What will your insurer ask about your IT at renewal?

At cyber insurance renewal, your insurer will ask how your firm protects its systems, backs up its data and recovers from an attack. Expect questions about multi-factor authentication, patching, backups, remote access, incident plans and whether you hold a certification such as Cyber Essentials.

The way to answer is simple to say and harder to do: answer only what you can show is true today. The NCSC is clear that “the onus is on you to ensure that your organisation’s cyber security details are accurate and up to date”, and that if they aren’t, “the insurer may not be obliged to pay any claims” (NCSC cyber insurance guidance).

What questions should we expect?

Every insurer’s form is different, but the Association of British Insurers publishes the kind of questions asked at application (ABI: buying cyber insurance). They fall into five groups:

• Controls. Do you use multi-factor authentication and encryption? Is remote access secure? Do you have anti-virus and firewalls, and do you patch critical systems regularly? Do you take extra steps against ransomware?
• Plans and history. Do you have a business continuity plan that covers cyber attacks, and has it been tested in the last 12 months? Have you had an incident before? Do you hold a certification such as Cyber Essentials?
• Data. What data do you hold, how much, and how sensitive is it? Is personal and confidential data encrypted?
• Backups. How often do you back up? Is the backup offline, protected by separate credentials and unreachable from your network? How quickly can you restore, and how often do you test it?
• Outsourcing. Which IT services are outsourced, and what due diligence do you do on the providers?

The backup questions are where many firms struggle. “Do you back up?” is easy. “How long would a full restore take, and when did you last test it?” usually isn’t. Our article on how to know your Microsoft 365 backup will work covers the evidence to ask for.

Who in the firm can actually answer them?

Usually not the person signing the form. If your IT is outsourced, the evidence sits with your provider, so ask them for it in writing well before the renewal date. The outsourcing question also means the insurer expects you to know what your provider does. Our article on what your IT provider is responsible for helps with that conversation.

An illustration, not a real case: a form asks whether multi-factor authentication is enforced on all accounts. The managing partner ticks yes, because everyone’s phone prompts them when they sign in. Nobody mentions the shared reception mailbox or the old administrator account, which don’t have it. After an incident that starts on one of those accounts, that answer becomes the insurer’s first question.

What happens if an answer turns out to be wrong?

The NCSC notes that most policies are “re-assessed every 12 months”, and that you “should also let your insurers know when your circumstances change”. If you change IT provider, move to new systems or open a new office, ask your broker whether the insurer needs to know.

An answer that was true last year may not be true now. Check each one against how things actually run today, not how they were set up.

Does Cyber Essentials help with insurance?

It can, in two ways. The NCSC says “some insurers offer discounts” where recognised defences are already in place. And certification itself comes with a small amount of cover. According to IASME, an organisation that certifies the whole business, is domiciled in the UK or Crown Dependencies, has turnover under £20m and opts in receives cyber liability insurance with a £25,000 limit of indemnity.

Treat that as a starting point rather than a full policy. The NCSC itself says it “won’t be suitable for all organisations”. For the certification steps, see Cyber Essentials requirements and how to prepare.

Do we need a cyber policy at all?

That is a decision for you and your broker, but the NCSC suggests three checks before buying. First, see whether you already have some cyber cover inside existing policies. Second, understand “what is excluded” as carefully as what is covered. Third, don’t limit yourself to the insurer’s minimum: “Do not limit yourself to meeting the minimum cyber security requirements specified by an insurer.”

How does managed IT help at renewal?

Most of these questions are about controls that someone has to run every day: multi-factor authentication, patching, monitoring and tested backups. In our managed IT service, those controls are aligned to recognised standards, with reporting that gives you evidence to show clients, insurers and regulators.

If renewal is coming up and you are unsure of some answers, the IT Risk and Ownership Review checks your insurer questionnaire answers against reality before you sign.

If your insurer asks about remote working, our guide to whether it’s safe for your staff to work from home covers what to have in place.

Frequently asked questions

Do we need Cyber Essentials to get cyber insurance?

Not necessarily, but forms often ask whether you hold a certification such as Cyber Essentials, and the NCSC notes that some insurers offer discounts for recognised defences.

Is the insurance that comes with Cyber Essentials enough?

It has a £25,000 limit and eligibility conditions, including turnover under £20m. The NCSC says it won’t suit every organisation, so discuss your actual exposure with a broker.

When should we tell our insurer about changes?

When your circumstances change, not only at renewal. A new IT provider, new systems or a security incident are all worth raising with your broker.