A Cyber Essentials certificate can help meet a tender’s security-control requirement. It does not show that your cyber insurance covers losses from a public contract.
A policy may still limit cover for supplier failures, contract liabilities, data restoration, or incidents involving a named subcontractor.
Before tendering, check the insured entities, aggregate limits, and sublimits. Check that exclusions do not remove risks created by the contract.
Match each tender requirement to a policy clause, endorsement, or insurer letter. Do not confuse Cyber Essentials with insurance.
UK GDPR breaches may need ICO reporting within 72 hours.
Read the tender and policy side by side
Put the tender clauses beside your policy documents and mark each requirement as proven, unclear, or missing. Gather the invitation to tender, draft contract, insurance schedule, full policy wording, endorsements, and insurance certificate.
A policy supports a tender only when written evidence confirms the company, limit, scope, and contract risk.
This check usually takes 10 to 20 minutes per major clause.
Gather the seven documents first
Create one working folder for the tender pack, clarification responses, and draft contract. Add the policy schedule, full wording, endorsements, and current certificate.
Certificates are useful evidence, but they often leave out ransomware sublimits. They may also omit supplier exclusions, waiting periods, and special conditions.
Ask your broker for the full wording if you cannot find it. The typical error is treating the certificate as the whole policy.
Mark the tender wording by type
Highlight each insurance-related phrase in three colours. Use green for insurance, blue for security controls, and amber for contract promises.
“Maintain Cyber Essentials certification” is a security-control requirement. “Maintain cyber liability insurance of £2 million” is an insurance requirement.
An indemnity for all breach losses may be wider than the policy. This distinction can decide whether your bid is accurate.
For an England-based SME, write the tender deadline at the top of your working sheet. Broker and insurer confirmations can take between one and five working days. This can take longer when an underwriter must approve an endorsement.
Use a final pre-submission audit checklist. Before uploading the bid, confirm that the legal tenderer is the named insured. Confirm that policy dates cover submission, mobilisation, and the required contract term.
Check that the certificate matches the current policy wording. Check that available aggregate limits remain enough after earlier claims.
Record the excess, sublimits, ransomware limit, and data restoration costs. Record supplier-dependency cover and any relevant exclusions.
Then compare that record with every tender insurance requirement. Include requests for an additional insured, waiver of subrogation, run-off cover, or insurer letter.
A point without a document reference needs further proof.
⚠️ Do not mark a clause as met because a broker says it is “normally covered”. Ask for the policy reference or written insurer confirmation.
You now know what evidence you hold. Next, separate security proof from insurance proof.
Separate cyber essentials from insurance cover
Separate proof of security controls from proof that an insurer will pay after an incident. Cyber Essentials shows that a business met basic technical controls during assessment.
Cyber insurance is a contract that may pay stated costs after an insured event. Payment depends on wording, limits, and exclusions.
Cyber Essentials and insurance answer different tender questions.
Read certification requests literally
Cyber Essentials is a UK Government-backed scheme supported by the National Cyber Security Centre. Certification normally lasts for 12 months.
Cyber Essentials Plus includes an independent technical assessment. ISO 27001 covers an information-security management system.
Neither one confirms a cyber policy limit, excess, or insurer duty. Read the tender wording exactly as written.
Test the insurance requirement separately
Look for “cyber liability”, “network security and privacy liability”, or “data breach insurance”. Also look for “technology errors and omissions” or “insurance against cyber risk”.
Check whether the authority requests “any one claim”, “each and every claim”, or “in the aggregate”. An aggregate is one shared pot for all claims during the policy period.
The most frequent error is reading a £2 million aggregate as £2 million per claim.
⚠️ A current Cyber Essentials certificate does not fill an insurance gap. Submit it only as security evidence unless the tender says otherwise.
The control evidence is now separate. The next task is linking every promise to proof.
Map each tender clause to policy evidence
Create a line-by-line evidence matrix so no tender promise rests on a generic certificate. Copy each relevant tender and draft-contract clause into the first column.
Then identify the exact page, section, or endorsement that proves the answer. Mark it “confirmation required” when the wording does not answer the point.
Do not guess when a clause is unclear.
Use this tender-to-policy matrix
| Tender requirement | Best evidence | What to verify | Action if unclear |
|---|
| £1m cyber liability cover | Schedule and wording | Aggregate or each claim; excess | Ask broker for written confirmation |
| Breach response within contract terms | Incident-response section | Forensics, legal advice, notification costs | Check sublimits and panel-provider rules |
| Authority named in policy | Endorsement | Exact authority and status requested | Request contract-specific endorsement |
| Supplier assurance or Cyber Essentials | Current certificate | Certificate scope and expiry date | Renew or clarify scope |
| Business continuity after outage | Business interruption section | Waiting period and supplier dependency | Seek confirmation or revise cover |
Know where each answer lives
Use the schedule for the insurer name, policy dates, insured entity, main limit, and excess. Use the wording for definitions, covered events, exclusions, and conditions.
