Do not answer cyber insurance questions with a “yes” unless you can show how the control works. Show who owns it and when it was last checked.
Insurers in England set their own underwriting questions. There is no single legal checklist. Unsupported answers can affect terms, exclusions or a later claim.
Follow this five-part insurer readiness process
Follow this order. Produce a defensible application in roughly 60 to 120 minutes for a small firm with cloud-based systems.
- List systems and owners: write down email, devices, payments, backups, remote access and critical suppliers.
- Test the core controls: confirm MFA, backup restoration, patching and endpoint protection are live today.
- Gather evidence: save a dated screenshot, report or test record for each answer.
- Separate gaps from claims: record partial coverage and give each fix a named owner and date.
- Read the policy wording: compare your answers against exclusions, conditions and notification duties.
For an England-based SME, a truthful answer has three parts: the control works now, a dated record proves it, and a named person can explain any exception. A written policy alone does not prove the setting is switched on.
From insurer question to defensible answer
1. Question
“Is MFA enabled?”
2. Check scope
Email, VPN, admins
3. Save proof
Policy screenshot
4. Name owner
Director or MSP lead
5. Log gaps
Fix date and scope
Build evidence before answering insurers
Build one control-evidence-owner matrix. This lets you check every “yes” in under two minutes.
Check the controls insurers ask about first
Check MFA for Microsoft 365 or Google Workspace. Also check VPN, remote desktop and administrator accounts.
Multi-factor authentication means a password plus a second check. This may be an app code or security key. It is like needing both a house key and a door entry code.
Record proof and the accountable person
| Control | Minimum proof | Named owner | Priority |
|---|
| MFA | Policy screenshot and user report | IT lead or MSP | Usually blocking |
| Backups | Restore-test record and retention setting | Operations lead | Usually blocking |
| Patching | Device report and update schedule | IT lead or MSP | Usually blocking |
| Staff training | Completion list and training date | Office manager | Terms or premium |
Prioritise gaps that can affect insurance terms
Fix gaps in MFA, recoverable backups, patching and endpoint protection. Do this before spending on lower-priority improvements.
Separate blockers from useful improvements
For a 1 to 50-person firm in England, allow between 30 and 90 minutes. That is enough to check core technical controls if systems are cloud-managed.
Remediation takes longer, particularly where old software or shared accounts exist.
| Gap type | Likely underwriting effect | First action |
|---|
| No MFA on email or VPN | May prevent quote or restrict terms | Enable it for all users and admins |
| Backups not tested | May expose ransomware recovery gap | Run and record one restore test |
| No staff phishing training | May affect premium or conditions | Schedule training within 30 days |
Include suppliers in your readiness record
Treat critical third parties as part of the SME’s own cyber security controls. Their access can affect the application answer and the practical impact of an incident.
For each MSP, SaaS provider, payment processor and remote-access supplier, record the service provided. Record data handled, administrator access, support contacts and the offboarding process.
Check whether the MSP uses separate named administrator accounts. Check whether MFA protects remote access. Check whether VPN access is limited to approved users and devices.
Supplier access can create an insurance gap.
Keep relevant service reports, access lists, contract clauses and incident contacts. A supplier certificate alone does not prove that your firewall configuration meets the insurer’s requirements.
It also does not prove that your payment platform or cloud tenant is protected. Check the exact scope instead.
Where a control is incomplete, create a 30-day remediation plan. Do not leave an informal promise in the questionnaire.
Start with a short SME cyber risk assessment. It should identify systems handling email, payments, customer data and remote access.
Mark missing MFA, unsupported software and weak patch management as potential blockers. Also mark absent endpoint protection and untested backups.
Record the owner, target date, expected evidence and interim safeguard for each item. This makes an incomplete answer clear and defensible.
For example, restrict administrator rights while endpoint protection is being deployed. Review alerts daily during that period.
While improving backups, test restoration for one critical system. Document that test.
Keep an exception register for each open gap. Show the affected scope, business reason, approval date and review date.
Never describe an open exception as a fully operating control.
Check policy wording before relying on cover
Read exclusions, conditions and notification rules against your evidence pack. Do this before you bind or renew the policy.
Match the checklist to your policy stage
Avoid answers that create hidden gaps
This checklist does not replace an insurer’s questions, conditions or definitions. It cannot determine whether a claim will be covered. It is not enough for active incidents or complex risks. It is also not enough for sector-specific regulation, Network and Information Systems Regulations duties, or firms needing technical, legal or broker support.
Use the checklist differently at each policy stage. For a cyber insurance application, establish each control’s current scope. Answer underwriting questions from dated evidence.
At renewal, compare that evidence with changes to users, systems, suppliers and claims history. This shows where a prior answer may no longer be true.
To reduce policy exclusions, read the precise condition or definition. Then check whether the control applies to every relevant account, device or service.
After an incident, use the policy’s notification route. Do not try to reinterpret the application.
If a question asks whether MFA is enabled, state the protected services. State any excluded legacy accounts and the date of the MFA evidence.
Do not turn a partly deployed control into an unqualified “yes”.
Common questions
Do insurers require MFA for cyber insurance?
Many insurers expect MFA for email, remote access and administrator accounts. The exact requirement varies by insurer and policy.
Confirm whether service accounts, mobile devices and legacy applications are within the required scope.
Is cyber essentials enough for cyber insurance?
Cyber Essentials can support an application, but it does not guarantee a quote or full cover. Insurers may still ask for restoration tests, payment controls, incident contacts and supplier details.
What evidence should a small business keep?
Keep dated screenshots, device reports, restore-test records, training lists and supplier contacts for each control. Store them in a restricted folder.
Review them at least every 12 months. Also review them after a major IT change.
Can an MSP answer the insurance questionnaire?
An MSP can supply technical evidence, but the business remains responsible for accurate answers. A director should check the stated scope.
Keep copies of the MSP’s reports.
What should we do after a ransomware attack?
Contact the insurer or broker through the policy’s incident route. Do this before hiring forensic or ransom-negotiation services.
Isolate affected systems and preserve logs. Do not restore or delete evidence until professional guidance is received.
Keep the evidence pack live after renewal
Review the matrix whenever systems, suppliers or working patterns change. Do not review it only at renewal.
What matters most:- Only answer “yes” where a control is live across the stated scope.
- Keep a dated record, named owner and exception note for every key control.
- Prioritise MFA, tested protected backups, patching and endpoint protection.
- Include MSPs, SaaS providers, payment firms and remote-access tools in the review.
- Read policy conditions and incident contacts before an attack, not during one.
Learn more
Here are some additional resources on this subject:
