Document type: Checklist Practice area: Corporate—Insurance and Risk Jurisdiction: United States Last reviewed: 5 September 2026

Section 1—D&O structure

  • Total programme limit, by layer, with carrier and attachment point mapped
  • Dedicated Side A limit—amount, and whether it has difference-in-conditions and drop-down features
  • Side B retention amount, and whether defence costs erode it
  • Side C entity securities coverage, and whether it shares the limit with Side A
  • Scenario test: in a securities class action plus derivative suit plus investigation, how much is realistically available to individuals?
  • Insolvency test: if the company cannot indemnify, what responds?
  • Limit modelled against the company's own worst case, not only peer benchmarking

Section 2—Trigger and notice

  • Definition of "claim"—does it include written demands, shareholder demand letters, books and records demands, subpoenas, formal orders, Wells notices, tolling requests?
  • Notice standard: "as soon as practicable" vs a short fixed period
  • Notice address and method for every layer, recorded in one table
  • Extended reporting period: available, length, cost, trigger
  • Notice of circumstances provision—present, and the standard it applies
  • Related claims / interrelated wrongful acts definition, and how far back it can relate
  • Prior knowledge and prior notice exclusions, and what they capture

Section 3—Exclusions and severability

  • Conduct exclusion trigger: final non-appealable adjudication in the underlying proceeding—not "final adjudication," not "in fact"
  • Severability of exclusions—one insured's conduct not imputed to others
  • Side A non-rescindable
  • Severability of the application—signatories' knowledge only, not imputed to individuals
  • Application incorporation limited to specified documents
  • Bodily injury / property damage exclusion, with a carve-back for defence of derivative claims
  • Prior and pending litigation date—as early as possible
  • Professional services exclusion, and its interaction with any E&O policy
  • Regulatory and specific-event exclusions added at renewal

Section 4—Insured versus insured

  • Derivative suits brought without the assistance or participation of an insured person—carved out
  • Bankruptcy claimants: trustee, examiner, receiver, liquidator, creditors' committee, debtor in possession—carved out (the most important carve-out in the policy)
  • Former officers and directors after a stated period
  • Whistleblower and employment claims by insured persons
  • Claims brought outside the US by a foreign representative
  • Cross-claims and third-party claims within a covered proceeding
  • Consider whether the narrower "entity versus insured" formulation is available

Section 5—Allocation and defence

  • Pre-agreed allocation for securities claims—typically 100% to covered loss where entity and individuals are both defendants
  • Allocation method stated for non-securities claims
  • Interim allocation pending final determination
  • Advancement of defence costs during any allocation or coverage dispute
  • Duty to defend vs duty to indemnify, and who controls
  • Panel counsel requirement, and preferred firms added at placement
  • Rate position resolved in writing before fees are incurred
  • Litigation guidelines obtained and given to counsel at the outset
  • Consent-to-settle standard and the hammer clause

Section 6—The excess tower

  • Provision-by-provision comparison across all layers obtained and read
  • Notice provisions and addresses conformed
  • Definition of "claim" and "loss" conformed
  • Exclusions differing from the primary identified
  • Arbitration and choice-of-law clauses identified—choice of law may be the most consequential provision
  • Exhaustion language: does it permit exhaustion by payment "by the underlying insurers, by the insureds, or on their behalf"?
  • Express statement that a below-limits settlement of an underlying layer does not prejudice attachment if the excess insurer is notified
  • Drop-down on underlying insurer insolvency or refusal to pay
  • Consent-to-settle requirements at each layer, and the practicality of obtaining all of them

Section 7—Cyber coverage grants and sublimits

List every grant and its sublimit. The headline limit is usually not the operative number.

