A cyber insurance application can expose gaps that have sat unnoticed in your IT environment for years. Questions about multi-factor authentication, backup testing and patching are not paperwork exercises: insurers use them to judge how likely your organisation is to suffer a serious, avoidable incident. This SME cyber insurance requirements guide explains what UK insurers commonly expect, what evidence you may need, and how to prepare without treating insurance as a substitute for security.
Cyber insurance can help with the financial and operational impact of an attack, including incident response, legal advice, data recovery, business interruption and certain third-party costs. It does not remove the need to prevent attacks in the first place. In fact, the strength of your controls can affect whether cover is offered, its price, the excess, and the terms applied to a claim.
What insurers typically want from SMEs
There is no single UK standard for cyber insurance. Requirements vary by insurer, policy limit, industry, turnover, claims history and the data you hold. A small professional services firm with cloud-based systems will not face exactly the same assessment as a manufacturer with operational technology or a school handling sensitive pupil information.
Even so, most applications focus on a consistent set of security fundamentals. Insurers want assurance that an attacker cannot gain easy access through a stolen password, an unpatched device, an exposed remote service or a compromised supplier account. They also need confidence that the organisation can restore essential systems and respond in a controlled way.
For many SMEs, the most scrutinised areas are identity protection, patch management, email security, backup and recovery, endpoint protection, staff awareness, and incident response planning. A weakness in any one of these areas does not automatically make cover impossible, but it may lead to exclusions, higher premiums or a request for improvements before the policy begins.
SME cyber insurance requirements guide: the core controls
Multi-factor authentication
Multi-factor authentication, often called MFA, is now one of the clearest expectations. It should protect remote access, email, cloud platforms, privileged administrator accounts and financial or payroll systems. A password on its own is rarely sufficient, especially for Microsoft 365 and similar cloud services that are regularly targeted through phishing.
Insurers may ask whether MFA is enabled for all users or only administrators. The distinction matters. Protecting only IT administrators leaves ordinary user accounts vulnerable, and those accounts are frequently the route attackers use to access email, send fraudulent invoices or move further into a network.
Where possible, use an authenticator app, security key or other phishing-resistant method rather than relying solely on text messages. The right approach depends on your systems and users, but the objective is consistent: a stolen password should not be enough to enter a critical service.
Patching and supported systems
Unpatched software is a known route into business networks. Insurers commonly ask how quickly critical security updates are applied and whether unsupported operating systems, servers or applications remain in use.
A credible answer is more than stating that updates are enabled. You need a managed process that identifies devices, assesses critical updates, deploys them within defined timeframes and records exceptions. Some specialist or legacy applications cannot be patched immediately. If that applies, document the risk, limit exposure, segment the system where practical, and agree a replacement or mitigation plan.
Regular patching should cover laptops, desktops, servers, firewalls, network equipment, mobile devices and third-party applications. It also needs to account for staff working from home, where devices may spend long periods outside the office network.
Secure and tested backups
Backups are essential to recovery, but insurers increasingly distinguish between having a backup and being able to restore from it. Ransomware groups deliberately target backup systems, so copies that are permanently connected to the same network may not be enough.
A sensible backup arrangement includes separate copies, restricted administrative access, encryption and retention periods that match business needs. At least one copy should be protected from routine alteration or deletion, such as immutable or offline storage. Equally important, carry out restore tests. Test a file, a mailbox and, where relevant, a full system or server restoration. Record the results and resolve failures.
Your recovery objectives should be realistic. If finance, operations or learning systems must return within hours, make sure your technology, supplier arrangements and recovery plan can support that target. Insurance can fund assistance, but it cannot make an untested recovery process work under pressure.
Endpoint, email and network security
Managed endpoint protection should be installed across all supported devices, monitored and kept current. Basic antivirus may not provide the visibility or response capability insurers expect for larger or higher-risk organisations. Depending on your environment, endpoint detection and response may be appropriate, particularly where remote working is widespread or sensitive information is held.
Email remains a leading source of cyber incidents. Controls should reduce spoofed emails, malicious attachments and credential-harvesting attempts, while staff must have a simple way to report suspicious messages. Domain protection settings, secure email filtering and clear payment verification procedures work together to reduce fraud risk.
Network security also matters. Firewalls should be properly configured and maintained, remote administration should not be exposed unnecessarily to the internet, and guest, staff and critical systems should be separated where the risk justifies it. Flat networks make it easier for an intruder to move from one compromised machine to valuable systems.
People, processes and access control
Many cyber claims begin with a convincing email, an unauthorised payment request or a reused password. Regular, relevant security awareness training gives staff the context to act safely. Training is most useful when it addresses the risks people actually face, such as Microsoft 365 account prompts, invoice fraud, shared document scams and requests to change bank details.
Insurers may also ask about user access. Staff should receive only the access required for their role, privileged accounts should be tightly controlled, and leavers must be removed promptly. Shared administrator logins make accountability difficult and can create a significant problem during a claim investigation.
Documented procedures are equally valuable. A clear process for approving payments, onboarding staff, authorising access and reporting suspected incidents demonstrates that security is embedded in operations rather than left to individual judgement.
Be accurate on the proposal form
Cyber insurance forms often contain declarations or statements that are central to the policy. Answering optimistically can create more risk than admitting a gap. If MFA is only active for some services, say so. If backups have not been restored-tested recently, do not describe them as fully tested.
Before submitting an application, involve the person responsible for IT or your managed service provider. They can validate the technical answers and identify assumptions that a finance or operations team may reasonably make but cannot evidence. Keep a copy of the completed form, supporting documents and any insurer correspondence, particularly where an insurer accepts a known exception.
This is not simply an administrative safeguard. After a serious incident, insurers may review whether the answers were accurate at the point cover was arranged and whether policy conditions were met. Clear records help protect the organisation as well as improve its security posture.
Create evidence before you need it
The strongest preparation is a concise, maintained record of your controls. It should show your asset inventory, MFA coverage, patching reports, endpoint protection status, backup configuration and restore-test results. Include staff training records, access reviews, supplier contacts and your incident response plan.
Do not create documents purely for an insurer and then leave them untouched. They should be operational records that help management see whether security controls are working. For example, a monthly review of devices missing updates is useful whether or not an insurer asks for it.
A risk register can also add context. It allows you to record known issues, the impact they could have, the controls already in place and the target date for improvement. This is particularly helpful where budget, legacy technology or a complex supplier dependency means a risk cannot be eliminated immediately.
Prepare to respond, not just to prevent
Insurers want to know who will act when something goes wrong. An incident response plan should set out who can make decisions, how to contact IT support and key suppliers, how systems may be isolated, and how staff, customers and regulators will be informed where necessary.
The plan should not sit unread in a shared folder. Walk through a realistic scenario, such as a compromised Microsoft 365 account or ransomware affecting a file server. Check who has authority to take systems offline, where emergency contact details are held and how the business will continue if normal communications are unavailable.
For organisations in Cambridge, Cambridgeshire and the wider South East, a proactive IT partner can make this work practical rather than theoretical. Ask IT Solutions can assess existing controls, address priority gaps and help establish the evidence and recovery processes that support both resilience and insurance readiness.
The right cyber policy is valuable when an incident has financial consequences, but the most useful outcome of the application process is a clearer understanding of your operational risk. Treat the insurer’s questions as a prompt to strengthen the controls your organisation relies on every working day.
