Cyber Insurance in the District of Columbia

A person or entity conducting business in D.C. that owns or licenses computerized or other electronic data with personal information must promptly notify affected residents; the code sets no fixed day count. The District government and its agencies or instrumentalities are excluded from “person or entity.” The breach definition has three independent exclusions: qualifying good-faith employee or agent acquisition without improper use or further unauthorized disclosure; data secured so an unauthorized third party cannot use it unless acquired information could compromise the protection; or, after reasonable investigation and consultation with both the D.C. Attorney General and federal law-enforcement agencies, a reasonable determination that acquisition likely will not harm the individual. A maintainer, handler, or possessor of data it does not own must alert the owner or licensee promptly. Law enforcement may delay notice when an agency determines notice will impede a criminal investigation; notice resumes as soon as possible after it determines notice will not compromise the investigation. The separate written D.C. Attorney General filing still applies at 50 or more residents by resident-notice time, including under qualifying federal resident-notice procedures.

What Is Cyber Insurance?

Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.

What to Watch for With Cyber in District of Columbia

Prompt Notice Has No Day Count
After discovery, a person or entity conducting business in D.C. that owns or licenses computerized or other electronic data with personal information must promptly notify affected residents; the statute sets no fixed day count. The no-harm determination is one of three independent breach exclusions. The other two are qualifying good-faith employee or agent acquisition for business purposes without improper use or further unauthorized disclosure, and secured data unusable to an unauthorized third party unless acquired information could compromise the protection. The District government and its agencies or instrumentalities are not included in “person or entity.” ^1,²
The D.C. Attorney General Threshold Is 50
Written D.C. Attorney General notice is required when a breach affects 50 or more District residents and is due no later than resident notice. You cannot defer this filing until the final affected-resident count is known; the filing must include known counts, breach dates, cause, remedial steps, and a sample consumer notice. ¹
More Than 1,000 Notices Adds Credit Agencies
When a person or entity must notify more than 1,000 people, it must also tell nationwide consumer reporting agencies the timing, distribution, and content of its notices; a GLBA reporting exception applies. Ask who tracks this separate recipient threshold and coordinates the filing. ¹
Consumer Notices Need Freeze and Agency Contacts
D.C. notices must include the categories of exposed information, the notifying entity’s contact details, major credit-reporting agencies’ toll-free numbers and addresses, and the resident’s free security-freeze right. The notice also needs FTC and D.C. Attorney General contact details, including telephone numbers, addresses, and websites. ¹
Federal Procedures Can Replace Resident-Notice Mechanics
A person maintaining GLBA or HHS HIPAA/HITECH breach-notification procedures and giving resident notice under those procedures is deemed compliant with § 28-3852 as to resident notice. The written Attorney General filing still applies when the breach affects 50 or more District residents; the filing cannot be delayed because the final count is not yet known. Check that the entity and incident meet the federal-route conditions and track the District threshold. ¹
A Criminal-Investigation Finding Can Delay Notice
Under § 28-3852(d), notice may be delayed if a law-enforcement agency determines that notification will impede a criminal investigation. Notice must be made as soon as possible after that agency determines it will not compromise the investigation. The code does not state a separate request or documentation condition; track the agency’s determination and resumption point. ¹
A Data Handler Must Alert the Owner or Licensee
A person or entity that maintains, handles, or otherwise possesses computerized or other electronic data with personal information it does not own must notify the owner or licensee of a breach in the most expedient time possible after discovery. Identify each vendor holding another party’s data and the incident contact responsible for this handoff. ¹

Which Cyber Providers Have District of Columbia License Records?

These providers publish a national listing for Cyber liability; the license records below name the licensed entities and roles. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in District of Columbia. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.

At-Bay
Insurance producer, Surplus-lines broker · checked 2026-09-28
At-Bay Insurance Services LLC
At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. ¹¹
At-Bay offers primary and excess cyber insurance for businesses with revenue up to $5 billion.
Coalition
Insurance producer, Surplus-lines broker · checked 2026-09-28
Coalition Insurance Solutions, Inc.
Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. ¹²
Coalition offers cyber insurance.
Corgi
Insurance producer · checked 2026-09-28
Corgi Insurance Services, Inc.
Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. ¹³
Corgi lists cyber insurance among its business insurance offerings.
Hiscox
Insurer · checked 2026-09-28
Hiscox Insurance Company Inc.
Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. ¹⁴
Hiscox offers cyber insurance for small businesses.
TechInsurance
Insurance producer · checked 2026-09-28
Specialty Program Group LLC
TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. ¹⁶
TechInsurance arranges cyber insurance for small businesses.
Vouch
Insurance producer, Surplus-lines broker · checked 2026-09-28
Vouch Specialty Insurance Services, LLC
Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. ¹⁷
Vouch lists cyber liability in its technology-company programs.

