The renewal form is open. Familiar questions ask whether you use MFA, patch promptly, test backups and restrict administrator access. It is tempting to tick what is broadly true. But those answers may shape what an insurer expects if you later claim.
What reasonable controls mean for UK SMEs
Reasonable controls should match your size, data, systems and exposure. They should not copy every safeguard used by a bank.
Cyber essentials is a start, not a pass
Cyber Essentials covers secure configuration, firewalls, access control, malware protection and security updates. It offers useful proof of basic cyber hygiene.
It does not prove every relevant login uses MFA. It also does not prove backups have passed a restore test. Nor does it prove insurer-specific conditions have been met.
The National Cyber Security Centre says risk management must fit the organisation. A certificate alone is not enough.
Size, data and exposure change the answer
Insurers often consider turnover, sector, personal data, payment access and remote working. They also look at cloud reliance and how long you could trade without IT.
A small law firm may need stronger access checks. Confidential files and client money create an attractive target. A local decorator with two email accounts still needs MFA and backups. It does not need a security operations centre.
Your controls should fit the harm a cyber attack could cause.
GDPR and insurance ask different questions
UK GDPR and the Data Protection Act 2018 require security that fits personal-data risk. An insurer asks a related but different question.
It asks whether your stated safeguards reduce the chance and cost of a cyber claim. Meeting one duty does not prove you meet the other. It also does not stop a policy exclusion.
Cyber Essentials Plus gives stronger assurance than Cyber Essentials. An independent assessor tests selected technical controls. Cyber Essentials relies mainly on a self-assessment.
For an SME, Cyber Essentials Plus may help underwriting discussions. It can show device settings, malware protection and limits on administrator access. It still does not replace insurance control compliance.
The certificate may not test every cloud tenant or finance platform. It may also miss remote access routes and backup arrangements named in the proposal.
A business without Cyber Essentials Plus can still be insurable. It needs current equivalent evidence and honest details about any gaps.
Proposal answers can become claim-time terms
Proposal answers can carry legal weight. An insurer may compare them with technical records after ransomware or a data breach.
Questions that need a full-scope check
The highest-risk answers often concern MFA, secure backups and endpoint protection. They also cover remote access, administrator accounts and prior incidents.
A “yes” should mean the control covers every system named in the question. It should not mean only office laptops.
MFA on Microsoft 365 can leave other doors open. A remote desktop gateway, old email protocol or finance portal may still use only passwords.
Conditions, warranties and exclusions differ
A quotation requirement decides whether an insurer will offer terms. A policy condition may require action during the policy period.
A warranty clause can demand more exact action. A policy exclusion removes named losses from cover. Read the schedule, endorsements, definitions and conditions with the proposal form.
A practical rule: Keep the submitted questionnaire, statement of fact, final policy schedule and endorsements in one renewal folder. These documents show what you said, agreed and must do.
Ask before signing, not after an incident
Ask the broker or insurer to explain phrases like “all users” or “appropriate backups”. Also ask what they mean by “critical patches”.
Written confirmation is safer than an informal call summary. This matters when a managed service provider runs part of the control. The Financial Conduct Authority regulates insurers and brokers. Policy wording still decides the contract.
The policy price is only one part of the choice. Check the overall limit and any sub-limits. Check costs within them, including incident-response advisers, legal support and customer notices.
Also check business interruption and ransomware recovery costs. A £250,000 limit may offer less protection than expected. Forensic costs and lost trading can consume it quickly.
A policy exclusion may also remove cover for loss linked to an unmanaged supplier. It may do the same for an unsupported system.
Cyber insurance conditions must be read alongside the policy limit. MFA cover may depend on the application wording and endorsements. Do not assume MFA protects every claim type.
Map each control to risk and evidence
The strongest preparation links each control to a risk. It also links the control to evidence that can withstand claim checks.
| Control | Risk reduced | Proportionate SME proof |
|---|
| MFA | Phishing and stolen passwords | Identity settings and user coverage report |
| Secure backups | Ransomware and deletion | Restore-test record and retention settings |
| Patch management | Known software flaws | Patch dashboard and exception log |
| EDR or anti-malware | Malware spread | Device coverage report and alert process |
| Access control | Former staff or excess access | Leaver tickets and admin account review |
MFA must cover meaningful entry points
MFA requires a second proof of identity after a password. Think of it like needing both a house key and a door code.
Insurers often expect MFA for email and cloud administration. They may also expect it for remote access, finance platforms and privileged accounts. Shared accounts, supplier access and old protocols are common gaps.
The most frequent mistake is assuming one MFA setting covers all entry points. Check each route separately before answering an insurer.
⭐Picked for you
A FIDO2 security key adds a useful check for high-risk accounts. It can help where an insurer asks about phishing-resistant MFA. It supports account reviews and documented access settings. It does not replace them.
- It reduces reliance on one-time codes stolen through phishing.
- It gives administrators a physical sign-in factor for cloud consoles.
- It creates a clear control for finance and privileged-access account policies.
View on Amazon →Backups need a tested restore
A backup is a separate data copy. It helps recovery after ransomware, deletion or system failure.
