Cybersecurity Insurance: What It Covers and What Insurers Ask

Cybersecurity insurance is a policy that helps an organisation recover financially and operationally from incidents such as ransomware, data breaches and business interruption. Depending on the policy it can pay for incident response, legal costs, regulatory matters and claims from customers, and some policies add access to forensic and response specialists.

What it will not do is prevent an attack or fix weak security. The NCSC is plain on this point, and insurers act accordingly: they want to see the controls you have in place before they take on the risk.

This guide covers what is usually included, the exclusions that catch people out, what insurers ask, how to get quotes and what to expect if you claim.

What cybersecurity insurance covers

Policies differ, so the wording matters more than the label. The NCSC cyber insurance guidance says most policies work to restore systems and data quickly, reduce business interruption losses and cover the defence and settlement of claims from customers or other parties after a data breach.

Some also cover computer-enabled fraud, and some include extras such as IT forensics, legal help, public relations support and access to incident response firms.

As a rule of thumb, ask the broker to walk through three realistic scenarios against the wording: a ransomware outage, a stolen mailbox leading to a fraudulent payment, and a supplier compromise. The answers show quickly where cover is thin.

First-party and third-party cover

Cover is usually described in two halves. The table shows the typical split; confirm each item against your own policy schedule.

Check the limit for each section separately. A generous overall limit can sit alongside a small sub-limit for the item most likely to hit you.

Common exclusions and gaps to check

The NCSC does not publish a full exclusions list, because every policy is different. It does flag several areas to examine:

• business email compromise fraud, which standard policies may not cover;
• new types of attack that fall outside existing wording;
• policy limits that do not match your real exposure;
• compensation claims arising from lost personal data.

Also check whether your existing property or business interruption policies already include or exclude cyber events, so you do not buy duplicate cover or assume cover that is not there. Ask the broker to explain any wording on war, infrastructure failure or unpatched systems in plain terms, and get the answer in writing.

Finally, check what happens if your security changes mid-term. Policies are reassessed at renewal, but a material change in between, such as moving to a new platform or switching IT provider, may need to be disclosed. Our guide to switching IT support providers covers the practical side of that change.

What insurers ask for before they quote

Expect a proposal form or questionnaire about your technical, procedural and human controls. Questions vary by insurer, but they commonly probe:

• multi-factor authentication on email, remote access and admin accounts;
• backups, including whether copies are offline or immutable and whether restores are tested;
• endpoint protection, including whether you run managed endpoint detection and response;
• patching routines for operating systems, applications and internet-facing devices;
• staff awareness training and how phishing is handled;
• evidence of a recognised scheme such as Cyber Essentials.

The NCSC advises gathering input from your IT provider before answering, and warns that claiming controls are in place when they are not may mean the insurer is not obliged to pay a claim. A managed IT support provider can confirm what is deployed, and a cyber security audit gives you evidence to attach.

Answer from evidence, not memory. If the form asks whether multi-factor authentication covers all remote access, check the identity platform, not the policy document. Where you use Microsoft 365, our Microsoft 365 support team can confirm how sign-in protection is configured.

Where Cyber Essentials fits

The NCSC guidance notes that Cyber Essentials or Cyber Essentials Plus may lower premiums. Separately, the NCSC Cyber Essentials overview states that UK organisations with turnover under £20m that certify their whole organisation qualify automatically for cyber liability insurance arranged by IASME, the NCSC's delivery partner, including 24/7 incident response support (as at October 2026).

That cover is tied to certification, so read the terms before relying on it as your only protection. Our pages on Cyber Essentials and Cyber Essentials cost explain how certification works and what it involves.

Eligibility rules and policy terms can change, so confirm the current position with IASME or your assessor at the point of certification, and keep the certificate and scope statement with your insurance records.

How to get cybersecurity insurance quotes

A broker is the usual route, and the NCSC notes smaller organisations can rely on one. A practical process:

• List your critical systems and the incidents you most need to survive, such as a week without email or a ransomware outage.
• Collect control evidence: MFA coverage, backup tests, patch reports, training records.
• Ask for quotes on the same limits and compare retentions (the excess), sub-limits, waiting periods and exclusions.
• Ask what response services come with the policy and how to reach them out of hours.
• Have someone technical and someone who handles contracts read the draft wording.

Cover is typically reassessed every 12 months, and you are responsible for keeping your security details accurate. Tell the insurer when circumstances change.

Claims process basics

Details differ, but the pattern is consistent. Keep the insurer's contact details and policy number somewhere you can reach if systems are down, as the NCSC small business guidance recommends.

• Notify the insurer early, because many policies set notice conditions and may route you to approved responders.
• Keep a timeline and log of actions taken, which also supports ICO and regulator reporting.
• Do not agree to pay a ransom without taking advice. The joint NCSC, ABI, BIBA and IUA ransomware guidance supports consistent insurer and broker handling, and the NCSC strongly discourages payment.
• Expect questions about the controls you described at proposal stage.
• Keep copies of correspondence, invoices and logs, since you may need them to evidence the loss.

Our guide to phishing types and prevention covers a common starting point for claims.

What insurance does not replace

Insurance transfers part of the financial risk. It leaves the operational risk with you. Tested backups, an incident plan, trained staff and patched systems still decide how bad an incident becomes.

The Cyber Security Breaches Survey 2025/2026 found 47% of businesses had some insurance that covers cyber risk, but only 10% had a specific cyber policy. That gap suggests many firms are relying on general policies that may not respond as expected.

Our cybersecurity for small business page sets out the controls that support both resilience and insurability.

Keep the insurer's claims contact in your printed incident plan, not only in an inbox that may be offline.

Questions to ask your broker or insurer

The NCSC guidance frames six questions that apply to most buyers. In plain terms:

• What defences do we already have, and have we asked our IT provider and key staff rather than guessing?
• Who will read the policy wording, and do they include contract, technical and process owners?
• What would an incident cost us in business interruption, recovery and data loss?
• What is covered and excluded, what are the limits and what immediate response help is included?
• Which bundled services, such as resilience planning, do we actually need?
• What incident support is provided, including forensics, legal help, PR and access to response firms?

If you have no in-house expertise, the NCSC notes you can use an NCSC-assured consultancy to help assess the policy. Bring the answers to the first call and the quotes become much easier to compare.

Where the figures show only 10% of businesses with a specific cyber policy, the lesson is to read what you have already. Many firms hold cover they have never tested against a real scenario.

Do you need a standalone policy?

Start by checking whether existing business interruption or property cover already includes cyber events, or excludes them. The NCSC notes this check should come before you buy anything.

A standalone policy generally gives clearer first-party and third-party wording, and more specific response services. Whether it is proportionate depends on your dependence on IT, the data you hold and how long you could operate without systems. Accountancy practices, for example, hold sensitive client data and have deadline-driven workloads, which raises both the impact and the insurer's interest.

Conclusion

Cybersecurity insurance is worth considering, but treat it as one layer. Know what is covered, read the exclusions, answer proposal questions accurately and keep the controls running. If you want help preparing evidence for a quote, speak to NetMonkeys.

Frequently Asked Questions (FAQs)