Not a certification, what insurers actually check before they'll underwrite you or pay a claim, and exactly where we fit versus what stays with you.
Cyber insurance isn't a standard or a certification with a fixed rulebook, it's a commercial contract, and every insurer sets their own underwriting questions. But in practice, most UK cyber insurance proposal forms converge on the same core evidence: multi-factor authentication on email and remote access, endpoint protection, regular tested backups, a documented incident response plan, staff security awareness training, and patching discipline, heavily overlapping with the Cyber Essentials five controls.
The real risk isn't failing to get a policy, it's what happens after an incident. Insurers increasingly investigate whether your actual practices matched what was declared on the proposal form, and will reduce or deny a claim outright if they don't. The evidence trail matters as much as the policy itself.
Underwriting has tightened significantly, insurers ask more detailed technical questions than they did even two years ago, and price risk accordingly.
Many commercial contracts and public sector tenders now expect proof of cyber insurance as a condition of doing business, on top of whatever framework they also require.
The same complete security policy set, covering every control area a typical insurer's proposal form asks about, access control, backup, incident response, security awareness and more.
Documentation built to answer proposal-form questions honestly and consistently, and to hold up if you ever need to substantiate a claim.
A working risk register showing you actively manage risk rather than reacting to it, exactly what a good underwriter wants to see.
Evidence your incident response plan has actually been tested, a question that appears on an increasing number of proposal forms.
A clear picture of where your evidence is strong and where it's thin, before you sit down to complete a proposal form.
Update an answer and we automatically flag every document it affects. For real-world changes we wouldn't otherwise know about, a new supplier, a dropped control, tell us via your quarterly Narrative Check, so what you declared at renewal still holds true if you ever need to claim.
A dedicated set of the questions that recur across UK cyber insurance proposal and renewal forms, MFA coverage, endpoint protection, backup resilience, privileged access, patching, email authentication, incident response testing, prior incidents and claims, vendor risk, each with a tracked, dated answer.
Answer these once and they stay current in your portal, with the date each answer was last confirmed, so a renewal, a new insurer, or a broker's follow-up question is a lookup, not a fresh scramble to gather evidence from scratch.
Because these are the same questions that recur across most insurers' forms, one accurate, up-to-date answer set does the job for whichever provider you're with, or move to.
Insurers typically expect these controls reconfirmed at each renewal, not just declared once at onboarding.
A tracked "last updated" date on every answer means you can see at a glance what's genuinely current and what needs a fresh look before you renew.
Implementing the actual technical controls the evidence describes, MFA, endpoint protection, backups, patching, in your live environment, typically with your internal IT team or MSP.
Choosing your insurer or broker, completing the actual proposal form, and agreeing your policy terms and premium, we are not an insurance broker or FCA-regulated for insurance activities, and we don't sell, arrange or recommend specific policies.
Keeping your day-to-day practices matched to what you declared, the discipline of actually running MFA, testing backups, and training staff, not just having a policy document that says you do.
Our job is making sure that whenever you sit down with a broker or complete a proposal form, you're answering from genuine, current evidence rather than guesswork, and that if you're ever unlucky enough to need to claim, what you declared and what you actually do still match. Which insurer, which policy, and which premium you agree to is entirely your decision, made with your broker.
The full ISO 27001, CAF and Cyber Insurance policy pack, built from your core questionnaire.