Your insurer wants Cyber Essentials. Here's what to do.

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. Why insurers ask about Cyber Essentials at renewal

When an underwriter prices a cyber insurance or professional indemnity policy, they are trying to work out how likely you are to suffer a Business Email Compromise (invoice fraud) or ransomware claim. The five Cyber Essentials controls — particularly mandatory Multi-Factor Authentication (MFA) on all cloud apps, 14-day critical patching, and removing everyday admin rights — directly address the root causes of those claims.

2. Which insurer questions Cyber Essentials answers (and which it doesn't)

• Covered by Cyber Essentials: Multi-Factor Authentication on email and cloud apps, supported operating systems, patching within 14 days, endpoint anti-malware, firewall configuration, and separate administrator accounts.
• Usually asked by insurers in addition to Cyber Essentials: Offline or immutable backups (recommended in Section C of v3.3, though not a scored control), staff phishing training, and a written incident response plan.

3. The complimentary cyber insurance bundled with Cyber Essentials

When a UK-domiciled organisation certifies its whole organisation for Cyber Essentials (and opts in during the application), IASME includes complimentary cyber liability insurance underwritten through its scheme broker, provided your annual turnover is under £20 million (IASME). It provides a £25,000 total indemnity limit with 24/7 incident response support. For many micro-businesses that satisfies basic requirements; larger professional firms use their Cyber Essentials certificate to qualify for or reduce the excess on a larger commercial cyber policy.

4. What to do this week if your insurance renewal date is close

1. Run the 10-minute Auto-fail checker today: Find out immediately whether cloud MFA, Windows 10 or 14-day patching will slow you down.
2. Tell your insurance broker you are mid-certification: Insurance brokers and underwriters will often grant a short extension or note your booked preparation start date if you can show an active Cyber Essentials preparation plan rather than leaving the question blank.
3. Check our realistic timeline: A well-prepared Microsoft 365 firm can certify in one to two weeks. See how long Cyber Essentials takes.