Your Cyber Insurance Renewal Is Really a Security Audit. Treat It Like One

Five years ago, cyber insurance for a small business was a tick-box on a broker's form and a modest premium. In 2026 the renewal questionnaire looks more like a technical audit, because that is what it is. Insurers lost a lot of money on ransomware, and they responded the way insurers do: by asking harder questions and refusing to pay when the answers turn out to have been optimistic.

We now get a steady stream of clients who arrive holding a renewal form they cannot honestly complete. This article is the walkthrough we give them.

The questions that decide your premium

The wording varies by insurer, but the same handful of controls come up on almost every UK form we see.

Multi-factor authentication, everywhere that matters. Not "do you use MFA" but "is MFA enforced for all users on email, on remote access, and on administrator accounts". Enforced is the key word. If MFA is available but optional, the honest answer is no. This is the single most common gap we find, and in Microsoft 365 it is usually fixable in an afternoon.

Backups that are tested and separated. Insurers ask whether backups are kept separate from your main network and whether you have actually restored from them. A backup you have never restored is a hope, not a backup. Ransomware crews target backups first, which is why the separation question exists.

Patching discipline. How quickly do you apply security updates? "When we get round to it" is the answer that voids claims. A managed patching schedule, with evidence, is what they want to see.

Endpoint protection. Proper endpoint detection on every company device, not a free antivirus someone installed in 2019.

Leavers and access control. Whether accounts are disabled when staff leave, and who holds admin rights. Old accounts of departed employees are a routine way in.

Staff training. Whether anyone has taught your team what current phishing looks like. With AI-written phishing now fluent and personalised, insurers weight this more than they used to.

Why honesty matters more than a clean sheet

Here is the part worth underlining. If you answer yes to a question and a claim investigation later shows the control was not actually in place, the insurer can and increasingly will decline the claim. An optimistic form is worse than a truthful one with gaps, because the truthful one just costs a higher premium, while the optimistic one costs you the entire payout at the worst possible moment.

So the right order of operations is: read the form early, months before renewal if you can. Audit yourself against it honestly. Fix the gaps that are cheap, and most of them are cheap. Then fill in the form with answers you could defend to a claims investigator.

The overlap with Cyber Essentials

If this list looks familiar, it is because it is roughly the Cyber Essentials standard wearing a different hat. The five Cyber Essentials controls cover most of what insurers ask, and some insurers offer better terms, or include baseline cover, when you hold the certificate. If you are going to do the work anyway, doing it to the standard and getting certified turns a private chore into a public credential you can show clients too.

What this costs, honestly

For a typical 10-to-30-person business on Microsoft 365, closing the common gaps is days of engineering work, not months: enforcing MFA and conditional access, setting up proper patching, checking backup separation and doing a test restore, auditing who has admin rights, and running a staff phishing session. Most of it is configuration of licences you already pay for.

That work usually costs less than the premium increase you would swallow by leaving the form half-honest, and considerably less than a declined claim.

We offer a free security health check that maps your current setup against the standard renewal questions and tells you, in writing, which answers you can currently give. Take the findings to us or to anyone else. Either way, fill the form in from evidence, not memory.