Yes. Standalone cyber liability policies cover ransom payments — negotiated through the carrier’s breach-response vendor — up to the policy’s cyber extortion sublimit. The FBI and most state attorneys general discourage payment, and OFAC sanctions prohibit payments to specific sanctioned threat actors. Importantly, the policy also pays forensics and restoration, which usually exceed the ransom itself.
North Carolina is an outlier — state and local governments there are barred by statute from paying ransoms.
