Does Cyber Insurance Cover Third-Party Vendors?

A vendor can hold your data, provide a critical platform, or connect to your network. These relationships create different exposures: a breach of your information, an interruption at the provider, or an attacker using vendor access to reach your own systems. FTC guidance specifically advises buyers to check coverage for attacks on data held by vendors and other third parties. That checklist is a prompt to verify wording, not a guarantee that all vendor events qualify.

Check whether the policy covers your data when stored or processed by a vendor and whether the provider must be listed or meet a definition. For interruption, look for dependent-system coverage and its waiting period and sublimit. Review exclusions for service providers, infrastructure, and widespread events. Compare coverage with vendor contract terms, including notice and indemnity duties, because the vendor’s promise does not itself amend your insurance.