̽����ѡ

Terrorism coverage in the United States operates as a public-private risk-sharing partnership that allows the federal government and the insurance industry to share losses in the event of a major certified terrorist attack. The Terrorism Risk ̽����ѡ Act (TRIA), enacted by Congress in November 2002, ensures that sufficient financial capacity is available for businesses to recover and rebuild following such events. Under TRIA, all property/casualty (P/C) insurers in the U.S. are required to make terrorism coverage available to commercial policyholders. Terrorism insurance is typically purchased separately or added as a special endorsement (also called a “rider”) to a commercial P/C policy. A standard business P/C policy may exclude terrorism-related losses unless this endorsement is purchased. The current authorization of the program runs through December 31, 2027.

Frequently asked questions about terrorism insurance

Q. What is covered by terrorism insurance?

A. Commercial terrorism insurance generally covers physical damage and financial loss resulting from a certified act of terrorism. This can include damage to buildings, equipment, inventory, and other business property, as well as business interruption losses if your operations are disrupted. When purchased on applicable liability lines, terrorism coverage may also respond to third-party claims arising from a terrorist event. Coverage applies only when the terrorism endorsement is added to the underlying commercial property/casualty policy.

Q. What is excluded under a commercial terrorism insurance policy?

A. Coverage depends on the policy form and state regulations. Key exclusions often include:

• Nuclear, biological, chemical, and radiological (NBCR) events, which are commonly excluded from standard commercial policies and may require specialty coverage.
• Fire-following exclusions in some states/policy forms, meaning fire damage following a terrorist act may not be covered unless specifically included.
• Cyber terrorism risk, which is typically not covered unless physical damage results (e.g., a cyber-attack causing equipment failure or bodily injury). Most cyber-only events do not trigger terrorism coverage, so businesses concerned about this exposure should consider a separate cyber liability policy.

Important note: TRIA applies only to commercial property/casualty insurance. It does not apply to life or health insurance policies. Workers compensation policies, however, must cover terrorism-related injuries and cannot exclude NBCR events.

Q. How does terrorism insurance work?

A. Terrorism insurance responds only if the U.S. Department of the Treasury, in coordination with the Attorney General and Secretary of Homeland Security, certifies the event as an act of terrorism under the Terrorism Risk ̽����ѡ Act (TRIA).

To be certified, an act must:

• Be violent or dangerous to human life, property, or infrastructure
• Be intended to coerce U.S. civilians or influence government policy
• Result in at least $5 million in insured losses

Certification alone does not trigger federal payment. The federal backstop applies only if total industry insured losses exceed the statutory program trigger (currently more than $200 million). TRIA covers both domestic and foreign terrorist acts.

The program is currently authorized through December 31, 2027.

Q. How common is terrorism insurance and who should consider it?

A. A majority of U.S. businesses purchase terrorism insurance, particularly those in major cities or high-profile industries. When evaluating whether to buy coverage, consider:

• Location: Businesses in dense commercial centers or near symbolic targets face higher exposure than those in rural or residential areas.
• Industry: Sectors such as finance, energy, real estate, transportation, and hospitality may be at higher risk.
• Cost: Rates vary by location, industry, and risk profile. Terrorism coverage typically represents a small percentage of commercial property premiums, though pricing can vary based on perceived threat levels and portfolio exposure.

Q. How is terrorism insurance purchased?

A. Terrorism coverage is not automatically included in most commercial property/casualty policies. It is typically purchased as a separate policy or added through a terrorism endorsement (rider) to existing commercial coverage. Businesses should confirm whether terrorism coverage is included and assess potential exclusions, especially for NBCR and cyber-related risks.

Q. How does cyber risk relate to terrorism insurance?

A. Cyber risks and terrorism can overlap, but standard terrorism insurance usually does not cover most cyber incidents:

• Terrorist vector: A terrorist vector is the method or pathway a terrorist uses to carry out an attack, such as explosives, weapons, chemical agents, or even cyberattacks that cause physical damage. Understanding the vector helps determine whether an act qualifies as terrorism under TRIA.
• Cyber as a terrorist vector: Cyberattacks that cause physical damage or bodily injury (e.g., disabling industrial controls leading to fire or explosion) may be covered if the act is certified as terrorism by the Department of the Treasury.
• Typical cyber exclusions: Most commercial terrorism policies exclude cyber-only events, such as data breaches, ransomware, or theft of intellectual property. Businesses should purchase separate cyber liability insurance to protect against these scenarios.
• Emerging cyber-terrorism coverage: Some insurers offer limited cyber-terrorism endorsements. Coverage varies widely, may include significant exclusions, and requires careful review of policy language.
• Guidance for small and medium businesses: Assess whether your critical systems (networked controls, operational technology, cloud systems) could be damaged by malicious actors. Discuss with your insurance professional whether you need both a terrorism endorsement and a cyber liability policy, because coverage gaps between the two can be significant.