Cyber insurance for small businesses can help manage the financial consequences of certain cyber incidents, but it is not a substitute for maintaining systems, protecting accounts or testing recovery. Policy wording, eligibility, limits, excesses and notification requirements vary considerably between insurers.
What losses might a cyber insurance policy address?
Depending on the contract, a policy may provide access to incident specialists, legal or regulatory assistance, business-interruption cover, forensic investigation, data recovery or liability cover. Cybercrime and social engineering payments may have separate limits or exclusions. Read the wording rather than assuming every form of digital fraud is insured.
Security controls insurers often ask about
- Multi-factor authentication on remote access, privileged accounts and cloud email.
- Supported software and security updates on laptops, servers and internet-facing devices.
- Endpoint protection, monitored alerts and documented administrative responsibility.
- Offline, immutable or otherwise isolated backups with tested restoration.
- Staff training and a process for checking unusual payment requests.
- An incident response plan with insurer and IT contact details.
Be accurate in your proposal form
Answer the insurer’s questions using current evidence. If a questionnaire asks whether every account uses MFA, do not tick yes based on a policy that is not yet deployed. Inaccurate declarations can cause disputes about cover. Get advice from a qualified insurance broker or insurer for policy interpretation.
What to do when an incident occurs
Contain the immediate problem using your agreed response process, preserve evidence and follow the policy’s notification instructions. Some policies require the insurer’s approved response panel or prompt notification. Avoid commissioning major remediation work without checking policy requirements where cover may be affected.
How can a security review help?
A practical review can confirm which users and devices are protected, which risks remain, whether backups can be restored and what evidence exists. Use the result to prioritise improvements and provide more reliable factual answers in renewal questionnaires.
Frequently asked questions
Will Cyber Essentials guarantee cyber insurance?
No. It can provide evidence of baseline technical controls, but underwriting and policy eligibility are set by each insurer.
Does insurance pay every ransomware demand?
No. Coverage for ransom payments, legal restrictions and other conditions vary. Do not assume payments are covered or appropriate.
What if we use an outsourced IT provider?
You still need to verify the scope of protections, roles and escalation arrangements. Outsourcing IT does not automatically transfer all contractual responsibilities.
Get practical help from 39Security
39Security can review technical controls and security readiness; an insurance broker should advise on policy suitability, price, exclusions and claims.