  • Incident response—sublimit, panel vendors, whether the company's preferred firms are on the panel
  • Business interruption—sublimit, waiting period, period of restoration definition
  • Contingent business interruption—sublimit, whether providers must be scheduled, and whether the critical ones are
  • Data restoration
  • Cyber extortion—sublimit, consent process workable in 24 hours, sanctions compliance
  • Social engineering / funds transfer fraud—sublimit (usually far too low)
  • Bricking
  • Reputational harm
  • Privacy and network security liability
  • Regulatory defence and penalties, "where insurable"
  • PCI fines and assessments
  • Media liability
  • Retroactive date, and prior acts preserved on any change of carrier

Section 8—Social engineering specifics

  • Dedicated grant, not reliance on generic computer fraud or crime coverage
  • Sublimit raised toward the full policy limit
  • Vendor and client impersonation covered, not only executive impersonation
  • Inadvertent disclosure of credentials covered
  • Verification condition checked against the actual accounts payable procedure—if they do not match, change one of them
  • Coordination with the crime policy; "other insurance" analysed so neither points at the other
  • Dual authorization and callback-to-file-number procedures implemented and trained

Section 9—Cyber exclusions

  • War and hostile act: attribution standard requiring more than a government statement; carve-back for collateral damage to a non-target; burden on the insurer
  • Infrastructure / utility exclusion aligned with the CBI grant, with a carve-back for failures caused by a covered cyber event
  • Widespread event or systemic risk provisions identified and quantified
  • Betterment and system upgrade exclusions
  • Unencrypted device and failure-to-maintain-controls exclusions—check against actual practice
  • Contractual liability exclusion and its effect on customer indemnities

Section 10—The application

  • Signed by the person who actually knows, not by someone relying on a project plan
  • Every security control representation verified against reality
  • Partial deployments described as partial, with scope stated
  • Known circumstances disclosed
  • Copies of the application and all supporting materials retained with the policy
  • Representations re-verified at each renewal—controls change

Section 11—Transactions and run-off

  • Change of control provisions in every policy identified
  • Six-year run-off bound before closing, non-cancellable and fully earned, policy delivered at closing—not merely a covenant to purchase
  • Run-off limit sized for six years of claims
  • Dedicated Side A within the run-off
  • Merger agreement indemnification and insurance covenants reconciled against the actual policy
  • On an acquisition: prior acts and subsidiary definitions checked; target's policies, loss history, open claims, and circumstance notices diligenced
  • On an IPO: public company D&O placed before pricing; private company run-off considered

Section 12—Programme coordination

  • Annual gap analysis across D&O, cyber, crime, E&O, GL, property, and EPL
  • Realistic scenarios mapped to policies: which responds, at what limit, subject to what retention, and where nothing responds
  • D&O and cyber both noticed on a breach with shareholder litigation
  • Cyber / crime boundary resolved for social engineering
  • Physical damage from a cyber event addressed somewhere
  • Contingent business interruption addressed in either cyber or property, with providers scheduled

Section 13—Cash and retentions

  • Retention by coverage part, and whether defence costs erode it
  • Reimbursement cycle modelled—90 days invoice to payment is common
  • Interim payments requested on undisputed first-party amounts
  • Sublimit payments' effect on the aggregate understood
  • Working capital requirement in a modelled claim given to finance at placement

Section 14—The claims runbook

  • Trigger list distributed to everyone who might receive a claim
  • Notice matrix: carrier, policy number, limit, attachment, address, method, deadline—one table
  • Roles assigned: who assesses, drafts, sends, informs the broker, informs the board
  • Panel counsel and vendors pre-approved with contacts
  • Forensic accountant pre-identified for first-party claims
  • Coverage counsel pre-identified with conflicts cleared
  • First-party documentation protocol: cost centre, hourly logging, preservation
  • Board notification thresholds
  • One-page policy summaries current
  • Annual tabletop with the broker present

Section 15—Board reporting

  • Tower diagram with layers, carriers, limits, and dedicated Side A called out
  • The five terms, quoted: conduct exclusion trigger; insured-versus-insured carve-outs; Side A rescindability and application severability; allocation; exhaustion
  • Scenario analysis, including insolvency
  • Run-off arrangements on a change of control
  • Cyber limits, sublimits, outage cost against payable amount, scheduled providers, waiting period, war exclusion wording, application accuracy
  • What changed this year; what was asked for and not obtained

Related documents