Your Insurer Isn't Asking If You're Secure — It's Asking You to Prove It

There is a moment every small organisation dreads. The incident is contained, the dust is settling, and someone from the insurer asks for evidence that multi-factor authentication was enforced across remote access at the time of the loss.

If the honest answer is "we think so, but Dave set it up and Dave left", you have a problem that has nothing to do with criminals and everything to do with documentation.

This is not a story about insurers being villains. It is a story about a market that has spent several years learning that questionnaires get optimistic answers, and has responded the only way markets do: by demanding receipts.

What actually changed

For a while, cyber cover was cheap and the applications were short. Then ransomware losses piled up, and underwriters noticed that a lot of small firms were answering "yes" to controls they had never deployed, or had deployed once and quietly abandoned.

The correction has been steady rather than dramatic. Applications are longer. Attestation requirements are stricter. Warranties and conditions precedent — the clauses that make cover depend on you doing a specific thing — appear more often in SME wordings. And the person reviewing your form increasingly wants artefacts rather than assurances.

Meanwhile the Insurance Act 2015 changed how misrepresentation is handled. Insurers can no longer automatically void a policy for an innocent or careless mistake in the presentation of risk. Remedies are meant to be proportionate to what the insurer would have done had it known the truth. That is genuinely good news for small buyers — but it is not a licence to be vague. Deliberate or reckless misstatements still leave you badly exposed, and arguing about proportionality is expensive even when you win.

The questionnaire is a to-do list in disguise

Here is the reframe that makes this manageable. Every question on a cyber application is a control you should probably have anyway. MFA on email and remote access. Backups that are offline or immutable, and that have been restored successfully at least once. A patching routine with evidence it runs. An incident response plan that names people and phone numbers.

None of that is exotic. All of it is the same list the NCSC has been handing out for years.

So treat the application as a free audit. Fill it in honestly, mark every "no" and "partially", and you have a prioritised roadmap written by the people who will eventually assess your claim.

Four controls that get tested when it matters

Multi-factor authentication. Not "we have it available". Enforced, on remote access and email and your admin accounts, with a date. Screenshot the policy in your identity provider showing coverage and enforcement status.

Backups. Insurers increasingly ask whether backups are isolated from the main network and whether a restore has been tested. Keep the restore test log — date, what was restored, how long it took, who signed it off. A backup nobody has restored is a rumour.

Patching. Nobody expects a ten-person charity to hit a 24-hour critical patch window. They do expect a defined cadence and evidence it happens. A monthly report exported from your patch tool and filed is enough for most SME wordings.

Incident response. A one-page plan with roles, an out-of-hours contact route, your insurer's notification line and your legal and forensics contacts. Date it, review it annually, and note the review.

Building the evidence pack

Think of it as a folder that a stranger could read and understand in ten minutes. Nothing fancy — a shared drive with a sensible structure beats an expensive GRC platform nobody opens.

What to keep, roughly: an asset and supplier list; an MFA enrolment report; patch reports; backup configuration screenshots plus restore test records; the incident response plan and its review dates; security awareness and phishing simulation results; joiners and leavers checklists; and the signed application you sent to the insurer.

Two habits make the difference. First, timestamp everything and record who produced it. Second, retain it for the policy period plus a margin — evidence you cannot produce is evidence that does not exist.

The exclusions that catch small firms out

Read the exclusions page before you read the cover page. The usual suspects:

• War and nation-state exclusions. Broadly worded, increasingly common, and a genuine grey area when an attack is attributed to a state-linked group.
• Ransomware payment exclusions or sub-limits, plus conditions requiring you to use approved responders before paying anything.
• Unapproved vendor conditions. Use your own IT provider for incident response when the policy says use a panel firm, and you may fund the difference yourself.
• Failure to maintain. A warranty that you kept a control, breached, is often more damaging than the loss itself.
• Silent cyber carve-backs. Since the Lloyd's market mandated explicit cyber cover, many general liability and property policies say far less about cyber than buyers assume. Check where the cyber risk actually sits.

If they say no

Get the declinature in writing with the specific clause cited. Then go back to your broker — a good one will push the insurer for the reasoning and, in many cases, the decision shifts.

If it does not, you have escalation routes that do not involve a solicitor. Insurers have internal complaints procedures with defined timescales. After that, micro-enterprises can generally take the matter to the Financial Ombudsman Service at no cost, and larger SMEs may be covered depending on the insurer's arrangements. It is a slow route, but it is free, and insurers know it exists.

Keep your own contemporaneous notes throughout: what you submitted, when, what was asked, what you answered. A timeline is the single most persuasive document in any dispute.

Insurance is a forcing function, not a firewall

A policy does not stop a ransomware crew. It does not restore your reputation with the clients whose data sat on the server. What it does — at best — is buy you a competent incident responder and a financial buffer at the worst possible moment.

The useful side effect is that the application form nudges you into doing the boring things you kept postponing. MFA gets switched on. The backup finally gets tested. Somebody writes down who calls the bank.

So build the folder now, while nothing is on fire. It is dull, it takes a couple of afternoons, and it is the difference between arguing about a claim and simply making one.