A customer calls you after a difficult renewal. They've answered the proposal form, paid the premium and assumed they're covered, then discovered the policy depends on controls they can't prove. That's the gap this guide closes. You'll see what cyber insurance requirements look like in practice, what evidence insurers ask for, and how to build a simple record your customers can maintain month after month.

What Insurers Expect Before They Quote Cover

Say a bakery chain with three sites suffers ransomware on a Friday night. The owner calls the insurer on Monday expecting help, and the first questions aren't about the ransom. They're about multi-factor authentication, when backups were last tested, and whether anyone can show those controls were working before the attack.

Cyber insurance isn't legally mandatory for UK businesses, but insurers commonly require evidence of effective cyber-risk controls before providing cover. According to the UK Government's 2025 "Insuring Resilience" report, summarised by Cyphere, 65% of surveyed SMEs had cyber insurance while 35% remained uninsured, and 59% of insured SMEs reported policy limits of up to £1 million.

The same study, covering 104 SMEs in February and March 2025, found 65% of insured businesses had to satisfy specific cybersecurity requirements to qualify for cover. For half of those businesses, meeting the requirements cost between £5,000 and £25,000, and the median cost of cover itself was £11,500, concentrated on business interruption and crisis management.

Those figures explain the shift. Insurance now works as a risk-assessment mechanism, not a formality you complete after the actual decisions are made. The insurer is asking a simple question: can this business operate its controls every day, not just describe them once a year?

Three Layers to Prepare

• Technical controls: MFA, backups, patching, endpoint protection and access management that reduce specific losses.
• Written policies and response plans: Named owners, escalation routes and evidence retention when something goes wrong.
• The cover route: Standalone, embedded or certification-linked cover, each with different limits and conditions.

Prepare all three before the next proposal or renewal and you'll answer underwriting questions with records, not recollections.

Technical Controls Insurers Verify First

Underwriters start with controls that change the size or likelihood of a claim. As Aon's UK analysis of cyber claims trends describes, carriers commonly require evidence of multifactor authentication, firewalls, endpoint protection, regular backups and supplier-risk management before confirming coverage.

Why Each Row Matters

MFA reduces account takeover because a stolen password alone shouldn't open email or remote access. Endpoint protection limits malware execution on laptops and servers, while firewalls restrict who can reach your network in the first place. Patching closes known holes that attackers scan for automatically, and privileged access management ensures only a small, reviewed group holds admin rights.

Supplier-risk management covers compromise through third parties, a route many SMEs overlook. Staff awareness training addresses phishing, still the most common way credentials get stolen. None of these controls needs to be perfect, but each one needs a named owner and a recent record.

Practical rule: If you can't produce a dated report for a control within one working day, treat that control as unproven, however confident the team feels about it.

The Backup Gap and the Supplier Question

The National Cyber Security Centre recommends Cyber Essentials or Cyber Essentials Plus as a baseline. Our Cyber Essentials controls explained guide walks through that baseline, but note the catch: Cyber Essentials alone does not assess backups. Document backup frequency, offline or logically isolated copies, restoration testing and privileged-access protection separately, with dates.

Suppliers need the same treatment. Monitoring services, including ours, rely on third-party breach intelligence providers and infrastructure services, so an insurer may reasonably ask who sits inside your supply chain and what data they handle. Keep that list current. The NCSC also warns that the policyholder is responsible for ensuring submitted cybersecurity details are correct, so overstating a control can create a claims dispute later.

For identity risk specifically, credential alerts only help when they feed a documented process. Force password resets, revoke tokens, investigate affected accounts, record timestamps and retain the remediation evidence. That chain, from exposure to containment, is what an underwriter can verify.

Policies and Incident Response Plans Insurers Expect

An incident response plan works like a fire drill. Everyone knows the exit, where the extinguisher is and who calls the fire service, and they know it before there is any smoke. A cyber plan does the same job for a breach, when nobody has time to invent a process.

Insurers commonly ask to see written policies covering areas such as acceptable use, access control and backup, alongside an incident response plan. Short and accurate beats long and copied. A two-page access control policy that matches how your Microsoft 365 tenant is configured in practice is worth more than a borrowed template nobody follows, because an underwriter reads each document as a claim about how the business really runs day to day.

