Cyber insurance does not replace IT security
More and more small businesses consider cyber insurance. That's sensible, but many underestimate what insurers want to know and what the small print says. I'm not an insurance broker and don't advise on tariffs, but I can explain the technical questions that almost always appear.
What cyber insurance typically covers
Depending on the policy:
- IT forensics and recovery costs
- Loss of income from business interruption
- Crisis communication and legal advice
- Third-party claims
- Access to an emergency hotline
Often not or only partly covered: ransom payments, gross negligence, known but unfixed vulnerabilities and damage caused by outdated systems.
The technical questions
- Multi-factor authentication (MFA) for email, remote access and admin accounts. See also our article on passkeys.
- Backups: regular, at least one copy separated, restore tested.
- Updates: no systems without vendor support, e.g. Windows 10.
- Antivirus and firewall.
- Admin rights: normal users work without them.
- Training: phishing awareness.
- Emergency plan: a documented IT emergency plan.
Why honest answers matter
Your answers become part of the contract. If after an incident it turns out MFA wasn't active although you ticked "yes", the insurer may reduce or refuse payment. Only tick what is really implemented and documented. Go through the questionnaire with your IT provider before signing.
Checklist
FAQ
Is it worth it for a five-person business? That depends on how much you rely on IT. Ask an independent broker.
Does insurance replace safeguards? No. Without basic protection you often get no policy at all.
Conclusion
Cyber insurance is a sensible building block once the basics are right. If you want the technical points checked first, see IT security.
