspondence with affected people
• Legal reports
• IT-provider invoices
• Data-restoration invoices
• Business-interruption calculation
• Financial statements
• Bank records
• Proof of fraudulent transfers
• Technology-provider contracts
• Backup records
• Security policies
• Proof of declared security controls
• Employee statements
• Previous incident information

Keep a master document index showing when each item was requested and submitted.

Keep an incident and claims timeline

Create one chronological record showing:

• When the incident began, if known
• When it was discovered
• Who discovered it
• Systems affected
• Containment actions
• Insurer notification
• Specialist appointments
• Regulatory reports
• Customer communication
• System restoration
• Expenses incurred
• Business interruption
• Decisions made

The timeline should use confirmed facts. Where a time or event remains uncertain, identify it as an estimate.

This record helps the insurer, forensic team, legal advisers and regulators work from consistent information.

How does the insurer assess a cyber claim?

The insurer may examine:

• Whether the policy was active
• Whether the incident meets an insured definition
• When the organisation first knew about it
• Whether it was disclosed before policy inception
• Whether notification was prompt
• Which systems and entities are insured
• Whether required security controls existed
• Whether approved providers were used
• Which losses fall under each policy section
• Whether exclusions apply
• Whether costs were reasonable
• Whether a waiting period or sublimit applies
• Whether another insurance policy may respond

The insurer may appoint forensic accountants to evaluate business-interruption losses and technical experts to investigate the incident.

Cooperate with reasonable requests while maintaining legal privilege and confidentiality where applicable.

Common reasons cyber claims are delayed

Cyber claims can be delayed by:

• Late notification
• Incomplete forensic investigation
• Unclear incident timeline
• Missing system logs
• Unauthorised response expenses
• Delayed regulatory assessment
• Difficulty identifying affected data
• Business-interruption calculations
• Disagreement about restoration costs
• Several policies potentially responding
• Questions about security controls
• Third-party technology-provider investigations
• Continuing law-enforcement enquiries

A delayed claim has not necessarily been declined.

Ask the insurer to identify the outstanding requirements and whether any undisputed expenses can be processed separately.

Common reasons cyber claims are declined

A cyber claim may be declined where:

• The incident began before the policy or retroactive date
• A known circumstance was not disclosed
• The event does not meet the policy definition
• The affected system or entity was not insured
• The loss falls under an exclusion
• Required security controls were misrepresented
• The organisation failed to maintain a policy condition
• The loss involves ordinary system failure
• Social engineering was not included
• The stolen money was outside the cybercrime section
• Costs were incurred without necessary approval
• The organisation voluntarily shut down systems without a covered trigger
• The claim involves an excluded war or infrastructure event
• The loss exceeds the relevant sublimit

Request every rejection in writing together with the policy clauses relied upon.

For dispute guidance, read How to Challenge a Rejected Insurance Claim in Kenya.

What should the business avoid after an incident?

Avoid:

• Wiping affected devices
• Deleting logs
• Paying ransom independently
• Reconnecting infected systems
• Restoring untested backups
• Appointing expensive providers without checking the policy
• Concealing information from the insurer
• Making speculative public statements
• Admitting legal liability
• Altering evidence
• Continuing compromised payment instructions
• Waiting for complete answers before notifying the insurer
• Assuming an external IT provider has reported the claim

Every emergency decision should be recorded with the reason it was necessary.

Who should lead the cyber claim?

A cyber claim normally requires cooperation among:

• Senior management
• IT and cybersecurity
• Legal counsel
• Data-protection officer
• Finance
• Communications
• Business-continuity team
• Insurer
• Insurance intermediary
• Forensic specialists
• External technology providers

One authorised incident leader should coordinate decisions and maintain the official timeline.

Employees should know where to direct customer, media and regulator questions.

What can Imana do during a cyber claim?

Imana Insurance Agency Kenya Ltd can help the insured organisation:

• Locate the policy and reporting contacts
• Notify the insurer
• Obtain the claim form
• Clarify document requirements
• Follow up on specialist appointment
• Track insurer requests
• Coordinate claims correspondence
• Request progress updates
• Explain limits, excesses and sublimits
• Support a structured complaint where necessary
• Review coverage before renewal

Imana cannot:

• Conduct the forensic investigation
• Determine whether a breach must be reported
• Give legal advice
• Negotiate with attackers without authority
• Guarantee claim payment
• Approve expenses for the insurer
• Overrule a claim decision

The insurer retains responsibility for assessing the insurance claim. Legal and regulatory decisions require appropriately qualified advisers.