What the Response Plan Must Contain

• Named roles with deputies: One person leads containment, one handles communications, and each has a backup for holidays and sickness.
• Severity thresholds: Clear triggers for escalation, so a single compromised mailbox and a full ransomware event take different paths.
• Authorisation for external help: Who can approve forensic, legal and public-relations support, and at what spend level.
• Pre-agreed contacts: Your IT provider, your insurer's breach notification route and your legal adviser, printed and stored offline.
• The reporting clock: Where personal data is involved, UK GDPR requires notification to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying personal data breach, so the plan should name who drafts that notification.

Ransomware shows why this detail matters. Gallagher's 2026 UK Cyber Market Report states ransomware represented 52% of reported UK cases in 2025, up from 48% in 2024, and 59% of those cases involved data exfiltration. Stolen data shifts the work from restoring systems to notifying customers and regulators, and the records your plan produces are what the claims team will ask for first.

Preserve logs, breach timelines and the decisions you made during the response. Insurers and forensic teams work from that material, and gaps slow everything down. Guidance from Nutmeg Technologies on detecting and containing cyber incidents is a useful companion here, particularly on isolating affected systems before wiping evidence.

Map every alert type to an owner, a required action and an evidence-retention rule. Our notes on handling suspicious logins across client accounts show one way to structure that mapping, and our own platform security follows the same discipline, with one-way hashing of search identifiers, mandatory multi-factor authentication and continuous monitoring with audit logging.

A plan is only provable if it has been used. Test it once a year with a phishing or credential-compromise tabletop exercise, and record who attended, which decisions were taken and what changed afterwards. An insurer reads that follow-up note as proof the plan is alive, not laminated.

Standalone, Embedded and Certified Cover Compared

Two businesses can both say "we have cyber insurance" and mean entirely different things. One holds a standalone policy with a dedicated incident response team behind it. The other has a clause inside a general business policy that may name none of the losses it will face. The route you buy through decides what you can claim and what you must prove when you claim it.

Certification-linked cover is conditional. As the GOV.UK Cyber Essentials scheme overview sets out, UK organisations with turnover below £20 million that certify their entire organisation are entitled to Cyber Liability Insurance arranged through IASME, including a 24-hour helpline and support up to a total liability limit of £25,000. Certify only part of the business and that entitlement falls away.

Cover is spreading, and that spread creates a specific problem. Government research such as the Cyber Security Longitudinal Survey shows adoption of cyber cover growing among UK businesses, with cost a recurring reason others give for going without. Much of that cover arrives embedded inside general policies, where the holder has often never checked whether social engineering, supplier compromise or regulatory costs are named.

Check the wording, not the schedule summary. If cyber isn't named, assume it isn't covered until a broker confirms otherwise in writing.

Read warranties and conditions with the same care. A warranty is a promise the policy makes you keep: if the wording states MFA must be in place and it was not operating on the compromised account, the insurer can refuse or reduce the claim. Work through each condition and pair it with evidence you can produce today, such as a certificate with its issue date or an access policy showing MFA enforced. Evidence you plan to create later counts for nothing at claim time.

How Underwriters Judge Your Risk Profile

Underwriting is a judgement about two things: how likely a claim is, and how large it could be. Recent claims data explains why that judgement has hardened. Association of British Insurers data reported by Insurance Journal showed insurers paid £197 million in cyber claims to UK businesses during 2024, compared with £59 million in 2023, and malware and ransomware accounted for 51% of successful claims in 2024, up from 32% in 2023.

Those ABI figures come from participating member firms rather than the whole market, so read them as direction rather than exact size. The direction is clear enough. Losses grew sharply, and underwriters now examine each applicant more closely, with follow-up questions wherever an answer affects the size of a potential payout.

A proposal form works like a witness statement: everything written on it can be re-read after an incident, and anything that cannot be supported becomes a problem at the worst possible moment.

Factors That Shape the Quote

• Sector and turnover: Revenue sets the scale of a business interruption claim, and some sectors attract more attacks.
• Data held: The volume and type of personal or payment data drives notification and regulatory cost.
• Remote access: How staff and suppliers connect, and whether MFA protects every route in.
• Cloud administration: Who holds Microsoft 365 or Google Workspace admin rights and how those accounts are reviewed.
• Supplier dependencies: A single critical supplier can turn their incident into your outage.
• Past incidents and claims: Previous events raise questions about what changed afterwards.
• Proposal answers: Inconsistent or vague answers invite follow-up questions and higher premiums.

