Cyber insurance requirements: what UK insurers ask small businesses for

Cyber insurers typically ask whether you use multi-factor authentication on email and remote access, have modern endpoint protection such as EDR or MDR, keep backups the attackers can't reach, filter email and train staff, and whether you've had incidents before. Answer every question honestly: the NCSC warns that if you claim security measures you don't actually have, the insurer may not be obliged to pay.

Why insurers ask so much now

Claims have risen sharply. The Association of British Insurers reported that insurers paid £197 million in UK cyber claims in 2024, up 230% on the year before, and that malware and ransomware made up 51% of claims. More businesses are buying cover too: the government's Cyber Security Breaches Survey 2025/26 found that 55% of small businesses have some form of cyber insurance.

With claims like that, insurers want evidence that a business can stop the common attacks before they agree to cover it.

What the proposal form asks

Every insurer uses its own form, but the questions are remarkably consistent. Here's what a typical short form covers, taking one major insurer's short proposal form as an example:

Longer forms add questions about patching, admin accounts, payment card handling, suppliers with access to your systems and whether you have an incident response plan. Some insurers also ask about, or give discounts for, recognised certifications such as Cyber Essentials.

How to answer with confidence

• Get the form early. Ask your broker for it a couple of months before renewal, so you have time to close any gaps rather than discovering them the week it's due.
• Involve whoever runs your IT. Your IT provider knows whether MFA really covers every account. A confident "yes" from someone who hasn't checked is the most expensive mistake on the form.
• Don't round up. If MFA covers most accounts but not all, say so in the comments box and explain your plan. Partial and honest beats complete and wrong.
• Keep the evidence. Screenshots of settings, reports from your security console, a record of a tested backup restore. If you ever make a claim, you may be asked to show the controls were in place.
• Read the declaration. You're confirming you've given a fair presentation of the risk. It's worth knowing what you're signing and where that can lead you.

What to check in the policy itself

The NCSC's cyber insurance guidance suggests asking:

• What's covered, and what isn't? Check whether your existing business interruption or property policies already cover, or exclude, cyber losses.
• Is there help during an incident? Many policies include forensic, legal and PR support, sometimes with responders you're required to use.
• What must be in place to claim, or to renew? Conditions such as MFA or tested backups may apply throughout the policy, not just on the day you signed.
• Are third-party claims and data breaches covered, and are the limits right for your business?

A note for professional firms

Accountants, solicitors, insurance brokers, financial advisers, and other professional services firms often face questions from two directions: their cyber insurer and their professional indemnity insurer. Both want the same core controls. We cover what we recommend for each in our pages on cyber security for accountants, solicitors, insurance brokers and financial advisers.

If you'd like someone to go through your questionnaire with you, our cyber security consultancy can explain what each question is really asking and where you have gaps, or talk to us.

< Back to Guides