Cyber insurance claim checklist

After an incident, confirm that the organisation has:

• Activated its incident-response plan
• Contacted the insurer
• Contacted Imana
• Isolated affected systems
• Protected clean backups
• Preserved digital evidence
• Appointed approved specialists
• Opened an incident timeline
• Assessed ODPC reporting duties
• Considered KE-CIRT notification
• Notified the bank where money is involved
• Recorded downtime
• Preserved invoices and receipts
• Avoided unauthorised ransom payments
• Kept communication controlled
• Submitted the claim form
• Responded to insurer requests
• Retained copies of every document

Frequently asked questions

How quickly should a cyber claim be reported?

Immediately after discovery. Do not wait for the forensic investigation to establish every detail.

Should the business switch off every system?

Not automatically. Isolate affected systems under technical guidance. A careless shutdown can destroy evidence or interrupt essential services unnecessarily.

Can the company use its regular IT provider?

Possibly, but check whether the insurer requires an approved incident-response provider. The regular IT company may also lack forensic or breach-response expertise.

Does the business have 72 hours to notify the insurer?

Not necessarily. The 72-hour provision relates to qualifying personal-data breach notification under the Data Protection Act. The insurance policy may require immediate notification.

Must every cyber incident be reported to the ODPC?

Not every technical event necessarily meets the statutory reporting threshold. Obtain prompt legal or data-protection advice.

Does the policy pay ransomware demands?

Only where cyber-extortion payments are lawful, insurable and covered. Never pay independently.

Is stolen money automatically covered?

No. Cybercrime, social-engineering or funds-transfer protection may require a specific extension.

Can the business restore systems immediately?

Containment and recovery should begin quickly, but evidence must be preserved and insurer approval obtained where required.

How is cyber business interruption calculated?

The insurer examines lost income and reasonable additional expenses, considering historical financial records, trends, mitigation and the policy’s waiting and indemnity periods.

Can Imana approve the claim?

No. Imana assists with notification, documentation, communication and follow-up, while the insurer decides whether the policy responds.

Build the claims process before the incident

The worst time to search for the cyber policy is after the network has gone dark.

Before an incident, every insured organisation should know:

• Where the policy is stored
• Who can notify the insurer
• The emergency hotline
• The policy excess
• The interruption waiting period
• Which providers must be used
• Who handles regulatory notifications
• Where clean backups are kept
• Who can communicate publicly
• Who can approve emergency expenditure

Conduct a response exercise at least periodically. Test the process without waiting for a real attack.

Explore Imana’s cyber insurance knowledge cluster

Read:

• Cyber Insurance in Kenya: Data Breaches, Ransomware and Business Interruption
• Cyber Insurance Cost Guide Kenya
• Why Kenyan Businesses Need Cyber Insurance
• Insurance Claims Knowledge Centre Kenya
• How to Challenge a Rejected Insurance Claim in Kenya

Compare cyber insurance quotations in Kenya

The strength of a cyber claim begins with the cover purchased before the incident.

Compare:

• Incident-response services
• Ransomware protection
• Data restoration
• Business interruption
• Dependent business interruption
• Privacy liability
• Cybercrime
• Social engineering
• Regulatory investigation costs
• Limits and sublimits
• Policy excesses
• Security conditions
• Retroactive dates
• Territorial scope

Submit a Corporate Insurance Quotation or request guided comparison through ImanaInsurance.com.

Visit Imana.co.ke for Kenyan insurance authority resources and MyKava.co.ke for travel, medical and digital insurance comparison.

Contact Imana Insurance Agency Kenya Ltd

Imana Insurance Agency Kenya Ltd
4th Floor, Krishna Centre
Woodvale Grove, Westlands, Nairobi
Call/WhatsApp: +254 796 209 402

Websites:

• www.imanainsurance.com — quotation comparison and customer enquiries
• www.imana.co.ke — insurance authority and product information
• www.mykava.co.ke — travel, medical and insurance comparison

Imana Insurance Agency Kenya Ltd is a Westlands-based insurance intermediary helping individuals, families and businesses compare insurance quotations from licensed Kenyan insurers across Motor, Medical, WIBA, PSV, Travel, Motorcycle, Cyber, SME/Corporate and other insurance classes.

Author: Raymond Momanyi
Founder & CEO, Imana Insurance Agency Kenya Ltd

Disclaimer: This guide provides general information and is not a substitute for the cyber policy, professional incident-response advice or legal guidance. Cyber claims, breach-reporting duties, limits and exclusions depend on the incident, policy and applicable law.