A Cornish construction firm suffered a ransomware attack encrypting all project files. Their £1.25m cyber insurance policy denied the claim because backups weren't stored offline as required in the policy conditions. They paid the ransom and lost two major clients during the three-week recovery.
Your cyber insurance policy isn't just paperwork you file away. It's a contract with specific technical conditions you must follow. Insurers use these requirements to assess risk and calculate premiums. More importantly, they use them as grounds to deny claims when something goes wrong.
Insurance companies got serious about IT security after paying out billions in ransomware claims. Modern policies now include detailed technical requirements that go far beyond "have antivirus installed." You're expected to demonstrate systematic security practices aligned with recognized frameworks.
If your policy renewed after October 2026, it likely includes requirements around:
These aren't suggestions. They're contractual obligations that determine whether your claim gets paid.
While every insurer writes their policy differently, certain requirements appear consistently across major UK insurers like Aviva, Hiscox, AIG, and Zurich. Here's what you're likely dealing with:
Every user needs individual credentials. Default passwords must be changed immediately.
MFA required for email, remote access, admin accounts, and cloud services.
Weekly backups stored offline or in isolated cloud. Must validate integrity regularly.
All internet-connected systems must be protected by active firewalls.
Critical and high-risk patches must be installed within 14 days of release.
Business-grade protection on all systems, updated monthly minimum.
Document employee training on phishing, social engineering, and security policies.
Documented process requiring verbal verification for new payees or payment changes.
Our £10/device/month platform automatically handles MFA enforcement, patch management, backup verification, firewall monitoring, and antivirus deployment. You focus on running your business while we ensure insurance compliance.
Insurers don't create security requirements from scratch. They reference established frameworks that represent industry best practice. Understanding these helps you implement controls that satisfy multiple requirements at once.
| Framework | What It Is | Why Insurers Like It | Best For |
|---|---|---|---|
| Cyber Essentials (UK) | Government-backed scheme with 5 basic controls: firewalls, secure config, access control, malware protection, patch management. | Certification proves baseline security. Some insurers offer premium discounts. Required for UK government contracts. | All UK businesses. Simplest certification to achieve. Start here. |
| NIST Cybersecurity Framework | US framework with 5 functions: Identify, Protect, Detect, Respond, Recover. Flexible and adaptable. | Demonstrates systematic risk management. Used globally as assessment baseline. | SMEs wanting structured approach without formal certification costs. |
| ISO 27001 | International standard for Information Security Management Systems. Formal certification available. | Gold standard. Certification provides strong evidence of security maturity. Required for high-risk sectors. | Larger businesses, finance sector, businesses working with sensitive data. |
| CIS Controls | 18 prioritized cybersecurity actions from Center for Internet Security. Practical and actionable. | Focuses on preventing common attacks. Implementation guides available free. | SMEs building security program from scratch. Technical teams appreciate specificity. |
| COBIT | IT governance framework aligning IT with business goals. Covers risk, compliance, service delivery. | Demonstrates IT governance maturity and accountability. Board-level oversight. | Larger enterprises, regulated sectors like finance. |
For most Cornwall SMEs: Start with Cyber Essentials. It's UK-specific, affordable (£300-500 for certification), and directly addresses insurer requirements. Once certified, you can reference it in insurance applications and renewals.
If you're in construction, manufacturing, or working with government: Cyber Essentials Plus adds verification testing. Worth the extra cost if clients require certification.
For professional services, finance, healthcare: Consider ISO 27001 as you scale beyond 25 employees. The certification process itself strengthens your security posture significantly.
If you just need to meet insurance requirements without formal certification: Follow NIST CSF or CIS Controls. These provide structure without certification costs, and you can self-assess compliance.
You can't fix everything overnight, but you can implement insurance-compliant security systematically. Here's a realistic timeline for a 10-20 person business starting from basic IT setup:
Goal: Understand current state and identify gaps.
Goal: Implement highest-impact, fastest controls.
Goal: Meet backup requirements properly.
Goal: Close vulnerability windows.
Goal: Document processes and train staff.
Goal: Prove compliance for insurer.
Implement these controls now, not when your policy renews. If a breach happens during your policy period and you weren't compliant, your claim gets denied even if you've since fixed the issues.
Understanding why claims fail helps you avoid the same mistakes. These are real denial reasons from UK insurers:
Insurer required backups "stored separately from original data" but business kept backup drive plugged into server 24/7. Ransomware encrypted both. Claim denied for £180,000 recovery costs.
Prevention: Use offline (air-gapped) storage or immutable cloud backup that ransomware cannot access. Test disconnection regularly.
Policy required MFA on "all systems." Business enabled it on Microsoft 365 but not on accounting software accessed remotely. Breach occurred through accounting system. Claim denied.
Prevention: Enable MFA everywhere: email, VPN, remote desktop, cloud apps, admin panels. Document everywhere it's deployed.
Exchange Server vulnerability published with CVSS score 9.8 (critical). Policy required patching within 14 days. Breach occurred on day 17 through unpatched server. £250,000 claim denied.
Prevention: Monitor vendor bulletins. Prioritize patches by CVSS score. Document patch deployment dates.
CEO clicked phishing link leading to wire fraud. Policy required "documented employee training on social engineering." Business ran training but kept no records. Claim denied for £85,000.
Prevention: Maintain attendance records, completion certificates, quiz results. Email evidence counts.
Accounts payable received email appearing to be from CEO requesting urgent payment to new supplier. Sent £50,000 without verbal verification as required by policy. Claim denied.
Prevention: Document the verification policy in writing. Train staff. Require written acknowledgment. Actually enforce it.
Businesses that get claims paid can demonstrate three things: (1) They had required controls in place before the incident, (2) They maintained evidence of those controls, and (3) They followed documented procedures. It's not about being perfect - it's about showing systematic effort.
Use this checklist to verify you're meeting standard insurance requirements. Print it, tick boxes as you implement, and keep it with your insurance documentation.
Score yourself: If you checked fewer than 18 boxes, you're at high risk of claim denial. If you're between 18-20, you're mostly compliant but have gaps. All 22 checked means you're insurance-ready.
Cyber insurance isn't useful if your claim gets denied when you need it most. The requirements exist because they actually prevent breaches - insurers aren't being difficult, they're protecting their exposure.
For most Cornwall SMEs, implementing these controls properly costs £2,000-4,000 upfront and £100-200/month ongoing. Compare that to the average ransomware payment of £200,000+ or the cost of recovering from a breach without insurance coverage.
The question isn't whether you can afford to implement proper security. It's whether you can afford not to.
InfiniTech's endpoint management platform handles 80% of standard insurance requirements automatically for £10/device/month. Free compliance assessment shows exactly what you're missing and how to fix it.