Knowledgeable Person
Published: October 20, 2026 · Last reviewed: October 20, 2026 · Est. reading time 11 minutes
What this button does
Get the right coverage answer the first time you search. Add Total CSR as a preferred source, and our expert-written coverage resources will show up higher in your search results.
In plain language: A knowledgeable person is one of the senior people named in some cyber policies, such as the president, the technology chief or the general counsel. When one of these people learns about a breach or a claim, the policy treats the business as knowing. That moment can decide which policy responds and when the duty to report starts.
Technical definition: Knowledgeable person is a defined term in some cyber and technology E&O forms, such as Philadelphia Indemnity form PI-CYB-001. It lists officer titles plus their functional equivalent. The form uses the term for first-party discovery, notice of loss, the prior knowledge exclusion and application misstatements. Titles and effects vary by policy.
Knowledgeable Person at a Glance
The table below summarizes the core attributes of a knowledgeable person definition in a cyber insurance policy.
| Attribute | Detail |
|---|---|
| Also known as | Control group, Control Group Insured (other carriers' labels) |
| Category | Cyber insurance policy definition |
| Lines of business | Cyber liability, technology errors and omissions |
| Industries most affected | Small and midsize businesses, nonprofits, technology companies |
| Related forms or endorsements | PI-CYB-001, PI-IT-001, AXIS 1012561 0120 |
| Who bears the risk | The insured organization, when a listed officer knows and notice is late |
| Common solution | A list of who holds each listed title, plus a same-day reporting path |
| Also interacts with | Discovery, notice of claim, prior knowledge exclusion, application representations |
Key Takeaways
- A knowledgeable person is a senior officer named in a cyber policy whose knowledge of an incident or claim counts as the organization's knowledge.
- On forms that use the term, discovery and the duty to give notice start when a listed officer learns of an incident, while the final deadline differs by form.
- A common mistake is assuming every cyber policy uses the same list, when the titles and their effects vary by carrier and edition.
- Agencies reduce E&O risk when they record who holds each listed title at renewal and confirm that staff report incidents to those people the same day.
What Is a Knowledgeable Person in Insurance?
A knowledgeable person is a senior officer named in the definitions section of some cyber insurance forms. An organization cannot know anything by itself, so the definition says whose knowledge counts. That answer sets when an incident is discovered, when the duty to give notice starts, and whether a known problem is excluded as prior knowledge.
Each form sets out its own list. Philadelphia Indemnity form PI-CYB-001 (08/12) names the President, Executive Director, Chairman, Chief Information Officer, Chief Technology Officer, Chief Security Officer, Risk Manager and General Counsel, "or his/her functional equivalent." The same carrier's PI-IT-001 (09/23) form, built for technology firms, adds the Chief Executive Officer and lists the Chief Information Security Officer in place of the Chief Security Officer. Other carriers use other labels, such as "Control Group Insured" on the AXIS specimen 1012561 0120.
A named group gives insurers a clear test for timing, and it limits whose knowledge counts under the provisions that use the term. On PI-CYB-001, a junior employee's knowledge alone does not trigger Exclusion E, the knowledgeable person prior knowledge exclusion. A separate prior-acts exclusion on the same form looks at what the insured organization had any basis to believe. Once a listed officer knows, the reporting duties begin.
Consider a 40-person software company insured on PI-IT-001. A support technician sees a strange password reset email on March 3 and tells no one. The chief executive officer learns of the intrusion on March 20, during the policy period. Discovery happens on March 20, so the 60-day first-party notice limit runs from that date.
How Does a Knowledgeable Person Clause Work?
- The incident. A breach, extortion threat or outage occurs, or a third party makes a claim. Junior staff often see it first.
- The discovery. A listed officer, or a functional equivalent, learns of it. PI-IT-001 covers a security breach "first discovered by a knowledgeable person during the policy period."
- The notice clock. The duty to report starts at that moment, but the final deadline differs by form. PI-IT-001 requires written first-party notice as soon as practicable, and no later than 60 days after any knowledgeable person discovers or becomes aware of the breach. PI-CYB-001 sets its outer limit for first-party losses at 60 days after the policy period ends.
- The coverage review. The adjuster asks whether a listed person knew of the problem before the policy began, or knew of a misstatement on the application.
- The outcome. Timely notice keeps coverage available, subject to the other terms. Late notice, or a listed person's prior knowledge, can lead to a denial, depending on the policy wording and the state's notice rules.
Claim Examples Involving Knowledgeable Person
Odd log-in alert seen by a warehouse supervisor
At a technology products distributor insured on a form like PI-IT-001, a warehouse supervisor saw a strange log-in alert and told no one. Three weeks later, the president learned that customer records had been taken. The agency reported the breach eight days after the president found out. Because the 60-day limit ran from the president's discovery, the eight-day report was within it.
Ransomware handled quietly by an IT director
A small software firm insured on a form like PI-IT-001 had no Chief Information Officer, but its IT director ran every system. In February, the IT director found ransomware, hired a recovery vendor and told no one. The owner reported the event in May. The carrier argued that the IT director was a Chief Information Officer's functional equivalent, so the 60-day period began in February. A second problem came from the vendor bill, because the form makes security event costs subject to the carrier's prior written consent.
Vendor breach letter known to the general counsel
A retailer applied for a policy on a form like the AXIS specimen. Months before, its general counsel had received a vendor's letter about a data exposure, but the office manager who completed the application did not know of it. When a claim from that exposure arrived, the carrier cited the prior knowledge exclusion and the representations clause, which both look at what a Control Group Insured knew.
Knowledgeable Person vs. Control Group: What Is the Difference?
Knowledgeable person and control group are two labels for the same tool, a defined set of senior people whose knowledge counts for the organization. The table below compares the knowledgeable person definitions in two Philadelphia Indemnity forms with the Control Group Insured definition in the AXIS specimen.
| Comparison area | Knowledgeable Person | Control Group |
|---|---|---|
| Primary use case | Discovery, notice, notice of potential claims (PI-IT-001), prior knowledge and application terms | The same jobs; on AXIS the group also sets the date a claim is deemed made |
| Coverage / concept type | Officer titles plus a "functional equivalent" | Officer titles plus "functional equivalents" |
| Titles listed | President, Executive Director, Chairman, CIO, CTO, Risk Manager, General Counsel, plus the Chief Security Officer (PI-CYB-001) or the CEO and CISO (PI-IT-001) | CEO, President, CIO, CTO, CSO, COO, CFO, Chief Privacy Officer, General Counsel, Risk Manager, and non-administrative staff of their offices |
| Typical exclusions | Prior knowledge; intentional acts a knowledgeable person knew of (PI-IT-001) | Prior knowledge; misconduct a group member knew of |
| Who is most affected by errors | Small organizations where one person fills several roles | Organizations whose listed officers have staff, because non-administrative staff in those offices count too |
| Common mistakes | Assuming the CFO is listed, when neither Philadelphia list names one | Assuming only executives count, when AXIS also counts non-administrative staff in their offices |
What Are the Most Common Mistakes With Knowledgeable Person?
- Treating every cyber policy as if it used one list. Titles differ even between two forms from one carrier, so a summary of one form can misstate another.
- Ignoring "functional equivalent" wording in small businesses. A carrier may treat an in-house IT manager without an officer title as a listed officer's equivalent, and the clock can start from that person's knowledge.
- Waiting for the owner to confirm an incident. On PI-IT-001, first-party notice is due within 60 days after any knowledgeable person discovers the breach, and a late report can cost coverage, depending on the policy wording and state law.
- Letting an office manager answer prior incident questions alone. Representations clauses, such as the AXIS one, look at what a listed person knew when the application was signed.
- Holding an incident report at the agency. Days in an agency inbox still count against a deadline that a listed officer's knowledge already started.
How to Explain Knowledgeable Person to a Client
Explaining Knowledgeable Person to a personal lines client
If you chair a nonprofit board or own a business, its cyber policy may name officers such as the chairman. When one of those people learns of a hack, the insurer may treat the organization as knowing, and the duty to report starts. If you hold one of those titles, call the agency about any incident right away.
Explaining Knowledgeable Person to a small business owner
Many cyber policies name certain people, such as the president and your top technology person, whose knowledge counts as the company's. Once one of them learns of a breach, the duty to report starts, and some policies allow only 60 days. An in-house IT manager may count as the technology officer even without that title. We will check whether your policy has such a list, so staff can report anything odd to those people the same day.
Explaining Knowledgeable Person to a CFO or risk manager
If the policy defines a group of officers, often called knowledgeable persons or a control group, their discovery of an incident sets the coverage date and starts the duty to report. The list differs by carrier, and some forms leave out the CFO while others include it. We recommend that your incident response plan route every security event to a listed officer the same day and log the discovery date.
Frequently Asked Questions About Knowledgeable Person
Do all cyber insurance policies use a knowledgeable person definition?
Not all cyber policies use the term. Philadelphia Indemnity forms PI-CYB-001 and PI-IT-001 use it by name, while the AXIS specimen uses the label Control Group Insured. Always read the definitions in the policy you are servicing.
Does a regular employee's knowledge start the reporting clock?
On forms that tie discovery to a listed group, an employee outside that group does not start the discovery and notice clock alone, unless the carrier treats that person as a functional equivalent. Some forms reach further: the AXIS definition also includes the non-administrative personnel of the listed officers' offices. Other deadlines can run without a listed officer, such as the PI-CYB-001 proof of loss limit of 60 days after the loss event.
What does "functional equivalent" mean in a knowledgeable person definition?
None of the forms reviewed here defines the phrase. Read plainly, it points to the person who does a listed officer's job under a different title. At a small business, CSRs should ask who does each job, not only who holds each title.
Why does the knowledgeable person matter on a cyber application?
Under PI-CYB-001, the policy is void as to the named insured if any knowledgeable person knew of a material misstatement in the application. For that reason, the listed officers should review answers about past incidents before anyone signs.
Can a knowledgeable person's prior knowledge exclude a claim?
Prior knowledge can exclude a claim on the forms reviewed here. PI-CYB-001 Exclusion E excludes losses from acts before inception if a knowledgeable person knew or could reasonably have foreseen, by the inception date, that they could lead to a loss. The AXIS specimen applies a similar test to its control group, measured from the first inception date.
Sources and References
- Philadelphia Indemnity Insurance Company. Cyber Security Liability Coverage Form, PI-CYB-001 (08/12).
- Philadelphia Indemnity Insurance Company. Integrated Technology E&O and Cyber Risk Coverage Form, PI-IT-001 (09/23).
- AXIS Capital. AXIS Cyber Insurance Policy, AXIS 1012561 0120 (specimen).