Cyber Incident Cash Flow: Funding Ten Days Offline
Article Summary
A ten-day cyber outage can create a cash shortage that lasts longer than ten days, because billing stops while payroll and recovery costs continue and delayed invoices then enter normal payment cycles. In the hypothetical plan, $220,000 of opening cash falls to a $25,000 low after systems return, so preserving a $75,000 reserve needs at least $50,000 of additional funding. Model the outage on a dated cash schedule, exclude insurance proceeds until a supportable date, and confirm credit-line access before counting it as emergency cash.
Ten days without your operating systems can create a cash shortage that lasts longer than ten days. Payroll still clears. Specialists may need deposits. Invoices wait for restored records, then enter the customer's normal payment cycle.
Run the test just before a major payment week. For a $2M–$15M service business, a percentage of annual revenue won't tell you whether Friday's payroll can be funded; a dated cash schedule will.
The ten-day outage below is hypothetical. It is a planning scenario, not an estimate of typical recovery time.
Start from the payment calendar
Take a copy of the current short-term cash forecast and change the events affected by the outage. Don't rebuild every expense from scratch.
Separate three types of cash effect:
- Receipts that arrive despite the outage.
- Receipts that move to a later date.
- Receipts permanently lost, reduced, or disputed.
Then add incremental recovery payments. Existing payroll and rent belong in the scenario because they still need funding, but they aren't all new incident losses. Mixing ordinary payments with incremental losses exaggerates the cost while obscuring the actual bank balance.
CISA's StopRansomware guide recommends tested offline encrypted backups, an incident response plan, and restoration priorities for critical services. Those technical actions inform the cash assumptions. A backup is financially useful when the team knows what can be restored, in what order, and how quickly usable operations resume.
A ten-day operating interruption
Assume this hypothetical business starts with $220,000 of unrestricted cash and a $75,000 minimum operating reserve. The outage prevents normal billing for ten days. Existing customers can still pay some previously issued invoices.
| Period | Receipts | Regular payments | Incremental response payments | Closing cash |
|---|---|---|---|---|
| Opening | — | — | — | $220,000 |
| Days 1–5 | $25,000 | $90,000 | $35,000 | $120,000 |
| Days 6–10 | $15,000 | $40,000 | $25,000 | $70,000 |
| Days 11–20 | $35,000 | $70,000 | $10,000 | $25,000 |
| Days 21–30 | $110,000 | $65,000 | $0 | $70,000 |
The lowest period-end balance is $25,000. Preserving the chosen $75,000 reserve requires at least $50,000 of additional funding under these assumptions.
The cash low occurs after systems return. That is the point of the exercise.
This table is not precise enough to authorize payments during an incident. Payments can cluster within each period, producing a lower daily balance. Expand the forecast to actual dates before setting the final liquidity requirement.
Don't make insurance the opening balance
An expected claim is not money available today. Put reimbursement into the forecast only on a supportable date and model a version without it.
Coverage, deductibles, waiting periods, consent requirements, documentation, and payment timing depend on the actual policy and claim. Confirm them with the broker and insurer. Finance should preserve purchase orders, invoices, time records, and the evidence of interrupted operations.
In this scenario, no insurance proceeds are assumed during the first 30 days. That doesn't say a claim will fail. It prevents an uncertain reimbursement date from funding a certain payroll date.
A free 20-minute Profit & Tax Leak Check can help identify whether the business's current cash cushion is already under pressure. Bring rough cash, payroll, and collection figures; no documents are required.
Name the minimum operation you can fund
The practical question is what has to work for safe service delivery, cash collection, and employee payment. Your incident team should set the technical recovery sequence. Finance translates that sequence into payment and receipt dates.
A business may be able to deliver work manually but unable to invoice it. Another may issue invoices but lack the records needed to resolve disputes. These are different cash scenarios.
Keep an approved offline contact list and a way to verify unusual payment instructions with known contacts. During an outage, speed does not remove payment controls. Pre-agreed approval authority is faster than inventing it under pressure.
A lender's undrawn facility also needs scrutiny. Confirm availability and operational access before counting it as emergency cash. A borrowing limit isn't the same as unrestricted funds in a usable bank account.
Test the recovery tail
When normal operations resume, don't assume all delayed cash arrives the same day. Work may need reconstruction, customer acceptance, invoice correction, and resubmission.
Extend the 13-week cash forecast through the backlog's collection dates. Use the cash-reserve model to distinguish the ordinary reserve from the additional incident funding requirement.
Run a second case with slower billing recovery and a larger response deposit. There is no need to borrow an industry loss statistic when your payroll dates and payment terms already expose the weak point.
Give the exercise an owner
The output should be a minimum daily balance, a funding source, a payment authority, and the assumptions the incident team must confirm. Review it when payroll, systems, banking, or policy coverage changes.
Fractional CFO support can connect continuity planning to the operating cash model. Start with the week an outage would hurt most, then use a Profit & Tax Leak Check to identify the financial constraint to address first.
Frequently asked questions
Why can cash fall after systems are restored from a cyber incident?
Delayed billing still needs reconstruction, customer acceptance, invoice correction, submission, and customer payment time. Recovery of operations does not instantly collect the backlog. In the hypothetical ten-day outage, the lowest cash balance occurs in days 11–20, after systems have already returned.
Is ten days a typical recovery time after a cyber attack?
No. The ten-day outage is a hypothetical planning scenario, not an industry estimate of typical recovery time or a recovery commitment. Your incident team should set the technical recovery sequence, and finance should run a second case with slower billing recovery and a larger response deposit.
How much extra funding does the cyber outage cash example need?
The lowest period-end cash is $25,000 against a chosen $75,000 minimum operating reserve, implying at least $50,000 of additional funding. Because payments can cluster within each period, actual daily timing may require more, so expand the forecast to actual dates before setting the final liquidity requirement.
Are payroll and rent during a cyber outage incident losses?
No. Payroll and rent still need funding in the scenario, but they are not automatically incremental losses. Separate ordinary payments from extra response costs, because mixing them exaggerates the incident cost while obscuring the actual bank balance the business must protect.
Should an expected cyber insurance claim fund the first payroll after an outage?
No. An expected claim is not money available today. Put reimbursement into the forecast only on a supportable date and also model a version with no early proceeds. Coverage, deductibles, waiting periods, and payment timing depend on the actual policy, so confirm them with the broker and insurer.
What does backup testing contribute to a cyber incident cash model?
Tested backups help the incident team know what can be restored, in what order, and how quickly usable operations resume. Finance uses those assumptions to move billing, collection, and response-payment dates in the forecast, turning the technical recovery sequence into payment and receipt dates.
Does an undrawn credit line count as emergency cash during a cyber outage?
Not automatically. Confirm availability and operational access with the lender before treating the facility as funding that can be used during an outage. A borrowing limit is not the same as unrestricted funds in a usable bank account, especially when systems are down.
Who owns the cyber incident cash flow plan?
Assign a named owner for the output: a minimum daily balance, a funding source, payment authority, and the assumptions the technical incident team must validate. Review the plan whenever payroll, systems, banking, or insurance coverage changes, and keep an offline contact list for verifying unusual payment instructions.