Cyber liability insurance pays some of the costs when a UK business suffers a cyber attack or data breach. It doesn't stop attacks, and insurers increasingly expect basic security to be in place before they will cover you, so the policy and the controls are best bought together.
What a policy typically covers
- First-party cover for your own costs: incident response such as forensics, legal advice and a PR helpline, data restoration, business interruption while your systems are down, and the response to a cyber extortion demand
- Third-party cover for claims made against you by customers or others affected by an incident, and sometimes the cost of defending a regulatory investigation
Fines and ransom payments are covered only where the policy wording and the law allow it.
The free cover many UK firms miss
If your organisation is based in the UK, has a turnover under £20 million and certifies its whole organisation to Cyber Essentials, the certification includes £25,000 of cyber insurance cover through the IASME scheme. IASME itself estimates that a small breach can cost between £10,000 and £30,000 and larger ones considerably more, so the included cover is a good starting point for a small business, but you may need a higher limit as your data and turnover grow.
Ransomware and the law
The UK government does not condone paying ransoms, and paying a sanctioned person is a criminal offence. Many policies pay for specialist negotiators and incident response, and cover a ransom payment only where the law allows and the insurer approves it. Read what your wording says before you need it.
What to check before you buy
| Check | Why it matters |
|---|---|
| Limit of cover | Whether it is enough for the amount of data you hold and your turnover |
| Business interruption | The waiting period before cover starts, and the maximum period it pays for |
| Incident response | Whether a 24-hour helpline and specialists are included |
| Exclusions | Ransom payments, war, and losses caused by unpatched systems |
| Security conditions | Requirements such as multi-factor authentication and tested backups. Failing them can mean a refused claim |
| Excess | The amount you pay before the insurer does |
| Overlap with other cover | How the policy fits with professional indemnity insurance |
Cover and controls go together
Questions to ask a broker
A specialist broker can compare policies, but go in prepared. Ask what the limit and excess would be at your size, whether the policy pays for restoring data and rebuilding systems, how quickly the incident response line answers, and which security conditions could void a claim. Check whether social engineering and invoice redirection fraud are covered, because these are common ways small firms lose money. Keep a copy of the policy and the helpline number somewhere you can reach if your systems are down.
Insurers ask about multi-factor authentication, backups, patching and endpoint protection, and Cyber Essentials certification covers most of what they look for. Insurance is a safety net, not a substitute. Our guide to business security solutions puts the controls in order, and the guides to cloud backup and endpoint protection cover two that insurers ask about most.