National-PC-IX Specialty Lines medium
A cyber policy's 'Privacy Regulatory Proceeding' insuring agreement is triggered after the FTC opens an investigation into the insured's data-handling practices following a breach. The carrier's defense obligation under this agreement most commonly covers which of the following? A Only the eventual fine or penalty assessed by the regulator, with all defense and investigation costs excluded as ordinary administrative overhead of the insured's operations B Only first-party breach-response expenses such as forensic investigation, credit monitoring, and consumer notification mailings, with all regulatory defense costs, agency investigations, and governmental proceedings expressly excluded from the scope of this insuring agreement C Reasonable and necessary legal fees, expert costs, and consultant fees incurred in responding to the regulatory inquiry, plus insurable fines and penalties where permitted by law, subject to a sublimit D Defense of class-action plaintiff suits brought by affected individuals, but not the defense of investigations or proceedings commenced by a government agency or regulator