Use endorsements for changes that override standard wording. A broker letter may explain existing cover.
A broker letter cannot replace an endorsement where a new legal duty is needed.
Flag wording that needs clarification
Flag “unlimited liability”, “including acts of subcontractors”, and “maintain cover for six years after expiry”. Also flag “waiver of subrogation” and “provide evidence with the tender submission”.
These clauses may need legal, insurance, and procurement review. This is most likely when the contract duty is wider than the policy.
A common case involves a subcontractor outage. The authority claims against the prime supplier, but the policy has no matching supplier cover.
⚠️ Do not attach a generic certificate when the tender asks for an authority-specific status. That often needs an endorsement.
Your matrix reveals what must be funded. Now test the actual money available.
Test limits, sublimits and excess carefully
Check the money available after sublimits, earlier claims, and excess, not just the headline figure. One public-sector incident can create forensic, legal, notification, restoration, income-loss, and third-party costs.
The headline limit may exceed the separate amount for ransomware. It may also exceed cover for regulatory costs or supplier interruption.
A £1 million policy can hold a much lower sublimit.
Check aggregate and per-claim limits
If a tender asks for £2 million “each claim”, do not assume a £2 million aggregate matches. Ask the broker to confirm the basis in writing.
Check whether earlier claims reduced the available amount. Record whether cover stays in force for the contract term and required run-off period.
This step can take between 10 and 20 minutes. It takes longer when claims history needs checking.
Find sublimits and waiting periods
Search for “sublimit”, “limit of liability”, “extension”, “waiting period”, and “retention”. Check limits for cyber extortion, social engineering, incident response, and regulatory investigation.
Also check privacy liability and dependent business interruption. A supplier outage may breach the contract before a waiting period ends.
The problem is that a policy may respond too late.
Calculate the excess in cash terms
The excess is the amount your business pays first on a covered claim. Cyber policies may apply different excesses to different types of loss.
Record excesses for first-party costs, third-party claims, and crime losses. Decide whether the business can pay each amount without disrupting service delivery.
Check the policy trigger and reporting tail. Many cyber liability policies use a claims-made and notified basis. This may require a claim and insurer report during the policy period.
Check the retroactive date for relevant earlier work. Keep cover continuous when renewing during a multi-year public contract.
If the tender needs cover after expiry, ask about extended reporting or run-off. Check its length and the allegations it covers.
⚠️ Do not quote the main limit without checking its basis, sublimits, and excess. The tender may require more than the available amount.
The funding check is complete. The next section finds events the policy may exclude entirely.
Find exclusions before making promises
Read exclusions and conditions before promising protection for ransomware, suppliers, or state-linked attacks. An exclusion describes a situation that the insurer will not cover.
A condition is a rule that may affect cover if you do not meet it. Read endorsements first because they can change the main wording.
The exact clause matters more than a product summary.
Review cyber war and sanctions clauses
Cyber-war clauses can restrict cover for hostile or state-backed activity. Sanctions clauses can stop payments that breach sanctions law.
This matters during ransomware events. Payment to a criminal group may be restricted, even where cyber-extortion cover exists.
Rely on the precise clause, not the sales description.
Check prior incidents and security duties
Check exclusions for prior known circumstances, earlier breaches, and unpatched vulnerabilities. Review duties for multi-factor authentication, backups, patching, encryption, and privileged access.
A known compromised mailbox may affect cover. Failure to meet a stated security condition may also affect cover.
Tell the broker about any known issue before bidding. This is often faster than arguing about disclosure later.
Test ransomware and supplier wording
Search for “ransomware”, “cyber extortion”, “dependent system”, and “outsourced service provider”. Also search for “failure to maintain security”.
Check whether the insurer appoints lawyers, forensic firms, and ransom negotiators. Using an unapproved provider before notification can cause disputes over costs.
Most guides mention ransomware limits. They often miss provider-approval rules.
⚠️ Do not promise ransom payment or supplier-outage cover without reading exclusions and insurer appointment rules.
Exclusions show what may fall outside cover. Supplier, GDPR, and contract duties create the next gap.
Check suppliers, GDPR and liability gaps
List every supplier that can access systems, data, or the service before relying on your policy. Include cloud hosts, IT support firms, payroll providers, software platforms, data processors, and subcontractors.
If one fails or exposes authority data, the authority may seek recovery from your business first.
Your supplier’s policy does not automatically protect you.
Separate first-party and third-party cover
First-party cover may pay your forensic, restoration, extortion-response, and income-loss costs. Third-party cover addresses claims made against your business.
Check both where the contract involves authority data or essential services. Read professional-indemnity and cyber policies together for exclusions or limited carve-backs.