Who Regulates Insurance in District of Columbia?

District of Columbia Department of Insurance, Securities and Banking

DISB licenses and supervises insurance companies and producers, enforces District insurance laws, and provides consumer complaint assistance. Its licensing search covers insurance entities and representatives; consumers can contact the agency’s complaints unit for help. ^4,^5,⁷

Website: Regulator website
License lookup: Search licensed producers
Complaints: File a complaint
Phone: (202) 727-8000

Surplus-Lines Tax and Stamping Office in District of Columbia

Reported tax rate. Generally 2% of gross premium, including qualifying placement fees ^6,^8,^9,^10,³

When the District is the insured’s home state, surplus-lines agents and brokers generally owe a 2% tax on gross premium, including necessary fees incidental to placement when separately itemized. An agent or broker procuring insurance on behalf of the District government is exempt for that government business; claiming the exemption requires identifying its allocation in the required affidavit and does not waive other statutory duties. Ask the broker which taxes and fees your agreement passes through to you. DISB generally requires a diligent effort to place risks with authorized insurers. For a purchaser meeting the federal exempt-commercial-purchaser definition, the broker may skip that search only after disclosing that insurance may or may not be available from the admitted market, which may provide greater protection with more regulatory oversight, followed by the purchaser’s written request for nonadmitted placement. This record does not state a District-specific guaranty-fund conclusion.

Questions to Ask Before You Buy Cyber in District of Columbia

Who records the D.C. discovery date and any law-enforcement agency determination that delays notice, and who resumes notice when the agency clears it?
If 50 or more District residents are affected, will the filing go to the D.C. Attorney General before the final count is known?
Does the notice package include the required credit-agency, FTC, D.C. AG, and free-freeze information?
If more than 1,000 people require notice, who coordinates the nationwide consumer-reporting-agency report?
Do our GLBA or HIPAA/HITECH procedures qualify for D.C.’s resident-notice route, and who preserves the separate Attorney General filing?
Which vendor maintains, handles, or possesses our personal information, and who must promptly alert us if that data is breached?

Cyber Insurance in District of Columbia: Frequently Asked Questions

How many days does a D.C. business have to report a data breach to residents?

Promptly; the statute sets no fixed day count. The no-harm finding is one of three independent exclusions. Separate exclusions cover qualifying good-faith employee or agent acquisition without improper use or further unauthorized disclosure, and secure data unusable to an unauthorized third party unless acquired information could compromise the protection. A qualifying no-harm finding requires reasonable investigation and consultation with both the D.C. Attorney General and federal law-enforcement agencies. ^1,²

When must a business notify the D.C. Attorney General after a breach?

When 50 or more District residents are affected, no later than resident notice. The filing cannot wait for the final affected-resident count. ¹

Does D.C. require notice to credit bureaus after a breach?

Yes, when the person or entity must notify more than 1,000 people; nationwide consumer reporting agencies receive the timing, distribution, and content of notices, subject to the GLBA exception. ¹

Can a D.C. business use its federal breach-notification procedures for resident notices?

Yes, if the person maintains qualifying GLBA or HIPAA/HITECH procedures and notifies affected residents under them. The written Attorney General filing still applies when at least 50 District residents are affected, and it cannot be delayed just because the final count is unknown. ¹

