Cyber insurance can help a business recover after a serious incident. It may cover costs such as investigation, legal support, data recovery and business interruption.
However, insurance isn't a replacement for good security. In 2026, insurers are asking more detailed questions before providing cover or renewing a policy. They want evidence that the main risks are being managed.
For UK SMEs, this means cyber insurance is now closely linked to day-to-day IT management.
The exact questions vary between insurers and policies. Still, five areas appear regularly:
- Multi-factor authentication
- Patching and software updates
- Antivirus and endpoint protection
- Tested and protected backups
- Access control and security logging
Let's look at what insurers are checking and how we can prepare.
Why cyber insurance applications are becoming more detailed
Cyber attacks can create significant costs for a business. A ransomware incident, for example, may stop staff working, affect customer services and make important data unavailable.
Insurers need to understand how likely these events are and how severe the impact could be. They also need confidence that a business is taking reasonable steps to reduce the risk.
This is why application forms now ask about specific controls rather than general questions such as, “Do you have antivirus?”
We may be asked:
- Which systems use multi-factor authentication?
- How quickly are serious security updates installed?
- Are all laptops, desktops and servers protected?
- When was the last backup restore test?
- Who has administrator access?
- Are important security events recorded and reviewed?
The answers need to be accurate. If a policy states that a control is in place when it isn't, this may affect a future claim.
The National Cyber Security Centre’s cyber insurance guidance recommends reviewing both our security measures and the policy wording before taking out cover.
1. Multi-factor authentication everywhere
Passwords alone are no longer enough for important accounts.
Multi-factor authentication, or MFA, asks users to confirm their identity in a second way. This could be through an authenticator app, security key or another approved method.
Insurers commonly expect MFA for:
- Email accounts
- Microsoft 365, Google Workspace and other cloud services
- VPNs and remote access tools
- Administrator accounts
- Financial and business-critical applications
- Remote desktop access
The phrase “everywhere” needs careful attention. Enabling MFA for one cloud service isn't the same as enforcing it across the business.
How to prepare
Start by listing every system that staff use to access business data. Then confirm that MFA is enabled and enforced, rather than simply offered as an optional setting.
Administrator accounts deserve particular attention. They should always use MFA and shouldn't be used for ordinary email or web browsing.
We should also review old accounts, shared logins and accounts belonging to former employees. Removing unnecessary accounts reduces the number of ways an attacker could gain access.
Our cyber security services can help with MFA, conditional access, privileged access and account reviews across common cloud platforms.
2. A clear patching routine
Security updates fix weaknesses in operating systems, applications, network equipment and other technology.
Leaving systems unpatched gives attackers more time to exploit known problems. Insurers therefore want to see a repeatable patching process, not occasional updates when someone remembers.
Many application forms ask whether critical or high-risk updates are installed within a defined period. Fourteen days is a common benchmark, although internet-facing systems may need faster action.
A good patching routine should cover:
- Windows and Linux computers
- Servers and virtual machines
- Firewalls and network equipment
- Business applications
- Cloud-connected devices
- Printers, phones and other connected equipment
- Firmware where relevant
How to prepare
We need a current list of the technology we own or manage. Without an accurate list, it's difficult to know whether every system has been updated.
Next, define:
- Who checks for updates
- Which updates are urgent
- How quickly they should be installed
- How changes are tested
- What happens if an update fails
- How completion is recorded
Keep patch reports and exception records. If an update can't be installed immediately because it could interrupt a critical service, record the reason and the temporary protection in place.
Regular vulnerability assessments can also help identify devices or software that have been missed. This gives us a clearer view before an insurer asks for it.
3. Antivirus and endpoint protection
Traditional antivirus still has a role, but insurers increasingly expect business-grade endpoint protection across all supported devices.
Endpoint protection should cover laptops, desktops and servers. It should also be centrally managed, kept up to date and able to raise an alert when something unusual happens.
Insurers may want to know:
- Whether every endpoint is protected
- Whether servers are included
- Who receives security alerts
- How alerts are investigated
- Whether protection can isolate an infected device
- Whether devices outside the office are covered
A single unprotected laptop can create a serious gap, particularly when staff work remotely.
How to prepare
Use a central management console where possible. This gives us a reliable view of covered devices, outdated agents and active alerts.
We should also check for:
- Devices that haven't connected recently
- Unmanaged personal computers
- Unsupported operating systems
- Disabled security software
- Servers missing endpoint protection
- Alerts that have been ignored or closed without review
Endpoint protection works best alongside secure email, firewall rules, regular patching and staff awareness. No single product can remove every risk.
Your IT Specialist provides antivirus and EDR deployment, patch management and remote monitoring without tying recommendations to one vendor.
4. Backups that can be restored
A backup is only useful if we can restore it.
Insurers are looking closely at ransomware recovery. They may ask whether backups are separate from the main network, protected from deletion and tested regularly.
A backup stored on the same network as the live systems may be affected by the same attack. A cloud snapshot may also be insufficient if an attacker can access or delete it.
A stronger approach includes:
- Regular automated backups
- A separate offline or immutable copy
- Protection for backup administrator accounts
- Monitoring for failed backups
- A defined retention period
- Regular restore tests
The right testing interval depends on the business. Testing at least annually is useful, while critical systems may need testing every 90 days or after major changes.
How to prepare
Choose an important file, application or server and perform a controlled restore. Record:
- What was restored
- When the test happened
- How long it took
- Whether the data was complete
- Any problems found
- What was changed afterwards
We should test more than whether a job reports “successful”. A backup can complete correctly while still failing to restore a working system.
The NCSC's guidance on offline backups provides further advice for reducing the impact of ransomware.
5. Access control and useful logging
This final check combines two related questions:
- Who can access our systems?
- Can we see what happened if something goes wrong?
Most staff don't need administrator rights. Giving people more access than they need increases the possible impact of a stolen account.
Insurers may ask about:
- The number of administrator accounts
- Separate everyday and admin accounts
- User access reviews
- Leavers and joiners
- Shared accounts
- Access to financial and customer data
- MFA for privileged accounts
Logging is also important. We should be able to review events such as:
- Successful and failed sign-ins
- Changes to administrator accounts
- MFA changes
- Security alerts
- Backup failures
- Firewall activity
- Unusual access to important systems
We don't need to collect every possible log without a plan. The aim is to record the events that help us spot an attack and understand what happened.
How to prepare
Create a simple access review process. Review privileged accounts regularly and remove access that is no longer needed.
Then decide:
- Which events must be recorded
- How long logs should be kept
- Who reviews important alerts
- How suspected incidents are escalated
- Where evidence is stored
Evidence is increasingly important. Useful records may include MFA settings, patch reports, endpoint dashboards, backup test results, access reviews and incident notes.
Don't forget firewalls and Cyber Essentials
The five checks above are central to many insurance applications, but they aren't the whole security picture.
A properly configured firewall, secure settings, device encryption, malware protection and user access controls all support a stronger application.
The UK government's Cyber Essentials scheme provides a recognised baseline for protecting against common online threats. It may also support insurance discussions and demonstrate our approach to customers and suppliers.
Certification doesn't guarantee cover. We still need to read the policy carefully and answer the insurer's questions accurately.
How to keep premiums reasonable
There are no guaranteed savings, but good security can improve our position when comparing policies.
Before renewal, we can:
- Review the insurer's questions early.
- Check every answer against current systems.
- Close gaps before completing the application.
- Keep evidence in one secure location.
- Tell the broker about Cyber Essentials certification.
- Check that the policy covers our main risks.
- Confirm any required security controls after a claim.
- Review changes to systems, suppliers and remote working.
We should also check exclusions. Some policies may treat business email compromise, unsupported software or poor backup practices differently. A broker can explain the financial terms, while an IT specialist can help verify the technical answers.
A practical pre-application checklist
Before requesting a quote, let's confirm:
- MFA is enforced for email, remote access, cloud services and administrators.
- Critical security updates are installed within our defined timeframe.
- All supported endpoints and servers have active protection.
- Backups include a separate offline or immutable copy.
- Important data has been restored successfully in a recent test.
- Administrator access is limited and reviewed.
- Security events are logged and checked.
- Firewalls are configured and maintained.
- Evidence is available for each answer.
- The policy covers the incidents that matter to our business.
If any answer is unclear, it's better to investigate it before submitting the application.
How Your IT Specialist can help
Cyber insurance requirements are easier to manage when they form part of normal IT support rather than a last-minute exercise.
Your IT Specialist provides impartial, provider-agnostic advice for businesses of all sizes. We can help with:
- Firewall installation and support
- MFA and access control
- Antivirus and endpoint protection
- Patch management
- Vulnerability assessments
- Security log analysis
- Network and cloud security reviews
- Backup and recovery checks
- Practical security policies
We can also provide remote support or complete planned work outside normal hours where changes could affect staff.
Our goal is simple: build security controls that work for the business, keep clear records and improve resilience over time.
Contact Your IT Specialist to review your current position before applying for or renewing cyber insurance.
This article provides general information and isn't insurance, legal or financial advice. Policy requirements differ, so we should confirm the details with a qualified broker and the insurer.
