Cyber insurance for businesses

Cyber insurance is a specialist policy that covers the costs your business faces after a cyber attack, data breach, or IT system failure. It sits alongside your other business insurance but addresses risks that general liability policies typically exclude.

Unlike most traditional insurance, cyber cover protects against both the direct costs to your business (first-party losses) and claims brought against you by others (third-party liability). For any business that holds personal data, processes payments, or depends on IT systems to trade, it is a core part of risk management rather than a nice-to-have.

What cyber insurance covers

First-party cover (costs to your business)

First-party cover pays for the direct costs you incur after an incident:

• specialist investigators to find out what happened, which systems were affected and how to contain the breach
• notification costs: under UK GDPR you must notify the Information Commission (formerly the ICO) within 72 hours and may need to contact affected individuals, which can be costly for large databases
• lost income while your systems are down, and the cost of temporary workarounds to keep trading
• ransomware and extortion costs, including ransom payments under some policies, though insurers increasingly discourage payment
• rebuilding damaged systems, recovering data from backups and replacing compromised hardware or software
• crisis communications support to manage reputational damage with customers, suppliers and the media

Third-party cover (claims against you)

Third-party cover protects against liability when others suffer because of a cyber incident at your business:

• defence costs and settlements when people whose data was compromised bring claims against you
• fines imposed by the Commission or other regulators, where UK law allows them to be insured; deliberate breaches are excluded
• payments to customers or partners who suffered financial loss because of a breach at your business
• fines your payment processor imposes if you handle card data and fail Payment Card Industry (PCI DSS) standards after a breach
• solicitor and barrister fees for defending regulatory investigations or civil claims

When you need cyber insurance

Cyber insurance is not legally mandatory, but it is strongly advisable if:

• you hold personal data, such as a customer database, employee records or a mailing list, because UK GDPR gives you obligations and financial exposure if that data is compromised
• you trade online, as e-commerce, SaaS and online service businesses face higher risks of payment fraud, account takeovers and website attacks
• you cannot trade when your IT systems are down, so business interruption cover becomes essential
• you handle payment card data, as PCI DSS creates extra liability if card data is breached
• your contracts require it, as larger clients and public sector organisations increasingly do

Even very small businesses are at risk. A sole trader with a customer email list holds personal data under UK GDPR. A small retailer taking card payments online faces PCI DSS obligations. The question is not whether you face cyber risk, but whether you can absorb the financial impact of an incident without insurance.

Relationship with UK GDPR compliance

Cyber insurance and UK GDPR compliance are complementary: you need both, and neither replaces the other.

Under UK GDPR and the Data Protection Act 2018, the Commission can impose fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. A breach also brings notification costs, possible compensation claims from affected individuals, and reputational damage.

UK GDPR requires appropriate technical and organisational measures to protect personal data, including access controls, encryption, staff training and documented procedures. If a breach occurs, you must notify the Commission within 72 hours and, where there is high risk to individuals, notify them directly.

Even with strong security, breaches can happen through sophisticated attacks, supply chain compromises or human error. Insurance covers the financial consequences: forensic investigation, notification costs, legal defence, and potential fines or compensation.

Cyber insurance will not pay out if you have fundamentally failed to implement basic security measures. Policies typically exclude claims arising from known vulnerabilities you failed to patch, deliberate non-compliance, or wilful negligence. Good security practices are a prerequisite for cover, not an alternative to it.

What insurers expect from your business

Cyber insurance underwriting has tightened significantly since 2020. Most insurers require evidence of baseline security controls before they will offer cover, and better security typically means lower premiums.

Common underwriting requirements

• multi-factor authentication (MFA) on email, remote access and administrative systems, which is a near-universal requirement
• applying software security updates within a reasonable time, typically 14 to 30 days for critical patches
• documented, regularly tested backups, including offline or immutable backups that ransomware cannot encrypt
• staff training on phishing, social engineering and password hygiene
• antivirus and endpoint detection on all devices

Cyber Essentials certification

Many insurers offer premium reductions of 10-25% for businesses holding Cyber Essentials certification. The scheme, backed by the National Cyber Security Centre (NCSC), verifies that your business has five baseline technical controls in place. Getting certified is good practice regardless of insurance: it demonstrates a minimum standard of cyber hygiene to customers and supply chain partners.

Choosing the right cover

Cyber insurance policies vary considerably in scope, limits, and exclusions. Consider these factors when selecting cover:

Assess your exposure

• How many personal records do you hold? Breach notification costs scale with the number of people affected.
• How long can your business survive without its IT systems? Business interruption cover should match your maximum tolerable downtime.
• Do client contracts specify minimum cover levels?
• Healthcare, financial services and legal firms face heightened regulatory scrutiny and may need higher limits.

Key policy terms to check

• The retroactive date: does the policy cover breaches that happened before it started but are discovered during the policy period?
• Regulatory fines: are Commission fines included or excluded? Check whether the policy covers fines "where insurable by law".
• Ransomware: some policies exclude ransomware payments or cap them at a sub-limit.
• Supply chain incidents: does the policy cover you if a breach occurs at a third-party provider such as your cloud host or payroll provider?
• Incident response panel: good policies give access to pre-approved forensic investigators, solicitors and PR firms who can respond quickly.

Typical cover levels

For small businesses, cover typically starts at £100,000 and ranges up to £1 million. Premiums for a small business with good security controls generally range from £300 to £1,500 per year, depending on sector, data volumes, and turnover. Businesses in higher-risk sectors (healthcare, financial services, e-commerce) or those with large customer databases should consider higher limits.