Cyber insurance and Cyber Essentials working together to protect your business
How long could your business operate without access to its systems or customer data? For many SMEs, a short disruption could mean lost sales, missed deadlines and difficult conversations with customers. Cyber Essentials and cyber insurance can help address that risk together, combining protection with support when an incident happens. We discussed this with Duncan Sutcliffe of Sutcliffe & Co Insurance Brokers, who have provided the insurance accompanying Cyber Essentials since the scheme began in 2014. His message: businesses should consider their security measures and insurance together.Cyber Essentials provides a foundation
Cyber Essentials helps organisations address common cyber threats through five technical controls:- Firewalls.
- Secure configuration.
- Security update management.
- User access control.
- Malware protection.
Understand the limits of your cover
The included policy provides a total indemnity limit of £25,000, with access to a 24-hour incident helpline. This is a starting point, but Duncan cautioned that a serious ransomware attack could quickly exhaust that amount. Consider the potential cost of restoring systems, investigating an incident and losing the ability to trade. A broker can help assess whether your business needs higher limits or broader protection. Always check the policy wording, exclusions and excesses: the included policy does not cover money stolen electronically or through cyber fraud.Be accurate about your security
Insurers may ask about multifactor authentication, software updates and other safeguards. Your answers help determine whether they offer cover, the premium and any conditions. Those answers must reflect what is actually in place. Work with your IT or security provider to verify them and maintain the controls you declare. Misrepresentation or failure to meet policy conditions can affect a claim; the outcome depends on the circumstances and applicable terms.Support when an incident happens
Duncan highlighted the value of incident response. Depending on the policy, insurers can arrange specialists to investigate an attack, contain the damage and help restore systems and data. Legal and communications support may also help businesses manage the consequences. Where personal data is involved, prompt assessment matters. Reportable breaches must be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness. Not every personal data breach requires notification. Specialist support can help establish what happened and guide the response.Take the next step
Security and insurance deserve attention as your business changes. Review your controls, train employees and consider how you would respond if systems became unavailable. At Factory Internet, our IASME assessors help businesses work towards Cyber Essentials certification. Speak to us about strengthening your security foundations, and discuss appropriate insurance with your broker, so your business is better prepared to prevent, manage and recover from an incident. Get in touch.Sources: Interview with Duncan Sutcliffe, 22 September 2026; IASME insurance guidance; ICO breach reporting guidance.
