Cyber Business Interruption Waiting Period: How to Measure an Outage

The waiting period is a clock, not a coverage exclusion

Cyber business-interruption coverage typically starts paying for lost income only after a defined waiting period has elapsed from the start of a qualifying outage. An outage shorter than that window can still generate real forensic, response, and reputational costs — those are usually covered under separate insuring agreements — while the income-loss portion specifically pays nothing, because the clock never finished running.

This surprises business owners who assume "covered incident" means every resulting cost is paid the same way. In practice, the waiting period applies narrowly to the income-loss calculation, not to the whole claim.

A ten-hour outage tests every definition in the policy

An online consultancy loses access to its cloud workspace for ten hours after an account compromise. Staff are paid regardless, client deliverables are delayed, and a forensic vendor is brought in the same day. If the policy's waiting period is, say, twelve hours, this outage produces real forensic and response costs but no income-loss payment — even though the disruption was genuine and expensive in staff time.

The exact math depends on how the policy defines when the outage "started" and when operations "resumed" — questions that sound simple until an actual timeline has to be reconstructed under pressure.

Start and end times are not always obvious

Discovery time and actual outage start time are frequently different — an account can be compromised hours before anyone notices systems are unavailable. Using discovery time when the real outage started earlier can understate the duration; using it when the outage actually started later can overstate it. Neither error helps the claim.

Partial restoration adds another wrinkle: if half the affected systems come back online while the rest are still down, the policy's restoration definition — not a general sense that things are "mostly fixed" — determines when the waiting-period clock effectively stops.

What the timeline needs to show

One person, separate from the technical response team, should own the operational timeline from the moment the outage is discovered — because the people fixing the problem are rarely the ones with time to document it precisely.

• Exact time systems became unavailable, distinguished from discovery time
• Time material operations actually resumed, per the policy's definition
• Which specific services were affected, and for how long each
• Staff downtime and any canceled or delayed client work
• Whether the outage originated in the business's own systems or a dependent vendor

Frequently asked questions