Cyber insurance for businesses: what insurers require and how to arrive prepared

Cyber insurance (or cyber risk insurance) is a policy that transfers to the insurer part of the financial impact of a security incident: ransomware that halts operations, a breach of client data, fraud through email impersonation. It does not prevent the incident; it spreads its cost.

The exact cover varies between policies — the wording always governs — but the usual families are these:

• First-party losses: incident response costs, forensic analysis, restoration of systems and data, and loss of profit through business interruption.
• Third-party liability: claims from clients or partners affected by the breach of their data or by the unavailability of your service.
• Crisis management: legal advice, communications, notification of affected individuals and of the data protection authority where required.
• Cyber extortion: handling and negotiation in ransomware incidents, within legal limits and the policy's own terms.
• Response services: many policies include access to a panel of incident response providers appointed by the insurer.

One important nuance: insurance arrives after the incident. Everything that happens before — detecting, resisting, containing — still depends on your controls. That is exactly why insurers require them to exist.

Exclusions are the part of the policy people read least and the part that produces the most surprises. Without replacing a careful read of the wording — every policy differs — these are the exclusions and limits worth looking for explicitly:

• Breach of the conditions you declared: if you declared controls that did not exist or stopped existing, your cover is at risk. It is the most important exclusion of all, and section 05 is devoted to it.
• Incidents predating the policy: breaches already present or known before inception are normally excluded.
• Infrastructure betterment: the policy restores what you had; it does not pay for modernising the systems the incident exposed as inadequate.
• Long-term reputational damage: the loss of clients and trust after an incident is rarely fully indemnifiable.
• War and hostile acts: many policies exclude cyberattacks attributed to state actors or treated as acts of war — an area under active debate in the market.
• Administrative fines: the insurability of fines (for instance, under the GDPR) is legally debated in Spain; what tends to be covered are defence costs. Get it confirmed in writing.

The real risk. The scenario that repeats most often is not "the policy was bad", but "the policy was reasonable and the claim went wrong because what the questionnaire declared did not match the company's technical reality".

There is no general legal obligation to buy it, but there are three profiles where the decision is almost always sensible:

And who can still consider not buying it? Businesses with very low digital dependence and no relevant third-party data. They are fewer every year, and even then the right conclusion is not "do nothing", but "prioritise the controls before the policy".

After years of rising ransomware losses, insurers have tightened underwriting: today it is common for a policy not to be issued — or to be issued with loadings and exclusions — unless you can evidence a set of baseline controls. The ones that appear again and again in questionnaires are these six:

1. Multi-factor authentication (MFA)

On remote access (VPN, remote desktop), corporate email and administrator accounts. It is the most universal requirement: many insurers treat it as a condition of entry, not a scoring extra.

2. EDR or managed antivirus

Endpoint protection with detection and response capability — unattended traditional antivirus is not enough. The questionnaire usually asks which product, on what percentage of the estate and who reviews the alerts.

3. Disconnected or immutable backups

Backups that an attacker with control of the domain cannot encrypt or delete: offline, immutable, or with real credential separation. And tested: the typical question is not "do you back up?", but "when was your last restore test?".

4. Patch and vulnerability management

A defined process for applying security updates within maximum timeframes, especially on internet-facing systems. A continuous vulnerability management programme is exactly what this part of the questionnaire wants to see.

5. Incident response plan

A document defining who decides, who contains, who gets called and how you communicate when something happens. Insurers ask for it because it directly reduces the cost of a claim: a business that responds in an orderly way costs them less money. A professional incident response service gives that plan real substance.

6. Staff training and awareness

A periodic awareness programme, ideally with phishing simulations. Email remains the most common entry point, and the questionnaire asks how often staff are trained. Role-based cybersecurity training covers this point and, along the way, genuinely reduces the risk.

The underwriting questionnaire is the document the insurer uses to assess your risk before issuing the policy. It usually combines closed questions ("Is MFA enforced on all remote access? Yes/No") with requests for detail (products, scope, frequency, owners). For larger risks it may be complemented with technical interviews or an external scan of your public attack surface.

The essential thing is to understand its legal nature: it is not a sales form, it is a declaration of the risk. Insurance contract law imposes on the policyholder a duty to declare accurately the circumstances they know that bear on the risk. The policy is issued, priced and — come a claim — interpreted on that declaration.

The real risk: a denied claim. If you declared MFA "everywhere" and the forensics show the compromised account did not have it, or you declared immutable backups that turned out to be encryptable, the insurer may reject or reduce the payout for misrepresentation. The worst possible outcome: years of premiums for cover that fails exactly when you need it.

Three practical consequences:

• Answer with reality, not intent. "We are rolling out MFA" is not "we have MFA". If a control is half-implemented, declare it half-implemented — or close it before signing.
• Keep evidence of what you declare. Configuration screenshots, policies, restore test reports. If there is a claim tomorrow, that evidence is your defence.
• Maintain what you declared for the life of the policy. The questionnaire is not a snapshot that expires at signature: switching off a declared control can compromise cover at renewals and in later claims.

We will not quote discount percentages, because none exist in general terms: each insurer prices with its own models. What is consistent across the market is the direction of the effect — security maturity influences three things:

The operational conclusion is uncomfortable but useful: the best money you can spend before buying cyber insurance is the money that closes your control gaps. It improves the premium, improves the cover and — unlike the policy — also reduces the likelihood of suffering the incident.

The same patterns repeat in businesses of every size:

• Lying or exaggerating on the questionnaire. The most expensive mistake. Often it is not even bad faith: the person signing does not know that MFA only covers half the workforce. The result is the same — the risk of a denied claim for misrepresentation.
• Buying without an inventory. Without knowing which systems and data you have, you can neither declare the risk rigorously nor size the limits. The resulting policy is a bet, not cover.
• Assuming insurance replaces security. "We're covered now" is the sentence that precedes cutting controls. Besides raising the likelihood of the incident, it degrades the declared conditions — and with them, the cover itself.
• Not reading the exclusions. Discovering mid-claim that ransomware carried a reduced sub-limit, or that the fine was not insurable, is as common as it is avoidable.
• Letting declared controls lapse. The EDR that was uninstalled "temporarily", the restore test that was never repeated. What you declared must be maintained for as long as the policy lives.
• Confusing the roles. The broker advises on the policy; your team or technical provider answers for whether what you declared is true. When nobody takes the second role, the questionnaire gets filled in by hearsay.

First, the declaration of interests: Hard2bit is not a broker, does not sell insurance and receives no commission from any insurer. We technically prepare your business for the process. Choosing the policy is up to you and your broker; our job is making sure you reach that conversation with a security posture that is real, demonstrable and truthfully declared.

In practice, that means four things:

• A security audit focused on the control gap. We assess your real position against what underwriting questionnaires typically require (MFA, EDR, backups, patching, response plan, training) and prioritise closing the gaps by risk and by impact on insurability.
• Evidence for the questionnaire. We document what is in place — configurations, policies, restore tests — so that every answer you sign is backed up. If there is a claim tomorrow, that documentation is your defence against an allegation of misrepresentation.
• Remediation of what is missing. From deploying specific controls to a continuous vulnerability management programme and staff training with phishing simulations.
• Incident response as the policy's complement. A 24/7 incident response retainer turns the questionnaire's "response plan" into an actual capability: activation in minutes, containment, forensics and coordination — including the notification deadlines the policy itself sets.