Sources for Cyber Insurance in District of Columbia

1
D.C. Code § 28-3852 - Notification of Security Breach. Council of the District of Columbia, D.C. Law Library; D.C. Code § 28-3852(a)–(d), (g): prompt resident notice; maintainer/handler alert under (b); D.C. AG threshold under (b-1)–(b-2); >1,000 CRA reporting under (c); law-enforcement delay and resumption under (d); federal resident-notice route under (g). Accessed 2026-09-28.
2
D.C. Code § 28-3851 - Definitions. Council of the District of Columbia, D.C. Law Library; D.C. Code § 28-3851(1)(A)–(B)(i)–(iii): breach definition and three independent exclusions; (2A) excludes D.C. government and agencies/instrumentalities from “person or entity”; (3) personal-information definition. Accessed 2026-09-28.
3
D.C. Code §31–2502.40: License to procure policies from unauthorized companies. Council of the District of Columbia; Subsection (a): broker/agent tax and diligent effort; (c)(1)–(3): District-government procurement tax exemption, allocation statement and continuing duties. Accessed 2026-09-28.
4
Department of Insurance, Securities and Banking. District of Columbia DISB; Official insurance regulator homepage. Accessed 2026-09-28.
5
Verify a Financial Institution or Representative Licensed with DISB. District of Columbia DISB; Official license verification for companies and representatives. Accessed 2026-09-28.
6
Surplus Line Information. District of Columbia DISB; Current 2% tax base including incidental placement fees; fees must be necessary and separately itemized; diligent-effort rule. Accessed 2026-09-28.
7
File a Complaint or Report Fraud. District of Columbia DISB; Official insurance complaint information and filing form. Accessed 2026-09-28.
8
15 U.S.C. §8201: Reporting, payment, and allocation of premium taxes. U.S. House of Representatives, Office of the Law Revision Counsel; §8201(a): exclusive insured home-State authority to require nonadmitted premium tax; (c): separate allocation reporting. Accessed 2026-09-28.
9
15 U.S.C. § 8205: Streamlined application for commercial purchasers. U.S. House of Representatives, Office of the Law Revision Counsel; §8205(1)-(2): admitted-market disclosure about possible availability, greater protection and oversight followed by the qualified purchaser’s written request; eligibility separately defined in §8206(5). Accessed 2026-09-28.
10
15 U.S.C. §8206: Definitions. U.S. House of Representatives, Office of the Law Revision Counsel; §8206(5) exempt-commercial-purchaser criteria; (6) home State and affiliated-insured rules; (13) qualified risk manager. Accessed 2026-09-28.
11
Licenses. At-Bay; Current producer introduction and state table; At-Bay Insurance Services LLC; P&C and surplus-lines identifiers. Accessed 2026-09-21.
12
Licenses and Carriers. Coalition; Licenses and Carriers, re-read 22 September 2026: Insurance Licenses table for Coalition Insurance Solutions, Inc., national producer number 18419475, with producer and surplus-lines numbers for all 50 states and DC including California 0L76155, Georgia 196479, Texas 2199630 and 2205589, Pennsylvania 815731 and 817452, Colorado 539028 and Wisconsin 3000108852. Insurance Carriers table naming, with NAIC numbers, Allianz Underwriters Insurance Company 36420, Arch Specialty Insurance Company 21199, Ascot Specialty Insurance Company 45055, Ascot Insurance Company 23752, Aspen Specialty Insurance Company 10717, Chaucer Insurance Company DAC, Coalition Insurance Company 29530, Fireman's Fund Indemnity Corporation 11380, Fortegra Specialty Insurance Company 16823, Lloyd's of London, MSIG Specialty Insurance USA Inc. 34886, MS Transverse Specialty Insurance Company 41807, Steadfast Insurance Company 26387, Vantage Risk Specialty Insurance Company 16275 and Zurich American Insurance Company 16535. Accessed 2026-09-22.
13
Insurance Producer Licenses. Corgi Insurance; Current complete Insurance Producer Licenses table for Corgi Insurance Services, Inc.; 50 rows covering 49 states and DC (DC 3003091619); no New Mexico row; no NPN or as-of date shown. Accessed 2026-09-28.
14
About Hiscox US Insurance. Hiscox; Hiscox Insurance Company Inc. NAIC 10200 as Chicago, IL domiciled insurer admitted or licensed in all 50 states and D.C.; Hiscox Inc. as general agent and Lloyd’s coverholder for Syndicates 33 and 3624; surplus-lines placements through licensed surplus-lines brokers; A.M. Best rating statement. Accessed 2026-09-16.
15
Licenses. ERGO NEXT Insurance; Current entity-by-state license table reopened 28 September 2026: 50 rows under Next First Insurance Agency, Inc., including Washington, DC; New York rows instead list Next Insurance Services PC-1423070 and AP Intego BR-1198885. Accessed 2026-09-28.
16
Insurance Licenses by State. TechInsurance; Current state table; identifies TechInsurance as a division of Specialty Program Group LLC d/b/a SPG Insurance Solutions; lists DC 3000041536 and labels Rhode Island “Individual licenses,” without an agency license number. Accessed 2026-09-28.
17
Licenses. Vouch; Effective 16 January 2025: Vouch Specialty Insurance Services, LLC, NPN 19926463; P&C table (50 states and DC); surplus-lines table includes Idaho 870820; footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses; Idaho retained as producer-only due to conflict. Accessed 2026-09-15.

Cyber Insurance in the District of Columbia

What Is Cyber Insurance?

What to Watch for With Cyber in District of Columbia

Prompt Notice Has No Day Count

The D.C. Attorney General Threshold Is 50

More Than 1,000 Notices Adds Credit Agencies

Consumer Notices Need Freeze and Agency Contacts

Federal Procedures Can Replace Resident-Notice Mechanics

A Criminal-Investigation Finding Can Delay Notice

A Data Handler Must Alert the Owner or Licensee

Which Cyber Providers Have District of Columbia License Records?

At-Bay

Coalition

Corgi

Hiscox

TechInsurance

Vouch