Practical cyber security guidance
Cyber insurance FAQ for small businesses
Cyber insurance can transfer some financial risk, but it does not replace security controls or incident preparation. Insurers can ask detailed questions about identity, backups, endpoints, email, privileged access and previous incidents.
Frequently asked questions
6 practical answers.
### Does every small business need cyber insurance?
It depends on contractual requirements, risk appetite, the value of systems and data, business interruption exposure and the cover already provided by other policies. An insurance broker should advise on appropriate cover.
### What cyber security controls do insurers ask about?
Requirements vary by insurer and policy. Common areas include MFA, endpoint protection, backups, patching, administrator access, remote access, email security, staff training and incident-response arrangements.
### Can we just answer 'yes' if a control is partially deployed?
No. Insurance declarations should be accurate and evidence-based. If a control applies only to some users or systems, describe the real position and obtain advice from the broker or insurer where wording is unclear.
### What evidence should we keep?
Maintain records showing how controls are configured and operated: policy settings, device coverage, backup tests, incident plans, training records and remediation actions. The exact evidence needed will depend on the insurer.
### Does Cyber Essentials reduce cyber insurance risk?
Cyber Essentials provides a recognised baseline and may help demonstrate control maturity, but insurance underwriting and policy terms are determined by the insurer.
### What should we review before renewal?
Re-check the proposal questions against the live environment rather than copying last year's answers. Staff, devices, cloud services, remote access, acquisitions and security tools may have changed.
Related guidance