Cyber Insurance for Small Businesses: What Insurers Ask and Cover

Cyber insurance is a policy that helps a business pay for the cost of a cyber incident: the specialists who investigate and contain it, the work to restore systems and data, the income lost while the business cannot operate, the notices that must be sent to customers and regulators and, in many policies, claims made by third parties. For a small business, a serious incident such as ransomware, a fraudulent payment or a data breach can cost more than a year’s profit, and the first days of the response need expertise that most small firms do not employ. Insurance is therefore attractive, and many customers and partners now ask whether you have it.

It is not, however, a substitute for security, and insurers know that. The application form asks detailed questions about your controls, and the answers affect whether you are accepted, what you pay and whether a claim is honoured. This article explains what cyber insurance usually covers and excludes, which questions insurers ask, how to prepare your business so that you get cover at a sensible price, how to read a policy and what to do when an incident happens. It is general information, not insurance or legal advice, and policies differ widely, so read your own wording and ask your broker or adviser.

What Cyber Insurance Typically Covers

Policies are usually described in two parts. First-party cover pays for your own losses and response costs. Third-party cover responds to claims made against you by others. The exact list differs by insurer, and many items are optional or sublimited, which means that a smaller cap applies to that item.

Some policies also cover reputational harm, hardware replacement and the costs of dealing with a failure at a supplier on which you depend. Each of these is a separate item to look for, and they are not automatic.

What Is Commonly Excluded

Exclusions matter as much as the cover. Read these sections slowly, and ask the broker to explain any term that you do not understand.

• Known problems. Incidents that began before the policy started, or that you knew about, are normally excluded. A retroactive date in a claims-made policy decides how far back covered events can go.
• Failure to maintain security. Some policies exclude or reduce payment if the loss results from a security measure that you said you had but did not keep, for example multi-factor authentication that was not enabled on every account, or patches that were not applied.
• War and state-backed attacks. Insurers have tightened wording about attacks attributed to nation states and about wider conflict. The exact definition affects whether a widespread malware outbreak is covered.
• Infrastructure failures. A power cut, a telecoms outage or a failure of a large cloud provider may be excluded or limited.
• Bodily injury and property damage. These are usually the subject of other policies.
• Fines and penalties that cannot lawfully be insured.
• Unencrypted portable devices or unsupported software, in some policies.

The broker should also explain the excess or retention that you pay before the insurer pays, the aggregate limit and whether defence costs erode that limit.

What Insurers Ask: The Controls Behind the Price

Application forms have become a checklist of basic security. Answering them honestly is essential, because an inaccurate answer can give the insurer grounds to refuse a claim. The following areas appear again and again.

1. Multi-factor authentication. On email, remote access, administrative accounts, cloud services and backups. Our guide to multi-factor authentication and password managers explains how to roll it out.
2. Backups. Regular, separate from the main network, protected against deletion or encryption and tested by restoring. See our ransomware protection plan for the details.
3. Endpoint protection. Current antivirus or detection and response software on every computer and server, and disk encryption on portable devices, covered in our article on endpoint protection.
4. Patching. A routine for operating systems, applications and internet-facing services, with fast action on critical vulnerabilities. Software that no longer receives updates is a red flag.
5. Email security. Filtering for spam, malware and phishing, plus authentication records for your domain.
6. Access control. Least privilege, separate administrator accounts, removal of leavers’ access and review of who can reach sensitive data.
7. Remote access. No exposed remote desktop services, and access through a secured gateway.
8. Incident response. A written plan, contact details and a person responsible.
9. Training. Staff awareness of phishing and payment fraud, and a process for verifying changes to bank details.
10. Data handled. The number of records of personal, financial or health data, and the countries and sectors you serve.

The questions are not arbitrary. They reflect the way most small-business attacks actually succeed: stolen credentials, unpatched systems, unprotected backups and tricked employees. Doing these things lowers your risk, and it lowers your premium.

Prepare Before You Apply

A few weeks of preparation make a visible difference. Work through the list below and collect evidence for each item, because insurers and brokers may ask for screenshots or reports.

• Take inventory. List devices, servers, cloud services and who administers them. Our guide to IT asset inventory shows how to build it.
• Close the obvious gaps. Enable multi-factor authentication everywhere that it is available, update unsupported software, remove unused accounts and test a restore of your most important data.
• Write the response plan. Even one page that names who calls whom, how to isolate systems and how to contact the insurer. Use our template thinking in the article on a security incident response plan.
• Document your controls. A short, dated summary of what you do, who is responsible and when it was last reviewed.
• Check your contracts. Customers may require specific limits, and suppliers may be responsible for parts of your environment.
• Consider a recognised baseline. Schemes such as the UK’s Cyber Essentials describe a set of basic controls and, in some countries, certification can help with both customers and insurers.

