Cyber insurance requirements: what UK insurers ask, and how to answer

Short answer: UK cyber insurers mostly ask about the same eight controls: multi-factor sign-in, backups, patching, protection from malware, admin rights, email security, staff training and an incident plan. They rarely insist on a Cyber Essentials certificate by name, but the questions line up closely with it. The part that catches businesses out isn’t the controls, it’s answering the proposal form accurately and being able to show evidence afterwards.

Cyber insurance requirements have tightened because insurers now underwrite on what you can prove rather than what you say. A few years ago the renewal form asked whether you had antivirus. Now it asks whether multi-factor authentication is enforced on every account, how often backups are tested, and how quickly critical updates go on. This guide goes through what a typical UK proposal form asks, what evidence answers each question, and how to get from “not sure” to “yes, here it is” in about a month.

Renewal form on your desk and not sure how to answer it? Ring 0151 452 3060 and a person picks up, or take the Free Cyber Health Check: six questions and a written list of what to fix first.

One thing to be clear on first: we’re an IT and cyber security provider, not an insurance broker. We don’t sell cover or advise on policies. What we do is put the controls in place and write down the evidence, so the answers on the form are true and you can prove them.

What’s on a UK cyber insurance proposal form

Every cyber insurer words it differently, but the cyber insurance requirements on most small-business proposal forms come down to these eight. For each one, here’s what they’re asking and what counts as evidence.

1. Multi-factor authentication. Is it enforced on email, on remote access and on every administrator account? “Enforced” matters: MFA that’s available but optional is usually a no. Evidence is a screenshot or export from Microsoft 365 showing the policy applied to all users. DSIT’s 2025 survey found only 40% of businesses use it on email, which is why cyber insurance forms ask about it first.

2. Backups. How often, where are they kept, are they separate from the main systems, and have you tested a restore? Cyber insurers want to know you could recover from ransomware without paying. Evidence is the backup schedule plus a dated record of a successful restore.

3. Patching. How quickly do critical and high-risk updates go on? Cyber Essentials sets 14 days, and many forms use the same number. They’ll often ask separately about unsupported software, so anything past its end of support needs a plan. Windows Server 2016 reaches end of support on 12 January 2027, so if you’re still running it, have a plan with a date before your next renewal.

4. Protection from malware. Antimalware or endpoint detection and response on every device, including laptops used from home. Evidence is a device report showing coverage and status.

5. Admin rights. Do staff use administrator accounts for everyday work? The right answer is no: admin accounts separate, few, named and protected with MFA.

6. Email security. Filtering for phishing and malicious attachments, and often SPF, DKIM and DMARC set up on your domain. With 85% of attacks starting with phishing (DSIT 2025), this is the question behind most claims.

7. Staff awareness. Do people get training on phishing and payment fraud, and is it recorded? A short, regular programme with a record of who’s done it beats an annual session nobody remembers.

8. Incident response. Is there a written plan, and does it say who does what? It doesn’t have to be long. Cyber insurance underwriters want to see that someone’s thought about the first hour before it happens.

Do UK insurers require Cyber Essentials?

Usually not by name. Many small-business cyber insurance proposal forms ask whether you hold Cyber Essentials without making it a condition of cover. What they do require are its controls, because the scheme’s five areas (firewalls, secure configuration, user access control, malware protection and security updates) overlap heavily with the eight questions above.

So Cyber Essentials is useful either way. If your cyber insurance provider, a client or a contract asks for the certificate, get it. If nobody’s asking, running your business to Cyber Essentials standards gives you most of the answers an insurer wants, whether or not you certify. That’s how we run our own setup.

Want the evidence written up for you? We map your setup to the proposal form and write down what’s in place, so the next renewal is a document, not a scramble. Ring 0151 452 3060 or see managed cyber security.

Why cyber insurance claims get refused

Cyber insurance is like any other business cover in one important way. Under the Insurance Act 2015, a business has a duty of fair presentation: it has to disclose what the insurer would want to know, accurately. If a proposal form says multi-factor authentication is enforced everywhere and the claim investigation finds a director’s account without it, the insurer can reduce or refuse the payout depending on what they’d have done had they known. That’s the real risk in cyber insurance compliance. The thing worth worrying about isn’t an exotic exclusion. It’s an answer on the form that wasn’t quite true.

The common gaps are predictable. MFA on most accounts but not all, often a shared mailbox or an old admin login. Backups that run but have never been restored. A laptop that’s missed six months of updates because it lives at someone’s house. A leaver whose account was never switched off. Each of those is a small job to fix and an expensive one to discover after a claim.

The rule for any cyber insurance application is simple: answer the form as things actually are today, not as they should be. If something isn’t in place yet, say so and fix it, and tell the insurer when it’s done.

Cyber insurance requirements by sector

The eight controls apply to everyone, but some sectors get extra questions because of what they hold or what their regulator expects.

Accountants are asked about client data under UK GDPR and their AML obligations, and professional bodies such as the ICAEW publish their own guidance on cyber cover. Law firms face questions about payment fraud and conveyancing funds, with the SRA expecting firms to manage cyber risk. Financial advisers get asked about FCA obligations and operational resilience. Schools are measured against the DfE’s cyber security standards and KCSIE. Across all of them, the ICO’s expectations under UK GDPR sit underneath. Our sector pages go into each: accountants, financial services and schools.

A cyber insurance checklist you can run this week

• Is multi-factor sign-in enforced on every account, including shared mailboxes and admin logins?
• When was a file last restored from backup, and is that written down with a date?
• Does the backup cover Microsoft 365 email and OneDrive, and is it kept separately?
• Are critical updates applied within 14 days, on every device including home laptops?
• Is anything running past its end of support, and is there a plan with a date?
• Does anyone use an administrator account for everyday work?
• Is email filtering on, and are SPF, DKIM and DMARC set for your domain?
• Is there a record of staff phishing training in the last year?
• Is there a one-page incident plan that says who’s rung first?
• Could you send evidence for every “yes” above within a day?

Eight or more and you’re in good shape for your cyber insurance renewal. Fewer than six and it’s worth fixing the gaps before you answer the form, not after.

Meeting cyber insurance requirements in about a month

Week one: find out where you actually stand. Check the MFA report, restore a file from backup, list every device and when it last updated. Week two: close the quick wins, which are nearly always MFA gaps, admin accounts and leavers. Week three: sort patching and anything unsupported, and turn on email filtering and domain records if they’re missing. Week four: write the incident plan, record staff training, and put the evidence in one folder.

After that, keeping it true is the job. Controls drift: someone new joins without MFA, a backup job fails quietly, a laptop stops updating. That’s why cyber insurance requirements are easier to meet with somebody watching them every month than with a scramble every renewal.

Where to start

Start with the two questions that matter most on any cyber insurance form: is MFA enforced on every account, and when did a backup last restore? The answers tell you a lot about everything else. Our cyber security guide for small businesses covers the wider picture.

Renewal coming up? Book fifteen minutes with Eric this week and bring the proposal form. You’ll know which answers are solid and which need fixing before you sign it. Ring 0151 452 3060 and a person picks up.