Cyber insurance: what UK SMEs actually get asked (2026)

Most UK owner-managers meet cyber insurance the wrong way round. A tender, a landlord, a bank facility or a bigger customer asks for "evidence of cyber cover". Or a broker emails a twenty-page proposal form that reads like an audit.

This guide is for firms with roughly 5 to 50 people. It explains what the questions are testing, which answers trip people up, and what to fix first. It is not a recommendation to buy a particular policy. It is not a substitute for a broker who knows your trade.

What cyber insurance is, and what it is not

Cyber insurance is a contract that may help with certain costs after a cyber incident. That can include forensic work, legal advice, business interruption, and telling customers their data was affected. Exact cover depends on the policy wording.

It is not a substitute for backups, MFA, or someone who knows how to lock out a stolen Microsoft 365 login. Insurers know that. The proposal form is their way of checking you already run a basic, boring security baseline.

If a broker sells fear first and paperwork second, slow down. Ask for a plain summary of what is covered, what is excluded, the excess, and what you must do if something goes wrong.

Why the form feels like an IT audit

Insurers price risk with checklists. For a small firm they rarely send anyone to test your systems. Instead they ask yes or no questions about:

• Multi-factor authentication (MFA) on email and remote access
• How you manage passwords and admin accounts
• Backups: how often, whether one copy is offline, and whether you have tested a restore
• Security software and updates on laptops
• Staff awareness of phishing
• Who you call in an incident, and how fast you can cut off access
• Cyber Essentials or other certificates, if you have them
• Any claims or serious incidents in the last few years

Answer honestly. Ticking "yes" to look good can come back to bite you if you ever need to claim.

The questions that catch most small firms

MFA on email and remote access

"Is MFA enabled for all users with remote access to email or the network?" is the classic question.

If your Microsoft 365 or Google Workspace still allows password-only sign-in, expect friction. The same goes for remote desktop left open to the internet without MFA.

Fix it: turn MFA on for every admin first, then every user. Prefer an authenticator app over text messages where you can. Note the date you finished. Our MFA for Microsoft 365 beginners guide walks through it step by step.

Shared admin passwords and "the office login"

Forms ask who has admin rights, whether those accounts are personal or shared, and whether passwords are unique.

A shared Gmail, the accounts password on a whiteboard, or one admin login used by three people is a red flag. Insurers care because shared logins make it hard to cut off access after a phishing click or when someone leaves.

Fix it: one person, one login. Keep shared items in a company password manager with named access, not a group WhatsApp. See why shared logins are a liability and our best password manager for UK small businesses guide.

Backups you have never restored

"Do you take regular backups?" is easy. "Have you restored from backup in the last 12 months?" is where firms freeze.

A backup you have never tested is a hope, not a control. Ransomware and accidental deletes both test it for you, at the worst moment.

Fix it: pick one important system, such as your shared files or one mailbox. Restore it to a test location. Write down the date and who did it, and keep that note with your insurance pack. Our backup and ransomware restore test guide shows how. And remember that OneDrive is not a backup on its own.

Security software and updates

Expect questions on whether laptops have security software, and whether updates go on within a set time.

"We use Microsoft Defender and keep things updated" can be fine for many small firms, as long as it is true and someone can check it. "Everyone does their own thing" is weaker. See cheap endpoint protection for under 50 staff.

Cyber Essentials

Many UK forms ask whether you hold Cyber Essentials or Cyber Essentials Plus. You do not always need it to get a quote. Having it, or a clear plan to get it, helps with insurers and customers alike.

It is a baseline scheme, not a magic shield. If you mention it on a form, keep the certificate current and true to what you actually run. Start with Cyber Essentials for beginners.

Past incidents and claims

Expect a direct question on ransomware, fake invoice fraud, or previous claims. If you had a near miss you dealt with in-house, tell your broker the facts before you tick boxes. Surprises at claim time are expensive.

What good enough looks like for a 10 to 30 person firm

You do not need a security operations centre. For most owner-managed UK firms, insurers are looking for something close to this:

1. MFA on Microsoft 365 or Google Workspace for every user, especially admins.
2. Unique passwords kept in a business password manager. No shared master logins.
3. Backups with at least one copy offline or locked from changes, plus a dated restore test.
4. Security software on laptops and an update habit you can describe in one paragraph.
5. A one-page incident sheet: who locks accounts, who calls the bank, who speaks to customers.
6. Optional but useful: Cyber Essentials that matches your real setup.

If you can show those six, the form stops feeling hostile.

Prepare your pack before the broker chases

Spend half a day, not a month:

• Export a user list from Microsoft 365 or Google Workspace and mark who has admin rights.
• Take a screenshot or note of MFA status, or the admin report that shows it.
• Write three sentences on backup frequency, where the copies live, and your last restore test date.
• Note your security software and how updates happen, even if it is "built-in Defender and a monthly check".
• Keep certificates, such as Cyber Essentials, in one folder with expiry dates.
• Decide who is allowed to tell the insurer if something happens. Put that name on the sheet.

Then answer the form from that pack. Do not claim controls you only plan to buy later.

Buying cover: practical cautions

Cyber policies differ a lot on ransomware, fake invoice fraud and system outages. Read the exclusions. Ask what happens if a member of staff pays a fake invoice. That loss is often treated differently from a hack. Our invoice fraud checklist helps cut that risk either way.

Also check your existing office, professional indemnity or crime policies. Some already touch cyber losses. Some exclude them outright. A broker who sees all your cover is more useful than another policy PDF you never open.

Premiums and excesses change with your sector, turnover and controls. Treat any price you see online as marketing, not a quote.

Short checklist you can print

• MFA on every mailbox and admin account
• No shared admin passwords, and a password manager in use
• A backup and a dated restore test in the last 12 months
• Security software and an update routine you can explain
• Incident contact names written down
• Honest answers on past incidents
• Cyber Essentials status known: held, in progress, or not yet
• A broker summary of cover, exclusions, excess and notice duties before you buy

FAQ

Do UK small businesses legally need cyber insurance?

No. There is no general legal requirement. It usually comes up because a customer contract, tender, landlord or lender asks for it, or because you decide the risk is worth covering.

Do I need Cyber Essentials to get cyber insurance?

Not always. Many insurers will quote without it. Holding Cyber Essentials, or having a clear plan to get it, often makes the form easier and can help with customer due diligence too.

What happens if I answer the questionnaire wrongly?

If an answer turns out to be untrue, the insurer may reduce or refuse a claim. Answer from what you actually run today, not what you plan to buy next quarter. If unsure, tell your broker the facts.

Does cyber insurance cover invoice fraud?

Sometimes, but not always. Losses where a member of staff pays a fake invoice are often treated differently from a technical breach. Ask your broker directly and read the social engineering section of the wording.

Official guidance

• NCSC: Cyber insurance guidance
• NCSC: Cyber Essentials overview

Bottom line

Cyber insurance forms are less about clever jargon and more about whether you can show MFA, backups, tidy logins and a basic response plan. Fix those first. Then buy cover if a customer, contract or your own appetite for risk needs it, with wording you have actually read.