Choosing a Limit and a Policy

Choose the amount of cover by thinking about a realistic bad day, not an imaginary catastrophe. Estimate what a week without systems would cost in lost income, what it would take to restore, how many people’s data you hold and what your customers’ contracts say about liability. Then compare quotes on the following points, not only on price.

1. Limits and sublimits. The overall limit, and the caps on extortion, social engineering and regulatory costs.
2. Retention and waiting period. How much you pay first and how long an outage must last before business interruption cover begins.
3. Retroactive date and claims-made terms. How far back covered events can be and how long you have to notify.
4. Panel providers. Whether the insurer’s response team is included and whether you can use your own advisers.
5. Conditions. Which security measures are written into the policy as conditions of cover.
6. Territory and jurisdiction. Whether cover applies where your customers and servers are.
7. The insurer’s claims reputation. Ask peers and your broker about speed and fairness.

A knowledgeable broker who understands small businesses is often worth the fee, and the broker should be able to compare several insurers on the same basis.

When an Incident Happens

The first hours matter for both the recovery and the claim. Most policies require prompt notice, and some provide a hotline that you should call before you hire your own experts, or the costs may not be reimbursed.

1. Contain. Disconnect affected devices from the network, but do not switch off systems or wipe them, because evidence may be lost. Follow your plan.
2. Call the insurer or the broker’s hotline and report the incident as the policy requires.
3. Preserve evidence. Keep logs, emails, ransom notes and screenshots, and record times and actions.
4. Do not pay or negotiate without advice. Payments may be illegal in some situations, and the policy may need prior consent.
5. Notify authorities and affected people as the law requires. Under the GDPR, a personal data breach must generally be reported to the supervisory authority within seventy-two hours of becoming aware of it, unless it is unlikely to result in a risk to people.
6. Keep receipts. Record every cost and every hour of lost trading, because you will need to prove the loss.

The NCSC incident management guidance explains how to organise a response, and the practice of rehearsing the plan once a year pays for itself the first time that you need it.

A Worked Example

A twelve-person accounting firm is asked by a large client to show evidence of cyber insurance. The partner asks a broker for quotes and receives a detailed form. The firm answers honestly and finds that it cannot say yes to several questions: multi-factor authentication is on email but not on the remote desktop, the backup disk is permanently connected to the server and two old computers still run an unsupported operating system.

The firm spends three weeks fixing these points. It enables multi-factor authentication on every remote login, adds an offline backup copy and tests a restore, replaces the old computers and writes a one-page response plan. The quotes that follow are lower and the conditions easier than the first indications, and the policy covers response costs, business interruption after a short waiting period and a modest social engineering sublimit. A year later a staff member receives a convincing fake invoice, and the firm’s verification rule, a call to a known number, stops the payment. The insurance was never used, but the preparation was worth the effort.

Common Mistakes

• Treating insurance as a replacement for security controls.
• Answering the application form optimistically, which can endanger a later claim.
• Buying on price without reading exclusions, sublimits and conditions.
• Assuming that fraud by deception is fully covered, when the sublimit is small.
• Waiting too long to notify the insurer or hiring experts before calling the hotline.
• Forgetting to update the insurer when the business changes, for example new services or a move to the cloud.
• Having no tested backup, so that insurance pays for a recovery that was avoidable.

Frequently Asked Questions

Is cyber insurance worth it for a very small business?

It can be, mainly because it provides access to experts and cash during a crisis. Weigh the premium against the realistic cost of an outage and any contract that requires cover, and compare it with the money spent on prevention. Do both where possible.

Will insurance pay a ransom?

Some policies cover extortion costs, subject to legal rules, sanctions and the insurer’s consent. Paying does not guarantee that data is restored, and the better approach is to prevent the situation with tested backups.

How much does it cost?

Premiums depend on the sector, turnover, data held, controls and limit chosen. Because they vary so widely, obtain several quotes through a broker, and expect better terms if your security is strong.

Does it cover mistakes by employees?

Many incidents begin with an employee mistake, such as clicking a link, and those are generally covered if the policy covers the resulting loss. Deliberate dishonesty by staff is treated differently and may fall under crime insurance.

What if I use a cloud provider and they fail?

Cover for failures at a supplier is optional in many policies and often has a lower limit or a waiting period. Ask specifically about it, and read our article on backing up cloud services.

Can an insurer refuse a claim?

Yes, if an exclusion applies or if the answers to the application were materially wrong or the stated controls were not maintained. This is the reason to be accurate and to keep the controls running.

The Bottom Line

Cyber insurance is a useful safety net when it is bought with open eyes: understand what is covered and excluded, answer the application truthfully, build the basic controls that insurers expect, keep evidence and a response plan and call for help early when something goes wrong. The same measures that lower your premium also lower the chance of a claim. If you need help to put these controls in place and keep them running, see our IT maintenance service.