A restore test proves you can recover the copy in useful time. Record what you restored, who tested it and how long it took. Record any files that failed.
For many SMEs, a sample restore every three to six months gives credible evidence. Test again after major system changes.
A backup that cannot restore is not a recovery plan.
Patches and access reviews need exceptions
Patch management means applying fixes for known security flaws. These flaws are like broken locks that criminals already know about.
If you cannot apply a critical patch promptly, record the reason. Record the temporary protection, owner and review date too.
The common weakness is not a missing tool. It is an exception left open for months. Nobody may accept the risk or check whether the device is still needed.
Complete questionnaires without risky yes answers
Complete each questionnaire with the person who runs the control. A director should review the final answers.
Give every control a named owner
MFA and access rights often sit with IT. Backups may sit with a managed provider. HR may remove access when staff leave.
Use a simple renewal sheet with four columns. List the control, owner, evidence location and next review date. This reduces risk when staff or suppliers change.
Clear ownership prevents assumptions from becoming incorrect answers.
Disclose gaps rather than wish them away
If MFA is still being rolled out, say so. If backups have not passed restore tests, say that too.
Explain the current position and temporary protection. Name the owner and give a realistic completion date. An insurer may accept the gap, charge more or add a condition.
It may also decline the risk. That is better than presenting planned work as finished.
A truthful “not yet, due by 30 June, with remote access disabled” can help more than an unqualified “yes”.
Review after changes, not only at renewal
Recheck controls before quotation and at renewal. Check again after a major system change or cyber incident.
New cloud software can make an old answer wrong. Remote workers, a merger or a new IT provider can do the same. A small evidence routine is often enough. You do not need bank-level tools.
A usual pre-renewal problem involves automatic laptop updates. The firm answers “yes” to critical security patching. But an internet-facing firewall or remote desktop server has missed updates.
Another case involves endpoint protection reports for office devices. Contractor laptops with remote access sit outside the provider’s report. The business should list affected assets before submitting its answers.
It can apply or schedule the fix. It can restrict access where needed. Keep the exception record.
This helps ransomware claim preparation. It shows what was known, who owned the fix and whether the control worked at inception.
Cloud suppliers still leave duties with you
Cloud suppliers protect parts of their services. They do not remove your duty for user access and administrator settings. You still choose retention settings and recovery plans.
Microsoft 365 is not automatically a backup
Microsoft 365 offers availability and retention features. Your needed recovery period may be longer or different.
Check mailboxes, SharePoint, Teams and OneDrive separately. Then test whether you can restore deleted or encrypted data.
Ask your provider for identity settings and MFA coverage. Also ask for privileged-account reports, endpoint coverage and incident-response duties.
Cloud storage is not the same as tested recovery.
Prioritise critical suppliers first
Start with providers that process payments, payroll or customer data. Include ecommerce orders and remote IT access.
Check who can access your accounts. Check how quickly the supplier tells you about an incident. Check what happens if its service fails.
Regulated or larger firms may face higher standards through sector rules. The Cyber Assessment Framework may also apply.
This guidance does not replace your proposal form, statement of fact, endorsements or policy conditions. It matters less if your business has no meaningful digital systems or confidential data. Even sole traders often use email, cloud storage and online payments. Regulated, high-risk or larger organisations may need legal, insurance-broking and technical advice.
What people ask
Are insurer security controls reasonable for UK SMEs?
Insurer controls are usually reasonable when they match your systems, data and exposure. They should not demand bank-level security. MFA, tested backups, patching and access control are common starting points.
Does Cyber Essentials guarantee cyber insurance?
Cyber Essentials does not guarantee cover because each policy has its own conditions and exclusions. It can support an application. It does not prove every declared control is in place.
Can weak controls make cyber insurance more expensive?
Weak controls can raise the premium, excess or restrictions. They can also lead an insurer to decline the risk. Prices often rise when ransomware recovery would take longer or remote access lacks protection.
What happens if an insurer rejects cover for weak controls?
An insurer may decline cover, add conditions or ask you to fix gaps before inception. Ask for the specific control gap in writing. Then record the remedial work and evidence.
Does my IT provider answer the insurance questionnaire?
Your IT provider can give technical evidence, but your business remains responsible for final answers. Check its report against the questionnaire’s exact wording.
How often should a small business test backups?
Most SMEs should record a restore test every three to six months and after major system changes. The right timing depends on acceptable data loss. It also depends on how quickly you must trade again.
Does MFA need to cover every account?
MFA should cover every relevant user, administrator and remote-access route named in the insurer’s question. Shared accounts, old protocols and supplier access need separate checks.
Are cyber controls enough to meet ICO requirements?
Cyber controls can support UK GDPR security duties, but they do not prove full ICO compliance. Data handling, retention, breach response and lawful processing also matter.
The essentials:- Reasonable security means proportionate controls you can prove. It is not a universal insurer checklist.
- Read the proposal, schedule, endorsements and conditions together. Do this before relying on a general standard.
- Test restores, review access and record patch exceptions. Do not assume a supplier has done these tasks.
- Disclose unfinished controls clearly. Give each gap an owner and a credible completion date.
Learn more
Here are some additional resources on this subject:
