Follow-up on BSI-CS 154: What cyber insurance pays when control systems are hacked – using Stoïk as an example
In our article on BSI-CS 154 we explained in general terms why cyber insurance does not automatically pay for everything when control systems are hacked. Here we get specific: we have run the terms and conditions of Stoïk’s cyber insurance (Cyber Serenity in the Standard version, DE2609.2, and the Custom version, DE2609.1) clause by clause through a typical case – a manipulated refrigeration system.
Key points at a glance
- Control systems count too: Under the terms and conditions, the insured computer system also includes technology that can be accessed via the internet or an intranet and is owned or controlled by the business.
- Spoilage is covered: A spoilage clause compensates for spoiled goods, raw materials and semi-finished products as a result of an insured business interruption.
- Physical damage to equipment is possible as the “Sachsubstanzschäden” (physical damage to property) module – where agreed.
- Mind the order: For spoilage and physical damage to property, an existing property insurance policy takes precedence.
- Your obligation: weekly, protected backups – otherwise benefits may be reduced or the insurer may be released from liability.
The case: Friday night in the cold store
A grocery store in the district has its refrigeration controls looked after by a refrigeration technician via remote maintenance. The access point can be reached via the internet, and the password has been the same for years. During the night before Saturday, unknown persons log in and turn up the target temperatures. By morning, the goods in the refrigerated counters and freezers have spoiled, a compressor has overheated, and the store remains closed for two days. This, or something similar, is what happened in October in supermarkets in several European countries – more on this in our article Hackers heat up freezers.
What Stoïk’s terms and conditions provide in this case
First, the basic question: is the refrigeration control a “computer system” at all? Under clause II.1.1, this includes hardware, software and their components that are part of a system accessible via the internet or an intranet and are owned, controlled, operated or leased by the business. Based on this wording, a remotely maintainable control system is generally covered – we are happy to clarify this for you in advance or in the individual case. The unauthorised access is a network security breach and thus the trigger for the following benefits:
| Item of loss | Clause | What applies |
|---|---|---|
| Emergency assistance | III.1.2 | Crisis manager within 6 hours of notification, plus IT forensics, data protection specialists and crisis communication. These costs without deductible – and even during the waiting period. |
| Loss of income and additional costs | III.2.1, III.2.1.1 | Business interruption due to a cyber attack, operating error or technical problems. Compensation covers lost profit and ongoing costs as well as additional costs, e.g. for replacement equipment or alternative work processes – after the waiting period has expired, until the end of the indemnity period. |
| Spoiled goods, raw materials, semi-finished products | III.2.1.2 | Spoilage clause: variable costs due to spoilage, damage or rendering unusable as a result of an insured business interruption – including removal, disposal and replacement procurement. |
| Restoring data and control systems | III.2.3 | Costs of restoring data and the computer system to their state before the attack. If IT hardware cannot be cleaned, also its replacement (after consultation). |
| Damaged equipment and devices | III.2.13 (where agreed) | Physical damage to property (Sachsubstanzschäden) to technical operating equipment and movable property damaged directly and exclusively by an attack: repair or replacement at current value, after confirmation by the crisis manager. |
| Finding the cause and upgrading | III.2.11 | IT forensics fees for analysing the vulnerability and specific recommendations. For an economically reasonable security improvement, a one-off 50 % of the costs. |
| Dispute with the service provider | Legal protection module (ROLAND) | Lawyer, court and expert costs, e.g. if you want to enforce your own claims against a maintenance or IT service provider. |
For loss of income and spoilage, two values in the insurance policy matter: the waiting period (losses during this time are not taken into account) and the indemnity period (the maximum length of time payments are made). Both start with notification to the insurer. The faster you report, the sooner the clock starts running. Whether spoilage already counts in the first few hours in your case depends on the agreed waiting period – we are happy to clarify this for you in advance or in the individual case.
Who pays first: cyber or property insurance?
In principle, the Stoïk policy takes precedence over other contracts (clause VI.8). Expressly excluded from this are raw material losses (spoilage) and physical damage to property (Sachsubstanzschäden). Here, another existing insurance policy pays first, such as your contents, refrigerated goods, machinery or electronics insurance. The cyber policy steps in to the extent that the property policy does not pay – for example because it excludes cyber attacks.
For you, this means: put both contracts side by side. Only then will you see whether spoiled goods and damaged equipment are covered without gaps or whether you are paying twice.
The limits: what is not insured
- Financial loss insurance: Personal injury and property damage are excluded in principle (clause IV.6). Exceptions are hardware damage under III.2.3, physical damage to property under III.2.13 and non-material damage from data protection breaches.
- Physical damage to property only if agreed: If the module is not listed in the insurance policy, the overheated compressor remains a matter for property insurance. Not insured under the module are, among other things, vehicles, animals and property in transit.
- Failure of third-party infrastructure: If the public power grid or internet network fails, there is no cover (clause IV.21). Technical problems are only insured in relation to your own power supply.
- War and state cyber operations are excluded under clause IV.16.
- Own products and services: Liability claims due to defective products or services of the insured business are not insured (clause IV.4). For maintenance companies, professional or business liability insurance is therefore decisive.
- Sums insured and deductible: The sum insured applies per insured event, the annual maximum benefit per year, plus indemnity limits and deductible according to the insurance policy (clauses VI.4, VI.5).
- Serial loss: If the same attacker hits several branches via the same vulnerability, this counts as one insured event (clause VI.7). The sum insured must be sufficient for all locations.
