--- title: 'Cyber Insurance Requirements: What UK Insurers Ask' url: 'https://triplepoint.org.uk/guides/cyber-insurance-requirements-uk' markdown: 'https://triplepoint.org.uk/guides/cyber-insurance-requirements-uk.md' date: '2026-10-28' description: 'Applying for cyber insurance? The security controls UK insurers ask about, from MFA to 24/7 monitoring, and how to answer the questionnaire confidently.' --- # Cyber Insurance Requirements: What UK Insurers Ask ![](https://triplepoint.org.uk/user/pages/guides/cyber-insurance-requirements-uk/cyber-insurance-requirements-uk.jpg) **Cyber insurers typically ask whether you use multi-factor authentication on email and remote access, have modern endpoint protection such as EDR or MDR, keep backups the attackers can't reach, filter email and train staff, and whether you've had incidents before.** Answer every question honestly: the NCSC warns that if you claim security measures you don't actually have, the insurer may not be obliged to pay. ## Why insurers ask so much now Claims have risen sharply. The Association of British Insurers [reported](https://www.abi.org.uk/media-hub/news-post/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover) that insurers paid **£197 million in UK cyber claims in 2024, up 230% on the year before**, and that **malware and ransomware made up 51% of claims**. More businesses are buying cover too: the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) found that 55% of small businesses have some form of cyber insurance. With claims like that, insurers want evidence that a business can stop the common attacks before they agree to cover it. ## What the proposal form asks Every insurer uses its own form, but the questions are remarkably consistent. Here's what a typical short form covers, taking [one major insurer's short proposal form](https://www.chubb.com/content/dam/chubb-sites/chubb-com/ie-en/business/by-category-cyber/10985a-chubb_cyber_erm_short_proposal_form_ie.pdf) as an example: | They ask about | What they're looking for | How to meet it | |---|---|---| | **Multi-factor authentication** | MFA required for email and all remote access, not just some of it | MFA on every account, including admins and shared mailboxes; [identity threat detection](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) to spot gaps | | **Endpoint protection** | Modern anti-malware on every laptop, desktop and server, with EDR, XDR or MDR often listed as options | Any of our [protection tiers](https://triplepoint.org.uk/security#protection-tiers); MDR adds the 24/7 monitoring many forms ask about | | **Backups** | Backups that can't be altered or are kept offline, with access protected by separate accounts and MFA | Ask your IT provider to confirm, and to test a restore | | **Email security** | Suspicious emails quarantined, links and attachments checked, the domain protected against spoofing, macros off by default | [Email security](https://triplepoint.org.uk/security/people-and-email/email-security), plus SPF and DMARC records on your domain | | **Staff training** | Phishing training or simulations at least once a year | [Phishing simulation and training](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) | | **Past incidents** | Any incidents, breaches or complaints in the last few years | An honest answer, with what you changed afterwards | Longer forms add questions about patching, admin accounts, payment card handling, suppliers with access to your systems and whether you have an incident response plan. Some insurers also ask about, or give discounts for, recognised certifications such as Cyber Essentials. ## How to answer with confidence - **Get the form early.** Ask your broker for it a couple of months before renewal, so you have time to close any gaps rather than discovering them the week it's due. - **Involve whoever runs your IT.** Your IT provider knows whether MFA really covers every account. A confident "yes" from someone who hasn't checked is the most expensive mistake on the form. - **Don't round up.** If MFA covers most accounts but not all, say so in the comments box and explain your plan. Partial and honest beats complete and wrong. - **Keep the evidence.** Screenshots of settings, reports from your security console, a record of a tested backup restore. If you ever make a claim, you may be asked to show the controls were in place. - **Read the declaration.** You're confirming you've given a fair presentation of the risk. It's worth knowing what you're signing and where that can lead you. ## What to check in the policy itself The NCSC's [cyber insurance guidance](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance) suggests asking: - **What's covered, and what isn't?** Check whether your existing business interruption or property policies already cover, or exclude, cyber losses. - **Is there help during an incident?** Many policies include forensic, legal and PR support, sometimes with responders you're required to use. - **What must be in place to claim, or to renew?** Conditions such as MFA or tested backups may apply throughout the policy, not just on the day you signed. - **Are third-party claims and data breaches covered,** and are the limits right for your business? ## A note for professional firms Accountants, solicitors, insurance brokers, financial advisers, and other professional services firms often face questions from two directions: their cyber insurer and their professional indemnity insurer. Both want the same core controls. We cover what we recommend for each in our pages on cyber security for [accountants](https://triplepoint.org.uk/industries/accountants), [solicitors](https://triplepoint.org.uk/industries/solicitors), [insurance brokers](https://triplepoint.org.uk/industries/insurance-brokers) and [financial advisers](https://triplepoint.org.uk/industries/financial-advisers). If you'd like someone to go through your questionnaire with you, our [cyber security consultancy](https://triplepoint.org.uk/consultancy/cyber-security) can explain what each question is really asking and where you have gaps, or [talk to us](https://triplepoint.org.uk/contact?about=Cyber%20insurance). ## Questions Does cyber insurance replace cyber security?+No. As the NCSC puts it, insurance "will not prevent a cyber breach/attack". It helps pay for recovery, and often brings expert help, but your security still has to stop the attack in the first place, and insurers expect it to be there otherwise it could void your cover. Will better security lower our premium?+Yes, often it can, but it depends on the insurer. The NCSC notes that some insurers offer discounts if you already have recognised defences in place, and missing controls such as MFA can mean higher premiums, lower limits or no cover at all. Every insurer prices differently, so ask your broker. We answered a question wrongly last year. What should we do?+Tell your broker or insurer now, rather than waiting for renewal or, worse, a claim. You have a duty to give the insurer a fair presentation of the risk, and correcting a mistake early is far better than having a claim questioned later. Can you fill in the questionnaire for us?+We can go through it with you, explain what each question is really asking and tell you where you have gaps. The answers and the declaration are yours to sign, so they need to be ones you understand and can prove. Where to go next- [24/7 managed detection & response (MDR)](https://triplepoint.org.uk/security/detect-and-respond/mdr) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) - [Incident readiness](https://triplepoint.org.uk/security/incident-response/incident-readiness) - [Cyber security for accountants](https://triplepoint.org.uk/industries/accountants) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Next: [Does a Small Business Still Need a Firewall?](https://triplepoint.org.uk/guides/does-a-small-business-need-a-firewall.md)