A cyber insurance application can expose weaknesses long before a claim does. Questions about multi-factor authentication, backups, patching and supplier access are no longer administrative formalities. For many organisations, business cyber insurance requirements now act as a practical test of whether their security controls can withstand a real incident.
Cyber insurance can provide valuable financial and specialist support after ransomware, fraud, data loss or business interruption. It is not, however, a substitute for managed security, tested recovery or clear internal processes. Insurers want evidence that an organisation is taking reasonable steps to prevent an avoidable loss – and they may limit or decline cover where information supplied during the application is inaccurate or key controls are not maintained.
What are business cyber insurance requirements?
There is no single UK rulebook that applies to every insurer or policy. Requirements vary according to your turnover, sector, the data you hold, your reliance on technology and the level of cover requested. A small professional services firm will face a different assessment from a school, multi-site business or organisation processing payment card data.
That said, insurers increasingly look for a consistent baseline. They want to know who can access your systems, how those accounts are protected, whether devices are updated, and whether you can recover critical services without paying a criminal.
The application is also a declaration of fact. If it states that multi-factor authentication is in place for remote access and Microsoft 365, that needs to be true in practice, not simply planned for the next project. Policy wording can include conditions requiring you to keep those controls operating throughout the policy period.
The security controls insurers commonly expect
Multi-factor authentication for critical access
Multi-factor authentication, often shortened to MFA, is one of the most common requirements. It adds a second verification step beyond a password and should normally protect remote access, administrator accounts, cloud email and other systems containing sensitive data.
This matters because compromised email accounts remain a frequent route into fraud, ransomware and data theft. A strong password policy is useful, but it is rarely enough on its own. Insurers may ask whether MFA applies to all users, whether exceptions exist, and how privileged accounts are managed.
Patch management and supported systems
Unpatched software creates an opening attackers can exploit at scale. Insurers commonly ask whether operating systems, firewalls, applications and network devices are supported and updated within defined timescales.
A dependable patching process balances security with operational continuity. Critical vulnerabilities may need urgent action, while less severe updates can be tested and scheduled. What matters is that there is ownership, visibility and a record of action. Unsupported servers or ageing line-of-business software do not automatically make insurance impossible, but they should be identified and addressed with a documented risk plan.
Protected, tested backups
A backup that sits permanently connected to the same network as the systems it protects may be encrypted alongside them during a ransomware attack. Insurers increasingly look for backups that are separated from the live environment, protected from unauthorised deletion and tested for restoration.
The practical question is not merely whether data is backed up. It is whether your organisation can restore the data, systems and configurations needed to resume operations within an acceptable timeframe. Microsoft 365 is a good example: native retention features have value, but they are not always a complete backup and recovery strategy for business-critical email, SharePoint and OneDrive data.
Endpoint protection and monitoring
Traditional anti-virus alone may not meet an insurer’s expectations, particularly where organisations hold large volumes of personal, financial or commercially sensitive information. Managed endpoint detection and response can provide greater visibility of suspicious activity, while central monitoring helps teams identify whether an attack is spreading.
The right level of protection depends on risk. A small organisation may not need the same tooling as a large enterprise, but every organisation needs clear oversight of its laptops, desktops and servers. Unmanaged devices, local administrator rights and unknown software are common gaps that make both security and insurance applications harder to manage.
Staff awareness and payment controls
People are regularly targeted through phishing emails, fake invoices and fraudulent requests to change bank details. Insurers may ask about security awareness training and simulated phishing exercises, but training should support clear processes rather than become a box-ticking exercise.
For payments, an independent verification process is essential. A change to supplier bank details or an urgent payment request should be checked through a known telephone number or established contact route, not by replying to the email that made the request. This simple control can prevent costly business email compromise claims.
Evidence matters as much as the answer
An application may be completed by a director, finance lead or broker, but the answers usually depend on IT evidence. Before submitting it, gather accurate information on your systems, security tools, backups, user access and incident response arrangements.
Avoid assumptions such as “we have MFA” when only senior staff use it, or “our backups are secure” when no restoration test has been completed. Overstating your controls can create serious difficulties after an incident. Equally, a truthful answer that highlights a gap is not always fatal to obtaining cover. It can prompt a sensible discussion with an insurer or broker about timescales, exclusions and the actions required.
A useful preparation exercise is to assign an owner to each answer. IT can validate technical controls, finance can confirm payment procedures, HR can confirm training arrangements, and senior management can approve the final declaration. This reduces the risk of a form being completed in isolation without operational checks.
Policy conditions, exclusions and limits need careful reading
Meeting business cyber insurance requirements at the application stage does not mean every cyber event will be covered without question. Policies differ substantially in scope, sub-limits, exclusions and notification obligations.
Check how the policy treats ransomware, funds transfer fraud, business interruption, data restoration, legal advice, regulatory support and crisis communications. Some costs may have separate limits. Business interruption cover may also depend on how the insurer defines a system outage and how it calculates lost income.
Notification terms are particularly important. If a suspected incident occurs, policies often require the insurer or its appointed incident response team to be contacted promptly before engaging external forensic, legal or recovery providers. Acting too slowly can increase damage; acting outside the agreed process can complicate a claim.
For schools and organisations working with children or vulnerable people, consider the sensitivity of the data involved and the operational consequences of prolonged loss of access. Safeguarding records, learning platforms, communications systems and finance functions may all have different recovery priorities. A policy should be considered alongside, not instead of, a rehearsed continuity plan.
Build an insurable security position
The most effective approach is to treat insurance readiness as part of normal IT governance. Review user access regularly, remove dormant accounts, apply MFA consistently, maintain patching records, monitor endpoints and test recovery against realistic scenarios. Keep an up-to-date inventory of devices, systems and suppliers so you know what must be protected and restored.
It also helps to document an incident response plan that names decision-makers, sets out escalation routes and includes contact details that remain available if email is unavailable. A short tabletop exercise can reveal practical issues quickly: who has authority to shut down access, who speaks to insurers, and how will staff, customers or parents receive updates?
Herons IT works with organisations that want these controls to support daily resilience, not merely an annual insurance form. Proactive support, security reviews and tested backup arrangements can reduce disruption while giving decision-makers a clearer view of their risk position.
Cyber insurance is most valuable when it sits behind well-managed technology, rather than trying to compensate for its absence. Start with the controls most likely to prevent a serious incident, test the recovery measures you would rely on, and make sure the answers on your next application reflect the environment you actually run.