The usual mistake is checking only breach response costs.
Check UK GDPR costs precisely
The UK GDPR may require ICO reporting within 72 hours. This applies where a breach is likely to risk people’s rights and freedoms.
Check cover for legal defence, investigation, notification, and regulatory proceedings. Do not claim ICO fines are covered unless the wording addresses them clearly.
Fines must also be legally insurable.
Compare your contract promise with cover
Read indemnity clauses for “all losses”, “all costs”, “without limit”, and “irrespective of fault”. A small supplier may accept unlimited data-protection indemnity.
That supplier may hold a £1 million aggregate policy. The policy may exclude contract liability beyond normal legal liability.
The contract promise can then exceed the insurance backstop.
Test contractual liability cover against the draft contract. Cyber cover may respond to liability that exists without the contract. It may not insure extra liability accepted only through a tender clause.
Check for limits on liquidated damages, service credits, performance guarantees, penalties, and unlimited indemnities. Apply the same test where supplier-failure exclusions apply.
A public authority may claim against the prime contractor after a subcontractor outage. The policy may not treat that contract promise as an insured loss.
Seek an insurer response to the exact clause. A broad reference to privacy liability is not enough.
⚠️ This check does not replace legal, broker, or procurement advice on a specific contract.
The remaining task is getting written proof or changed cover before submission.
Ask for changes before the deadline
Send your broker the exact tender clause and request written confirmation or a policy change before submission. Include the contract value, service description, data types, supplier list, and deadline.
A vague question produces a vague answer. That creates weak tender evidence.
Send the clause, not just a summary.
Send this broker request
We are submitting a tender to [Authority] by [date]. Please review clause [number] and confirm whether policy [number] covers the requirement. Please state: (1) the insured entity, (2) limit basis and available aggregate limit, (3) relevant sublimits and excess, (4) cover for breach response, third-party privacy liability, ransomware and supplier interruption, and (5) any exclusions or conditions relevant to this contract. If the requirement is not met, please advise whether an endorsement, increased limit or revised policy can be issued before [date].
Decide between confirmation and endorsement
Request a confirmation letter when current wording meets the requirement. Use it when the certificate lacks detail.
Request an endorsement when the authority needs an additional insured or changed limit. Also request one for a waiver of subrogation or wider territorial scope.
Keep insurer-approved evidence in the bid folder. Describe it accurately in the tender response.
Use clarification questions safely
Ask through the official procurement portal when evidence is needed. Ask whether equivalent cover is acceptable.
Ask whether an award-stage increase is enough. Do not submit confidential policy documents unless the process asks for them.
This route is safer than making assumptions.
⚠️ Do not state that a pending endorsement is already in place. State the current position and follow tender clarification rules.
This guidance is less relevant when the tender does not request cyber insurance. It also matters less when you handle no authority data or systems. The contract must create no meaningful digital, data-protection, or service-interruption exposure. This is not legal, insurance-broker, or procurement advice for a specific contract.
Common questions
Do UK SMEs need cyber insurance for every tender?
UK SMEs do not need cyber insurance for every tender. An authority can still make it a contract requirement.
Check the tender, draft contract, and data or service risk. Do this before deciding that cover is unnecessary.
Is Cyber Essentials enough for a public-sector tender?
Cyber Essentials can meet a stated security-control requirement. It does not prove insurance cover.
You still need policy evidence when the tender requests cyber liability, breach response, or indemnity protection.
What cyber insurance limit should a tenderer have?
The required limit is the amount stated in the tender. Check its aggregate basis, sublimits, and excess.
A £1 million headline limit may be too low. It may be shared across claims or limited by a lower ransomware sublimit.
Does cyber insurance pay GDPR fines and legal costs?
Cyber insurance may pay legal and regulatory investigation costs. Fine cover depends on wording and legal insurability.
UK GDPR reporting duties remain your responsibility. This includes the 72-hour ICO rule where it applies.
What happens if a supplier causes the data breach?
You may still owe duties to the authority after a supplier breach. Check third-party liability and dependent business interruption.
Check outsourced-provider definitions and your contract indemnity clause. These terms decide whether the gap sits with you.
Can I submit a tender while insurance changes are pending?
You can submit only when your response states the current position accurately. The tender rules must allow the proposed change.
Ask through clarifications whether a pending endorsement is acceptable. Ask whether an award-stage increase is enough.
The essentials:- Match each tender requirement to the schedule, wording, endorsement, or insurer confirmation.
- Check aggregate limits, sublimits, and excess before quoting a headline policy figure.
- Keep Cyber Essentials evidence separate from insurance-cover evidence.
- Read exclusions for ransomware, suppliers, known incidents, sanctions, and cyber war.
- Request endorsements or higher limits before the submission deadline, not after award.
Learn more
Here are some additional resources on this subject:
