Cyber cover and the boring things it assumes

Cyber insurance does two jobs at once. It pays for certain losses. And it records what you told the insurer about how your firm runs its systems, so the same set of answers gets looked at again when the policy renews.

That second job is the one that catches small firms out. The policy is only as good as the answers in it, and you are the one who has to keep those answers true.

What the policy actually is

When you take out cyber cover, the application asks how you protect email, where you keep your data, whether you use two-factor authentication, how you back up. Those answers do not sit in a drawer once the policy starts. They become part of the record, and they are looked at again each year.

The National Cyber Security Centre says this plainly in its cyber insurance guidance. If you are claiming that security measures are in place when they are not, the insurer may not be obliged to pay any claims.

Read that line carefully. It does not say the missing control would have stopped the attack. It says the answer was wrong. The claim can fail on the paperwork rather than on the damage.

That is why the gap matters more than the absence of a control. A firm with no two-factor authentication and an honest application is in a different position from a firm that told the insurer it had two-factor everywhere.

What insurers are weighing

The Association of British Insurers published good practice guidance on cyber resilience in August 2026, developed with insurers and government. It names two things repeatedly: multi-factor authentication, and backups that are tested, immutable or offline, and out of reach of anyone who has compromised your credentials.

Here is the bit worth reading twice. The guidance says these are not a mandatory baseline. They are not a checklist where tick every box and you have cover. Each insurer weighs them in its own underwriting, and each insurer decides what it wants to see and how deeply it will look.

For an owner-run firm with 20 people and an IT provider rather than a security team, that cuts both ways. There is no rule saying you must have all of it. There is also no guarantee that a policy will respond if the answer you gave turns out to be wrong on the day.

The two gaps that catch small firms

Partial two-factor is the first. The business turns it on for email, for the bank, for the staff accounts, and leaves it off for the administrator account because the setup was fiddly and the account gets used less. The person who can reset everyone else's password and add their own access is the one account an attacker wants. If your application says authentication protects your systems, an unprotected administrator account is a gap between the answer and the enforcement.

The second is calling cloud sync a backup. A sync service keeps copies of files somewhere else, and that is genuinely better than nothing. It is also still live replication. Delete a file and the deletion goes everywhere. The same goes for corruption. It is not immutable and it is not offline, which means an attacker who gets into your account can delete the copies as well.

A firm can hold a current Cyber Essentials certificate and still have no tested backup regime. The scheme recommends backups and does not mandate them. So the badge on the website, which is often the thing the insurer and the customer both feel reassured by, tells you very little about whether anyone has ever restored a file from last March.

The trap sitting next to it

Some losses are excluded from cover in the first place. Business email compromise fraud is the common one. It often is not covered, whatever controls you have in place. That is not a technical failure and it is not a trick. It is just how many policies are written.

This matters because it changes where the money is. If a claim is going to be paid at all, the state of your controls and the truth of your application decide it. If the loss is excluded, they do not.

So the sensible order is: check the exclusions first, because they cost nothing to read. Then check the answers.

What to check in an afternoon

Before your renewal, two things are worth doing. Both can be done in an afternoon, and neither requires buying anything.

First, check the administrator account. Open your email, cloud admin console and domain registrar. For each one, confirm that two-factor is switched on, enforced rather than optional, and that no recovery codes are sitting in a shared inbox. Write down what you find. Compare it with what your insurance application says. If those two answers differ, you have found your gap, and you can fix the gap or correct the answer before renewal rather than after a claim.

Second, prove you can restore. Do not run a backup. Run a restore. Pick a folder that matters, restore it to somewhere clean, and check the files are actually there and open properly. Write down the date you did it and who did it. That note is worth more than a screenshot of a backup schedule, because it is evidence that a restore works rather than evidence that a job ran.

Two-factor on the accounts that can do damage. A restore you have actually run. Everything else can wait for another afternoon.

Need a starting point? The Be Ready guide has ten checks your firm can run in an afternoon, costing nothing. If you want the checks done with you, book a resilience session.

Sources

Tier A, UK government. National Cyber Security Centre, Cyber insurance guidance, sections 6 and 9.

Tier A organisation, Tier B carrier. Association of British Insurers, Good practice guidance on cyber resilience, August 2026. Reported by Beinsure (10 September 2026), Cyber Insurance News (19 August 2026), Insurance Post (19 August 2026) and The Insurer (21 August 2026).