Cyber insurance buying guide for UK SMEs

Cyber insurance can help a UK SME pay for specified losses and specialist support after a cyber incident. It does not prevent an attack, guarantee recovery or cover every cost. The useful buying question is whether a policy covers the losses your business could suffer, on conditions you can meet.

This guide is for an owner, finance lead or IT manager preparing to discuss cover with an insurance broker. It explains the questions to resolve before comparing premiums, how to check the technical declarations and what to put into an incident plan once cover is agreed.

Start with the incident your business could face

Describe a plausible disruption in operational terms. An online retailer might be unable to accept orders. An accountancy firm might lose access to client files during a filing deadline. A manufacturer might keep producing goods but lose its scheduling and dispatch system.

For each scenario, record the affected service, the dependency that failed, the work you could continue manually and the costs you would need to fund. Include external investigation, restoring systems, staff overtime, customer communication and lost trading where relevant. These are exposure categories to investigate, not a promise that a policy will reimburse them.

The NCSC's cyber insurance guidance recommends involving people who understand the business, its technology and its legal and commercial obligations. An IT provider can explain how backups work. The finance lead must explain what an interruption would cost. Neither should guess the other's answer on an insurance proposal.

Check existing property, professional indemnity and other policies with your broker. There may be related cover, exclusions or overlapping requirements. Obtain a written explanation of how the proposed cyber policy fits rather than assuming that a familiar policy name covers a cyber incident.

Understand the two sides of cover

First-party cover concerns specified losses or costs suffered by your business. Third-party cover concerns specified claims or liabilities involving others. The distinction helps organise questions; the policy wording decides what is insured.

A policy can provide access to a response team without providing unlimited assistance. Ask about service availability, geographical coverage, appointment procedures and financial sublimits. Keep the emergency contact details somewhere accessible if your email and document store are unavailable.

Do not assume that fines, ransom demands or all extortion-related costs are insurable or covered. Ask the broker and appropriate legal advisers to explain the wording and applicable restrictions. A policy discussion is not authority to make a payment.

Read exclusions alongside the cover

A useful comparison records both what is included and what can prevent or limit a claim. Ask the broker to explain exclusions in language that relates to your business. For example, what happens if the incident starts at a supplier, uses an account without required multi-factor authentication or exposes a control statement that was inaccurate when you applied?

Check definitions as well as headings. Terms describing systems, suppliers, incidents and losses can determine whether a scenario falls within cover. Record the answer in the comparison, along with the relevant section of the wording. A sales summary should help you navigate the policy, but it cannot substitute for reading it.

Be particularly clear about notification, consent and evidence requirements. Find out when to contact the insurer, which response costs need approval and how to preserve records without delaying necessary containment. Resolve these questions while systems are working.

Verify the security declarations

Answer proposal questions using evidence. If the question asks whether MFA protects all relevant remote access, check the actual accounts and routes. A policy document saying MFA is required does not prove that a legacy administrator login uses it.

Use a short evidence sheet for each material control:

• The question asked and the scope of the answer.
• The system, account group or device population checked.
• The evidence and date of the check.
• Any exception, its owner and the action agreed.
• The person authorised to confirm the answer to the broker.

Apply the same discipline to backups, patching, endpoint protection and supplier access. If you do not know the answer, investigate or disclose the uncertainty through the broker. Do not select a reassuring answer because you expect the control to be installed soon.

The NCSC warns that inaccurate information or changes in circumstances may affect cover. Ask how to report a material change during the policy period, such as a new business activity, acquisition or change to critical systems. Keep the final proposal and supporting evidence with the policy records.

Cyber Essentials can help organise baseline technical controls. Some insurers may take certification into account, but it does not guarantee a discount, acceptance or sufficient cover. Check any insurance included with a certification offering against eligibility, limits and your actual exposure.

Compare quotes without inventing a market price

Premiums alone cannot tell you whether two policies are equivalent. Compare the insured activities, limit, excess, waiting periods, sublimits, exclusions, response services and conditions. Ask the broker what information has the greatest effect on the quotation and whether a control improvement would change its terms.

There is no reliable universal premium for an SME of a given headcount. Revenue, activities, data, dependencies, claims history, controls and requested cover all affect the assessment. Use a quote for your actual business rather than a generic online range as your budget authority.

Build a comparison with three columns: the business requirement, the policy answer and the unresolved question. A cheaper option with an unresolved critical dependency is not ready for acceptance simply because it fits the budget.

Worked example: an online shop comparing interruption cover

Consider a hypothetical retailer whose website depends on a hosted commerce platform and an external fulfilment service. Its initial requirement is simply "cover lost sales". That is too vague to compare policies.

The finance lead defines the trading records needed to calculate loss. The operations lead identifies a manual way to fulfil existing orders, but confirms that new orders stop when the platform is unavailable. The IT lead records which outages the retailer can fix and which depend on suppliers.

The broker is then asked whether each supplier-outage scenario falls within the proposed interruption cover, what waiting period applies and which limit would be used. One quotation leaves the platform dependency unclear. The retailer records that issue as unresolved and obtains a written explanation before choosing cover.

The completed decision is to compare policies against a defined supplier outage, with evidence for the loss calculation. It is not to assume that every online shop needs the same limit or that insurance replaces the manual fulfilment plan.

Put the policy into the incident plan

Assign someone to contact the insurer or response line and a deputy if they are unavailable. Record who can approve expenditure, appoint advisers and speak for the business. Make the policy details accessible without relying on the potentially affected account.

Insurance notification and regulatory notification are separate decisions. Under the ICO's personal data breach guidance, a controller must notify the ICO unless the breach is unlikely to risk people's rights and freedoms. Where notification is required, it must be made without undue delay and, where feasible, within 72 hours of awareness. A processor must notify its controller without undue delay. High-risk breaches can also require prompt notification to affected people.

Do not wait for an insurer's claims decision before assessing those duties. Record when the organisation became aware, the facts available, decisions and actions. Preserve evidence in a way that supports investigation and safe recovery.

Discuss a short scenario with the people who would act: the website is unavailable, the finance mailbox may be compromised and the usual manager cannot be reached. Confirm that someone can find the policy, use the response number and make the first decisions. Any missing contact or unclear authority becomes a specific repair to the plan.

Decide what to do next

Before approaching a broker, prepare the critical-service list, plausible incident scenarios, control evidence and existing policies. After receiving quotations, resolve the gaps in scope and conditions before treating a premium as an agreed solution.

If your difficulty is establishing whether the security declarations are true, our security consulting and IT management services can help examine the controls and dependencies behind them. Arrange a consultation with the proposal questions and the systems they concern. Insurance advice and placement remain matters for an appropriately qualified insurance adviser.