Choosing cyber insurance for a small firm

Many small firms first hear about cyber insurance from a client, a bank or their own insurer.

These notes explain what a policy can help with and how to choose one well. They also cover what UK rules expect from a firm after an incident.

They draw on guidance from the National Cyber Security Centre (NCSC), the Information Commissioner's Office (ICO) and a government survey of UK businesses.

What a policy can help with

The NCSC says cyber insurance can help a firm get back on its feet after something goes wrong. Many policies include forensic help to find out what happened, and legal help. Some also help the firm deal with regulators after an incident.

Insurers word their policies differently, so the details are in each policy's terms. The NCSC also says insurance will not stop an attack. It compares this with home insurance, where the owner still locks the doors.

Questions to ask before you buy

The NCSC suggests that buyers work through a short set of questions.

What security do you already have in place?
Who in the firm will help you read the policy?
What would an incident do to your business?
What does the policy cover, and what does it leave out?
Which security services come with the policy, and do you need them?
Does the insurer give support during and after an incident?
What must you have in place to make a claim or renew?

Cyber Essentials

Cyber Essentials is the minimum standard of cyber security the government recommends for organisations of every size. It checks five technical controls. They are firewalls, secure settings, software updates, control of user access, and protection against malware.

For the basic level, a firm answers a set of questions and an assessor reviews them. Cyber Essentials Plus adds hands-on technical testing by an independent assessor.

A UK organisation with a turnover under £20 million that certifies its whole organisation is entitled to cyber liability insurance arranged through the scheme. That cover includes incident response support at any hour. The NCSC adds that some insurers offer discounts to certified firms.

What other firms hold

The government surveys UK businesses about cyber security every year. For its 2025/2026 survey, researchers spoke to 2,112 businesses and 1,085 charities between August and December 2025. The results came out on 30 April 2026.

Almost half of businesses (47%) said they were insured against cyber risks in some way. For most of them, the cover was part of a wider insurance policy. Only 10% of businesses held a policy written for cyber risks alone. Small businesses (55%) and medium-sized businesses (61%) were more likely than average to have some form of cover.

In the same survey, 43% of businesses said they had faced a cyber breach or attack in the previous 12 months.

After an incident

After a breach of personal data, the firm has to judge the likely risk to the people affected. If a risk is likely, the firm must tell the ICO as soon as possible, and where it can within 72 hours. If the risk to people is high, the firm must also tell those people without undue delay.

Ransomware is software that locks people out of their own devices and files. The NCSC and UK law enforcement do not encourage, endorse or condone paying a ransom. Their main advice is to keep a recent offline backup of the files a business cannot do without.