Our guide to assessing UK clients' cyber risks helps you score these factors before an underwriter does. The same discipline applies inside each answer. If the proposal says backups are tested monthly, the test log should show twelve dated tests across the year, and access reviews should leave records an outsider could check.

Underwriters price on evidence, so an inaccurate answer, even an honest guess, can become the centre of a disputed claim. Answer only what you can prove, and mark a control as partially deployed rather than rounding up to yes.

Steps to Qualify for Cover and Keep It

Meeting cyber insurance requirements comes down to one thing: proving your controls were running when it matters. The UK Government's 2025 Cyber Security Breaches Survey found 45% of businesses had some cyber cover, yet only a minority held a dedicated policy, so many firms believe they're insured without knowing whether credential theft or supplier compromise is covered.

Every insurer question has two halves: the control you operate and the proof you can hand over. The control gets you the policy. The proof gets you the payout. Work through these steps with that split in mind.

1. Inventory your estate. List systems, data types, cloud services and suppliers, since insurers ask about each. The common slip is forgetting the marketing platform or the finance SaaS tool nobody in IT approved.
2. Map each requirement to a control and an owner. One row per insurer question, one named person per row. Shared ownership usually means no ownership when renewal arrives.
3. Compare against the Cyber Essentials baseline. Note where you meet it and where you don't, remembering the baseline doesn't assess backups. Certification is a starting point, not the finish line.
4. Close the highest-risk gaps first. Start with MFA on email and admin accounts, then tested backups with an offline copy. These two controls answer the questions underwriters ask earliest.
5. Record dated evidence as you go. Save enforcement reports, configuration records and restoration test logs in one folder. Answering a questionnaire from memory is how honest businesses end up with inaccurate proposals.
6. Run credential monitoring as an alert-to-action process. When an exposed password or breached domain appears, reset credentials, revoke sessions, investigate the account and record timestamps. No monitoring service can guarantee absolute security, so the evidence that counts is a dated response trail alongside reasonable protective measures, showing you acted on what the alert found.
7. Complete the proposal using only answers you can evidence. If a control covers most accounts but not all, say so and give the completion date. Treating the policy itself as a control is the most expensive misunderstanding in this market.
8. Review at renewal and after major change. New premises, a new cloud platform or an acquisition all change the risk profile. Update the inventory and evidence pack at the same time.

Your Requirements-to-Evidence Checklist

Keep one living document with four columns: requirement, control, owner, evidence date. A single row might read: MFA on all admin accounts, enforced through your identity provider, owned by the IT lead, with the enforcement report exported and dated. Review the document quarterly and you'll never rebuild it in a panic before renewal.

Many businesses already have compromised credentials on the dark web without knowing it, so the monitoring row in that checklist often produces the first real conversation about identity risk.

For resellers: Customers don't want another complex dashboard. They want a clear alert, in plain language, that tells them which account to fix today.

That's the commercial opening for MSPs, IT support companies, telecom and VoIP providers, hosting firms and technology resellers. GoSafe is a white label dark web monitoring tool, Cyber Essentials accredited under a government-backed certification, and it helps MSPs protect over 15,000 businesses worldwide, having issued 1,291,455 threat alerts to businesses using the platform. You can sell dark web monitoring under your own brand alongside IT support, cloud, hosting or connectivity, with no complex setup, no security team and no specialist knowledge required.

As a dark web monitoring service for businesses, it gives your customers continuous scanning for compromised email addresses, exposed passwords and breached domains, with simple alerts they can act on. For you, it means low operational overhead, stronger customer relationships and a practical evidence trail your customers can show their insurer. Whether you position it as dark web monitoring for MSPs, reseller dark web monitoring or part of broader white label security services, you keep the customer relationship and your own branding throughout.

Ready to add it to your portfolio? View the GoSafe reseller programme to see how partners deliver monitoring under their own brand.

When your customers next face an underwriter's questions, the partners who win will be the ones who can hand over dated evidence, not reassurance. GoSafe Dark Web monitoring gives you a fully white-label way to supply part of that evidence, with continuous credential and domain monitoring your customers understand and clear alerts you can act on together. Brand it as your own and start offering a service your customers genuinely need.