Most cyber insurers now ask about the same handful of controls: multi-factor authentication, endpoint protection, backups, patching, old software, email filtering, staff training, an incident response plan and how you check payment requests. Answer each one accurately, with evidence, because a wrong "yes" can undermine a claim. Get your IT provider to help complete the form, fix quick gaps before you submit, and explain partial answers rather than guessing. Cyber Essentials makes most of this easier to prove.
Why have renewal questions got harder?
Ten years ago, a cyber policy was often a short form and a price. Insurers paid out on a lot of ransomware and email fraud claims, and they learned which businesses claim. Now they ask about the specific controls that make a claim less likely, and they price, restrict or refuse cover based on the answers.
Cover is common but not universal. The UK government's Cyber Security Breaches Survey 2025/2026 found that 47% of businesses have some form of cyber insurance, but only 10% have a specific cyber policy. The rest rely on cyber cover inside a broader policy, which is often more limited. Among charities, 35% have some cover (DSIT, April 2026).
The NCSC is blunt about what insurance does: it "will not prevent a cyber breach/attack" (NCSC, Cyber insurance guidance). The questions exist because the insurer wants to know you've done the prevention yourself.
What questions will the insurer ask?
Wording varies between insurers, but the subjects rarely do. Marsh Commercial lists six controls that insurers focus on: multi-factor authentication (MFA), email and web filtering, secured and tested backups, incident response plans, awareness training, and replacing or protecting end-of-life systems that no longer get security updates (Marsh Commercial, 2022). Most proposal forms add patching, endpoint protection and payment checks.
| Question | What they really want to know | Evidence to have ready |
|---|---|---|
| Is MFA enforced for email, remote access and admin accounts? | Can a stolen password alone get someone in? | Conditional access policy, MFA registration report, list of any exceptions |
| Do you run endpoint detection and response (EDR) on all devices? | Will an attack be spotted and stopped on a laptop or server? | EDR console showing device count against your asset list |
| Are backups separate, protected and tested? | Can you recover without paying a ransom? | Backup reports, including Microsoft 365, and the date of the last restore test |
| How quickly do you apply critical security updates? | Are known holes left open? | Patch compliance report. Cyber Essentials requires critical and high-risk updates within 14 days |
| Do you run any unsupported software or systems? | Are there devices that can't be patched at all? | Device list with operating system versions, and a plan for anything out of support |
| Is inbound email filtered for malicious links and attachments? | How much phishing reaches staff? | Name of email security product and its policies |
| Do staff get security awareness training? | Will people spot and report a phishing email? | Training records, phishing simulation results |
| Do you have an incident response plan? | Will you call the insurer's helpline quickly, or improvise? | A written plan, with contact numbers, reviewed in the last year |
| How do you verify new or changed bank details? | Could a fake invoice empty your account? | Written call-back process and dual authorisation in your banking |
Old software deserves a special mention this autumn. Windows 10 reached end of support in October 2025, and the first year of paid extended security updates ended on 13 October 2026. Any Windows 10 PC that isn't on a renewed extended updates plan is now unsupported, and the honest answer to "do you run unsupported systems?" is yes. Our article on Windows 10 extended security updates sets out the options.
How should you answer?
Business insurance in the UK comes with a duty of fair presentation under the Insurance Act 2015. You must disclose what you know, or ought to know, that would affect the insurer's decision, and you must not misrepresent it. If an answer turns out to be wrong, what the insurer can do depends on what it would have done had it known. That can include reducing a claim payment.
In practice, that means five rules.
- Don't answer from memory. "Yes, we have MFA" is often true for most staff and false for the one shared mailbox or the director who asked to be excluded. Those exceptions are exactly where attacks start.
- Ask your IT provider to complete the technical section, or at least check it. They can see the reports you'd otherwise guess at.
- Explain partial answers. "MFA on all accounts except two service accounts, which are restricted to our office IP address" is better than a bare "yes" or "no". Most forms have a notes box. Use it.
- Fix quick gaps before you submit. Turning on MFA for the last few accounts or setting up an alert can take a day. Doing it before renewal lets you answer "yes" truthfully.
- Keep a copy of what you said. If something changes during the year, such as a new office or a big system change, tell your broker.
Does Cyber Essentials help?
Yes, in two ways. First, it covers much of the same ground: firewalls, secure configuration, user access control, malware protection and patching within 14 days, with MFA required on cloud services. Organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance, according to an NCSC figure (Infosecurity Magazine, September 2026). Many insurers ask for the certificate number instead of some of the individual questions.
Second, small organisations can get some cover with it. UK businesses with turnover under £20 million that certify their whole organisation can opt in to cyber liability insurance with a £25,000 limit, underwritten by AIG and arranged through IASME's broker, with options to increase the limit (IASME, September 2026). It excludes money stolen through cyber fraud, so it's a starting point, not a replacement for a full policy.
Worked example: a 35-person firm's renewal
Example (an illustration, not a real client): a 35-person engineering consultancy receives its renewal form six weeks before its policy ends.
The office manager starts filling it in and gets stuck on four questions. The IT provider runs the reports. MFA is on for 33 of 35 accounts: a director and a scanner mailbox are excluded. Endpoint detection and response (EDR) is on every laptop but not the old file server. Microsoft 365 isn't backed up separately. Two PCs are still on Windows 10.
Over three weeks, MFA goes on the director's account, the scanner mailbox is restricted, EDR goes on the server, Microsoft 365 backup is added and tested, and the two PCs are replaced. The firm submits a form where every "yes" is backed by a report, and the broker attaches the firm's new Cyber Essentials certificate. Without those three weeks, the honest answers would have been four "partly"s.
How Indigo does this. Indigo Unified Communications is Cyber Essentials Plus certified, and Cyber Essentials support is included in our Platinum package. Every managed IT client gets INKY email security and Kaseya 365 Endpoint, which protects each device against viruses and ransomware (endpoint detection and response). Our Platinum and Charity packages add a dedicated security team watching your systems 24/7 (a security operations centre, using RocketCyber). We back up Microsoft 365 with Datto SaaS Protection. For Greenversity, a renewable energy client, we met a cyber insurance requirement by implementing Microsoft Intune. Read the Greenversity case study → We help clients complete insurance proposal forms as part of support on Gold and above; on Silver it's chargeable.
What to do next
- Find your renewal date and diary a start date six weeks before it.
- Get last year's proposal form from your broker, so you can see the questions early.
- Ask your IT provider for evidence on MFA, EDR, backups, patching and unsupported devices.
- Write or update your incident response plan, with your insurer's helpline number in it.
- Book a free IT health check and we'll test your answers against what your systems actually show.
Frequently asked questions
What do cyber insurers ask at renewal?
Most ask whether MFA is enforced for email, remote access and admin accounts, whether you run endpoint detection and response, whether backups are separate and tested, how fast you patch, whether you run unsupported software, and whether you have email filtering, staff training, an incident response plan and a process for verifying changes to bank details.
What happens if I answer a cyber insurance question wrongly?
For business insurance, the Insurance Act 2015 requires a fair presentation of the risk. If an answer was wrong, the insurer's remedy depends on what it would have done had it known. That can mean a reduced claim payment or, in serious cases, avoiding the policy (treating it as if it never existed). Check answers with your IT provider and explain anything partial.
Does Cyber Essentials lower cyber insurance premiums?
It can help. Insurers see it as evidence of basic controls, and the NCSC reports certified organisations are 92% less likely to claim. Businesses under £20 million turnover that certify their whole organisation can also opt in to £25,000 of cyber liability cover. Pricing is set by each insurer, so ask your broker.
Is cyber cover in my business package policy enough?
Possibly not. The government's 2025/2026 breaches survey found most insured businesses rely on cyber cover inside a broader policy rather than a specific one. Check the limit, whether ransomware, business interruption and payment fraud are covered, and whether an incident helpline is included. Your broker can compare it with a standalone policy.
Sources: DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) · NCSC, Cyber insurance guidance, 6 August 2020 (https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance) · Marsh Commercial, Six controls to help strengthen your cybersecurity, 3 October 2022 (https://www.marshcommercial.co.uk/articles/six-controls-to-help-strengthen-your-cybersecurity.html) · NCSC, Cyber Essentials: Requirements for IT infrastructure v3.3, April 2026 (https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) · Insurance Act 2015, section 3, The duty of fair presentation (https://www.legislation.gov.uk/ukpga/2015/4/section/3) · Infosecurity Magazine, Cyber Essentials has record year, 17 September 2026 (https://www.infosecurity-magazine.com/news/cyber-essentials-has-record-year/) · IASME, Cyber liability insurance, accessed September 2026 (https://iasme.co.uk/cyber-essentials/cyber-liability-insurance/) · Microsoft, Windows 10 support has ended on October 14, 2025 (https://support.microsoft.com/en-us/windows/windows-10-support-has-ended-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281)
Related: Cyber Essentials explained · Passwords, MFA and passkeys · How do you back up Microsoft 365? · Payment diversion fraud in construction · Cyber security
How secure is your business, really?
Book a free security review. We'll check your Microsoft 365, devices and backups against Cyber Essentials and give you a short list of fixes.