Most cyber insurers are likely to exclude or sub-limit PCI-DSS Fines and Penalties coverage if the client is unable to prove compliance. It is important to note that when a breach happens, the PCI automatically assumes the merchant to be out of compliance even if the merchant has met all requirements. The burden of proof falls on the merchant.