Provider security and insurer requirements for SaaS are not the same. Providers secure their infrastructure. Insurers usually assess your MFA, endpoint protection, backups, patching and incident response.
Comparativa rápida
The provider’s assurance is useful. It is not your full insurance answer.
| Control area | AWS, Azure or Google Cloud | SaaS supplier | SME evidence insurers often seek |
|---|
| Physical data centres | Owns building and hardware security | Usually none | Supplier due-diligence record |
| User MFA | Makes tools available | May support or require it | Configuration and enrolment reports |
| Laptops and mobiles | Does not manage them | Does not manage them | EDR coverage, patch status |
| Business data recovery | Offers storage resilience | Varies by contract | Restore test, 30 to 90-day retention |
| Incident response | Responds to its service incidents | Responds within its service scope | Your plan, contacts and notification process |
Provider protection has a boundary
An insurer normally measures the controls your business can switch on, supervise and prove. This includes Microsoft 365 accounts and administrator rights. It also includes employee laptops and SaaS tenant settings.
Your supplier protects parts of the building. You still lock your own office doors.
Certificates do not transfer risk
For an England-based SME, separate provider assurance from your own evidence. Keep supplier reports for the platform. Keep screenshots, reports and tests for controls your firm runs. This matters because a UK GDPR breach may need ICO reporting within 72 hours. That applies where it risks people’s rights and freedoms. Your policy may require even earlier notification.
Who owns each SaaS security control?
Most setups have three owners. Each owner has a different job.
The three-party model
The cloud provider runs the underlying platform. The SaaS supplier builds and maintains the application. Your SME controls who enters and what they can access. You also control how your devices connect.
A practical ownership route
Cloud provider
Hardware, core network, physical sites
SaaS supplier
Application code, service updates, platform support
Your SME
Users, access, endpoints, settings, recovery proof
Insurer question: “Which party owns it, and what evidence proves it works?”
Gaps inside the tenant
A tenant is your firm’s own area inside a SaaS service. It has its own users, settings and data. The supplier cannot safely make every choice for you.
The most frequent error is assuming a default setting meets an insurer’s test. It may not. Check each setting against the proposal form and policy wording.
Supplier checks that matter
Apply the cloud shared responsibility model one control at a time. Do not treat it as a general assurance statement. AWS, Azure and Google Cloud may protect physical sites and core networks. They may also protect managed-service infrastructure.
SaaS tenant security usually stays shared between the supplier and customer. The supplier may offer audit logs and access controls. The customer must switch them on and review administrator rights.
Logging can show unusual sign-ins and security events.
An insurer may ask if you can detect and prove security events. This can apply even when the cloud platform has a certificate.
UK cyber insurer controls for SaaS SMEs
Insurers focus on common attack paths. They want proof that your business can stop or limit them.
MFA and privileged access
Multi-factor authentication, or MFA, asks for more than a password. It may use a phone prompt or security key. MFA should cover email, remote access, cloud administration and finance systems. It should not cover only ordinary staff accounts.
A password is like one house key. MFA asks for a second key.
📦Available on Amazon
A USB security key can support phishing-resistant sign-in for compatible administrator accounts. Check compatibility with Microsoft, Google or your identity provider before ordering.
- Helps protect administrator logins against fake sign-in pages
- Gives a physical second factor for high-risk cloud accounts
- Can support documented stronger MFA for insurer discussions
Search on Amazon →Devices, patches and weaknesses
Endpoint detection and response, or EDR, helps protect laptops and mobiles. It can spot harmful activity and help contain it. Keep devices patched and record which devices have EDR.
A cloud supplier does not manage your staff laptops. Your business must do that work.
Backups and ransomware recovery
A comparison of NCSC guidance and insurer questionnaires shows one repeated theme: separation. Backup access should not use the same credentials as daily administration. Test recovery every 6 to 12 months. Record how long a real restore takes.
This works well in theory, but restore tests reveal gaps. A backup is only useful if you can recover priority data.
Evidence for underwriting and renewal
A simple evidence pack reduces late uncertainty. It also makes renewal questions easier to answer.
