In short
- ✓Cyber insurance helps pay for responding to an attack: experts, data recovery, lost income and claims from others.
- ✓Most UK small business policies cost roughly £100–£1,000 a year, depending on turnover, sector, data held and security.
- ✓Insurers increasingly ask about multi-factor authentication, backups, updates and staff training before quoting.
- ✓Cyber Essentials through IASME includes optional £25,000 cover for eligible UK businesses with turnover under £20m.
What cyber insurance usually covers
- Incident response: specialists to contain the attack and investigate what happened.
- Data and system restoration after ransomware or a hack.
- Business interruption: lost income while systems are down.
- Notifying customers and handling regulator enquiries after a data breach.
- Legal costs and claims from customers or suppliers affected by the breach.
- Cyber extortion such as ransomware demands, within legal limits and policy terms.
What's often limited or excluded
- Invoice and payment diversion fraud, which is often excluded or covered only with a small sub-limit. Check this carefully.
- Attacks that happen because a control you declared, such as multi-factor authentication, wasn't actually in place.
- Old, unsupported systems and known unpatched vulnerabilities.
- Regulatory fines, which may not be insurable.
- Losses from war or state-backed attacks, depending on wording.
What insurers ask before they'll quote
Proposal forms have become much more detailed. Expect questions like these, and make sure your answers are true, because a wrong answer can invalidate a claim:
| Insurer question | What good looks like |
|---|---|
| Is multi-factor authentication on for email and remote access? | Yes, for every user, including admins and directors |
| Do you keep backups, and are they protected? | Daily backups with a copy ransomware can't reach, tested regularly |
| How quickly are security updates applied? | Critical updates within 14 days; no unsupported software |
| Do you have anti-malware or endpoint protection? | On every laptop, desktop and server |
| Do staff get security training? | At least yearly, ideally with phishing examples |
| Do you verify payment and bank detail changes? | Always by phone, using a known number |
| Do you have an incident response plan? | A short written plan saying who to call and what to do |
How Cyber Essentials helps
Cyber Essentials covers most of the controls insurers ask about, so it makes proposal forms easier and can help with terms. UK organisations with turnover under £20m that certify their whole organisation through IASME can also opt in to £25,000 of cyber liability insurance at no extra cost, with higher limits available to buy.
£25,000 may be enough for a small incident but not a serious one, so many businesses use it as a starting point and buy a fuller policy through a broker.
Questions
How much does cyber insurance cost for a small business?
Most UK small business policies cost roughly £100–£1,000 a year. Price depends on turnover, sector, the data you hold, the cover limit and your security controls.
Does cyber insurance cover invoice fraud?
Not always. Payment diversion and social engineering fraud are often excluded or limited to a small sub-limit, so check the wording or ask your broker.
Do I need Cyber Essentials to get cyber insurance?
Not usually, but it covers most of the controls insurers ask about and eligible UK businesses can opt in to £25,000 of included cover.