Your obligations: backups are a prerequisite
Clause V.1.1 makes backups a prerequisite for insurance cover. All data and “critical elements” of the computer system must be backed up – that is, software and data whose restoration would cost more than five person-days:
- at least weekly, with at least two weeks of retention,
- as an offline backup (e.g. tape or external hard drive, disconnected from the network), an immutable backup (not even an administrator can delete it) or a secure backup (isolated, shielded by a firewall, access only with multi-factor authentication).
- Custom version: Here the backups must additionally be documented and tested verifiably at least once a year. Otherwise, the two sets of terms and conditions are the same on the points discussed here.
- Caution: According to the terms and conditions, certain NAS solutions whose protection an administrator can bypass are not considered immutable.
Our practical tip: Don’t just think of your office IT. The parameters, programs and configuration of your refrigeration, heating or machine controls also belong in the backup – ask your maintenance service provider to give you the backup.
If you breach an obligation (Obliegenheit) intentionally, the insurer is released from liability; in the case of gross negligence, it may reduce benefits in proportion to the severity of the fault (clause V.1.2). You retain cover if you prove that the breach did not cause the loss. Noteworthy: the costs of IT forensics by the partner CERT-Stoïk are not reduced even then.
Just as important are the details in the application (clause VI.10): what you state about your security status must be correct. And in the event of a claim: report it without delay via the hotline in the insurance policy (clause V.2.1) – this also starts the waiting period and the indemnity period.
Remote maintenance: why the maintenance contract matters
Remote maintenance also appears in Stoïk’s terms and conditions: under the cyber fraud module (where agreed), losses resulting from remote access that you yourself have consented to are excluded. This expressly does not apply to IT service providers or external service providers acting within the framework of a contractually agreed service or maintenance relationship (clause III.4.2). A written maintenance contract is therefore important not only for security, but also for insurance cover. We have compiled the points it should include in our article on BSI-CS 154.
If the service provider caused the loss, the legal protection module with ROLAND helps: eight areas, including data and cyber, contract and damages legal protection, with up to 250.000 € per legal protection case. According to the provider, it is included at no extra charge for new contracts of companies with up to 150 Mio. € annual turnover – we are happy to clarify this for you in advance or in the individual case.
Prevention instead of just paying
BSI-CS 154 requires regular checks as to whether devices can be reached from outside. This is exactly what is part of Stoïk’s prevention services (clause III.1.1): an external scan that monitors and reports vulnerabilities visible from outside, plus phishing simulations, an Active Directory scan (user rights, password policies, up-to-dateness) and a cloud scan. More on this in our article Cyber insurance with prevention: everything Stoïk provides. Important: a scan does not replace the work of your maintenance service provider on the control system itself.
Checklist before taking out a policy
- Which control systems and equipment are networked – and are they listed in the application?
- Has the physical damage to property (Sachsubstanzschäden) module been agreed?
- How long are the waiting period and indemnity period, and how high are the indemnity limits for business interruption and spoilage?
- What does your contents, refrigerated goods or machinery insurance pay – and does it exclude cyber attacks?
- Is the sum insured sufficient if all locations are affected at the same time?
- Does your backup concept meet the requirements – including for the control systems?
- Is there a written maintenance contract with security obligations for remote access?
Our offer: We arrange Stoïk’s cyber insurance and put it side by side with your existing property insurance policies for you – so that spoiled goods, downtime and damaged equipment don’t fall through the cracks between two contracts. More on this: Cyber security for businesses.
Frequently asked questions
Does cyber insurance pay for spoiled goods after a hacker attack?
That depends on the terms and conditions. Stoïk’s cyber insurance (Cyber Serenity, terms and conditions DE2609.2 Standard and DE2609.1 Custom) contains a spoilage clause: it compensates for variable costs due to spoilage of goods, raw materials or semi-finished products as a result of an insured business interruption, including disposal and replacement procurement. If there is also a property insurance policy that covers the loss, it takes precedence.
Is a refrigeration or machine control system covered by cyber insurance?
Under Stoïk’s terms and conditions, the computer system includes hardware and software that are part of a system accessible via the internet or an intranet and are owned or controlled by the business. Based on this wording, a control system accessible via remote maintenance is generally covered. We are happy to clarify this for you in advance or in the individual case.
What backups does Stoïk require?
A prerequisite for insurance cover is at least weekly backups of all data and critical elements of the computer system with at least two weeks of retention – as an offline, immutable or secure backup. In the Custom version, the backups must also be documented and tested at least once a year, with the test documented. Stoïk does not recognise certain NAS solutions whose immutability an administrator can bypass as immutable.
What happens if several branches are attacked via the same vulnerability?
Then the serial loss clause applies: several insured events with the same or a similar cause count as one insured event. The sum insured per event must therefore be sufficient for all affected locations together.
Warm regards from KiS
Note: General information, as of 05.11.2026, not legal advice and not individual advice. Stoïk serves here as an example; which tariff suits your business depends on the individual case. Only the terms and conditions and the insurance policy of your contract are authoritative; modules marked “where agreed” only apply if they are listed there. Sources: Stoïk, terms and conditions Cyber Serenity – Standard (DE2609.2) and – Custom (DE2609.1); Stoïk, glossary of insurance modules; Stoïk, legal protection module with ROLAND Rechtsschutz; BSI-CS 154 (13.10.2026). KiS – Kontor im Schwarzwald GmbH, insurance broker licensed under § 34d Abs. 1 GewO, Reg.-Nr. D-PS74-61V96-00.