Match each control to proof
| Insurer question | Useful proof | Review rhythm |
|---|
| Is MFA enforced? | Policy screenshot and enrolment report | Monthly |
| Are endpoints protected? | EDR device coverage report | Monthly |
| Can data be restored? | Restore test result and timings | Every 6 to 12 months |
| Are weaknesses managed? | Scan and remediation record | Monthly or quarterly |
Keep three tests separate
Meeting one test does not prove that you meet the other two. The ICO may expect a prompt risk review after a personal-data breach. An insurer may require immediate notice of a suspected ransomware event. Check the policy terms.
Different bodies ask different questions. Keep evidence for each one.
Read reports with their limits
Supplier checks should link technical assurance to contract risk. A current SOC 2 Type II report can help. An ISO 27001 certificate can also help. Both can show that a supplier runs managed controls.
Their scope, exclusions, dates and corrective actions still matter. Review the data-processing agreement and service-level commitments. Also review incident notice times, subcontractors, data location and exit terms.
A penetration-test summary may strengthen the assessment. A vulnerability-management statement may also help. Neither removes responsibility for your own settings.
Keep this evidence in a supplier register. It helps show insurers that you review major SaaS dependencies.
Policy terms after a cloud attack
The certificate is not the policy. Read the policy before an incident happens.
Limits, excesses and exclusions
A policy limit is the most an insurer will pay. A sub-limit is a smaller cap for one loss type. This may include social engineering, data restoration or ransomware. An excess is the amount your business pays first.
Small sub-limits can change the value of cover.
Notify before acting alone
Follow the policy’s notification rules before you appoint external help. The insurer may have an incident-response panel. It may require you to use that panel. Acting alone can create cover disputes.
A usual case is a suspected ransomware attack. Staff call an outside IT firm first. The policy then requires insurer notice before major costs begin.
A 30, 60 and 90-day route
In the first 30 days, enforce MFA on email and administrator accounts. Identify all endpoints. Read the policy notification duties.
By 60 days, confirm EDR coverage and test a backup restore. Collect supplier reports. By 90 days, run an incident tabletop exercise. Close priority weaknesses and ask your broker to check your answers.
Use the current policy wording for that check.
This comparison matters less if your business has little cloud or SaaS reliance. It also matters less if you hold little business or customer data digitally. If an insurer declined a specific claim, use the policy wording and your broker. Seek a regulated legal adviser where needed.
A workable incident plan should say how the business keeps operating after compromise. This may involve a SaaS account, endpoint or backup platform. Name who can isolate devices and disable accounts.
The plan should name who contacts the SaaS supplier. It should also name who contacts the insurer’s response panel. Name who approves external communications.
For ransomware, recovery should not rely only on normal administrator credentials. Use separate or immutable backups where suitable. Set retention periods around business needs. Test restores against priority systems.
The result should feed into continuity and disaster-recovery plans. Set realistic recovery-time targets and name decision-makers. Include prompt UK GDPR breach reporting where the legal threshold is met.
Common questions
Does my cloud provider meet insurer requirements?
A cloud provider may meet part of an insurer’s expectations, but rarely all requirements for your SME. Insurers usually still ask about MFA, endpoint protection, backups, patching and incident response.
Do ISO 27001 or SOC 2 satisfy UK insurers?
ISO 27001 or SOC 2 reports support supplier checks but do not automatically satisfy UK insurers. Check their scope, date and exceptions. Check whether your tenant settings remain your responsibility.
Should we upgrade SaaS controls for insurance?
Upgrade controls where the proposal form, policy wording or evidence shows a gap. Prioritise administrator MFA, EDR coverage and tested immutable backups. Aim to do this within 30 to 60 days.
What does phishing-resistant MFA mean?
Phishing-resistant MFA uses FIDO2 keys or passkeys that check the real sign-in site. It is stronger than SMS codes. Criminals can steal or redirect SMS codes.
What happens if a cloud breach claim is rejected?
A rejected claim may depend on policy wording, missed notice duties or inaccurate application answers. Ask your broker for the insurer’s written reasons. Seek regulated legal advice if the financial impact is material.
How often should SaaS backups be tested?
Test SaaS backups every 6 to 12 months and after major changes. The test should prove priority data can return in a business-acceptable time.
The essentials:- Cloud security certificates support supplier checks but do not transfer tenant duties.
- Insurers often review MFA, EDR, weakness handling, backups and incident response run by your SME.
- Keep dated proof for every control, especially restore tests and device coverage reports.
- Read limits, exclusions and incident notice duties before a cloud account is compromised.
Learn more
Here are some additional resources on this subject:
