Cyber insurance can fund recovery costs after a ransomware attack, a data breach or a business email compromise, yet cover depends heavily on the controls a business can evidence. Insurers ask detailed questions before quoting and again at renewal, and the answers influence both the premium and the terms. For London owners and directors, the practical question is which IT controls underwriters check and how to demonstrate them. This article sets out those requirements and how a managed IT provider can support them.
Table of Contents
- Quick Takeaways
- How Underwriters Assess Your IT Controls
- Access Controls: MFA and Privileged Accounts
- Detection, Backups and Patching
- Comparing Ways to Meet the Requirements
- Keeping Evidence Current at Renewal
- Policy Terms and Exclusions to Check
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Multi-factor authentication is a baseline expectation | Insurers commonly ask whether MFA protects email, remote access and administrative accounts. Confirm that it is enforced for every user, not set as an optional policy. |
| Endpoint detection and response is assessed separately from antivirus | Questionnaires typically ask whether EDR is deployed on every device, including laptops used off-site. |
| Backups must be separated and tested | Insurers look for backups isolated from the main network and evidence of recent restore tests. An untested backup is not evidence of recovery. |
| Questionnaire answers become part of the policy record | Inaccurate answers can lead to disputes at claim stage. Answers should be checked against live configurations by the person who manages IT. |
| Renewal is a review of evidence | Expect questions about changes since the last submission, such as new staff, cloud services or suppliers. Keep an asset list and patch record current. |
| SME policies often have standardised conditions | A UK market assessment describes SME cover as often based on off-the-shelf products with lower limits and prescriptive security requirements. Read the conditions before purchase. |
How Underwriters Assess Your IT Controls
Cyber insurance underwriting is now a structured review of controls rather than a general declaration of security. Ramsac notes that cover varies considerably between policies, so two businesses of similar size can receive different terms based on their answers.
A UK cyber insurance market assessment describes SME and mid-market risks as often accessed through standardised products with lower limits and prescriptive security requirements. In practice, an SME owner may have limited room to negotiate these conditions, so the controls need to be in place before the application is submitted. CBIZ reports that insurers now expect a stronger baseline control set alongside more intensive due diligence before granting or renewing cover.
Pro tip: Complete the questionnaire with the person who manages IT, not only the finance or operations lead. Answers based on assumption rather than verified configuration create avoidable risk at claim stage.
Access Controls: MFA and Privileged Accounts
Access control is the area where insurer questions are most specific. Coalition’s guidance on essential requirements begins with strong password policies, and multi-factor authentication is the control most often built on top of them.
Email and remote access
Insurers typically ask whether MFA protects email, remote access and cloud administration. For Microsoft 365 environments, the follow-up questions usually concern whether MFA is enforced for all users. A partial rollout is one of the gaps that surfaces most often when questionnaire answers are checked against tenant settings.
Privileged accounts
Administrator accounts should be separate from day-to-day user accounts, protected by MFA, and limited to staff who need them. Shared administrator logins make it difficult to show who accessed a system, which weakens both the control and the evidence trail.
Detection, Backups and Patching
Detection and recovery controls determine how an incident is contained and how quickly operations resume. Underwriters ask about these areas because they directly affect the size of a loss.
Endpoint detection and response
Coalition’s guidance lists antivirus or endpoint detection and response (EDR) software among its essential requirements. EDR is more than signature scanning, since it records device behaviour and can isolate a compromised machine, which helps contain an incident early.
Backups that can be restored
Insurers look for backups that are separated from the primary network and tested on a schedule. Owners should request a dated restore test log from their IT provider, not only a backup schedule, because the log is the evidence an underwriter can review.
Patch cycles and monitoring
Unpatched systems are a frequent entry point for attackers, so questionnaires usually ask how critical patches are applied and within what timescale. Monitoring with out-of-hours alerting is an increasingly common question, particularly for businesses with staff who work outside London office hours.
Comparing Ways to Meet the Requirements
SMEs generally meet insurer requirements in one of three ways. Each option affects cost, evidence quality and how quickly gaps are closed, so the choice should be made deliberately rather than by default.
| Approach | Strengths | Limitations |
|---|---|---|
| Self-managed by an owner or office manager | Low direct cost and familiar to the business | Limited time for monitoring, evidence is often informal, and gaps build up between renewals |
| Ad hoc IT contractor engaged per project | Flexible for specific work such as a migration | Coverage depends on individual availability, and out-of-hours response and documentation vary |
| Outsourced managed IT department | Defined service levels, continuous monitoring and documented controls that can be shared at renewal | Requires a clearly agreed scope and reporting schedule at the outset |
For most London SMEs without an in-house IT team, the third option produces the clearest audit trail. iTO.London provides this as an outsourced IT department, with documented controls, monitored systems and quarterly technology reviews, giving owners evidence they can share with insurers and brokers. Further information is available at iTO.London.
Keeping Evidence Current at Renewal
Renewal questionnaires ask what has changed since the previous submission. A business that has added staff, moved to new cloud services or changed suppliers needs to update its answers, because an outdated answer becomes a point of dispute if a claim is made.
A practical evidence file includes an asset register, current MFA and backup configuration records, patch and monitoring reports, and the most recent restore test. An internal review against the insurer’s questions each year is a useful discipline before the formal renewal begins.
Evidence gathered during a renewal is less reliable than evidence maintained throughout the year.
Pro tip: Store control evidence in a single dated file, including MFA enforcement settings and restore logs, and review it at least one month before each renewal date.
Policy Terms and Exclusions to Check
Meeting the required controls does not replace reading the policy wording. Ramsac advises SMEs to check what cover includes, common pitfalls and why regular reviews matter.
Check whether the policy contains conditions linked to specific controls, such as MFA or patching, since a failure to maintain a condition can affect a claim. Confirm the limit of indemnity against the realistic cost of a ransomware event, including business interruption and regulatory costs, rather than relying on the headline figure.
Frequently Asked Questions
Is cyber insurance a legal requirement for UK businesses?
Cyber insurance is not a general legal requirement for most UK businesses. Contracts with clients, suppliers or lenders may, however, require it, so owners should check their agreements.
Which controls do insurers ask about first?
Questionnaires commonly begin with MFA, endpoint protection and backups. These controls are central to most underwriting decisions because they affect both the likelihood and the impact of an incident.
Can an outsourced IT provider help with a cyber insurance application?
An outsourced IT provider can verify configurations, document controls and help answer technical questions accurately. The policyholder remains responsible for the accuracy of the submission.
How often should controls be reviewed for insurance purposes?
Controls should be reviewed before each renewal and after any significant change, such as a new cloud platform or a change of staff roles. An annual internal review is a sensible minimum for most SMEs.
What should a business do if a questionnaire answer turns out to be wrong?
The business should inform its broker promptly and correct the record. Early correction is far less damaging than a discrepancy discovered during a claim.
Does having a managed IT contract satisfy insurers automatically?
A managed IT contract does not satisfy insurers automatically. Its value lies in the controls it delivers and the evidence it produces, which must match what is stated in the application.
Which IT control has caused the most difficulty in your own cyber insurance renewals, and how did you resolve it?