Cyber insurance for small businesses: what the NCSC says to check first

Most small business owners know they should think about cyber insurance, and many put it off. The reasons are familiar: it feels like a cost for something that may never happen, and it is hard to tell what a policy will actually pay for. The National Cyber Security Centre (NCSC) publishes guidance on exactly this, and it is a sensible place to start before you speak to a broker.

What cyber insurance does, and what it does not

According to the NCSC, cyber insurance can help an organisation recover after an incident such as ransomware or a data breach. That can mean support in limiting business disruption, financial protection during the incident, and help with legal and regulatory action afterwards.

What it does not do is fix the underlying security problem or stop an attack happening. The NCSC is clear that you still need to protect the things that matter to your business. Think of a policy as the safety net, and good security habits as the thing that keeps you off it.

How common is cover among small firms?

Take-up is patchy. Insurance Business UK, reporting in January 2026, cites the government's Cyber Security Breaches Survey 2025: 45% of UK businesses have some insurance against cyber risks, usually as part of a wider policy, while only 7% hold a standalone cyber policy. The same article quotes a GlobalData survey finding just over 40% of UK SMEs hold cyber cover, ranging from 13.1% of sole traders to 63% of medium-sized firms.

The barriers it lists are cost, a belief that "we're too small to be a target", and an assumption that an existing commercial policy already includes cyber cover. That last one is worth checking, which brings us to the first step.

Step one: check what you already have

The NCSC advises checking existing policies first. Business interruption or property insurance may already cover some cyber losses, or may specifically exclude certain cyber incidents. Read the wording, or ask your broker to confirm in writing what is and is not covered.

Step two: get the basics in place

The NCSC recommends putting fundamental safeguards in place before you buy, such as Cyber Essentials or Cyber Essentials Plus. It says these can also lower premiums, and that some insurers offer discounts for them, so tell your broker if you hold either.

Cyber Essentials is a government-backed certification developed by the NCSC and delivered by IASME. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC page says pricing depends on organisation size and starts at £320 plus VAT. It also says that a UK organisation with a turnover under £20m that certifies its whole organisation automatically receives Cyber Liability Insurance arranged by IASME, including 24/7 incident response support covering technical, legal and crisis management help. The NCSC cyber insurance guidance notes this is not suitable for everyone, so you should still ask the same questions of it as you would of any policy.

Step three: know what you would hate to lose

Do not stop at the insurer's minimum security requirements. The NCSC points out that these may not protect what your organisation values most. Write down the scenarios that would hurt you badly: the booking system down for a week, the customer list leaked, the bank details on an invoice swapped by a fraudster.

The NCSC also suggests thinking about the impacts: downtime, data loss including customer data, response and recovery costs, and how one problem can spread across locations. It notes that keeping backups separate from your network, or in a purpose-built cloud service, reduces the impact of ransomware.

Questions to ask before you sign

The NCSC guidance lists questions to put to a broker or insurer. In plain terms:

• What is covered and what is excluded? The NCSC gives the example that some policies do not cover money lost through business email compromise fraud, so ask specifically if that is a risk for you.
• Would the policy cover a new type of attack that emerged after you bought it?
• Does it cover third-party compensation claims, such as from customers whose personal data was lost in a breach?
• Are the policy limits right for a business of your size?
• What immediate response services does the insurer provide, and do they help you learn from incidents?

The NCSC notes that during or after an incident, insurers may provide forensics, legal help, public relations support, or access to a Cyber Incident Response company. Typical cover focuses on restoring systems and data and limiting business interruption losses, and defending and settling data breach claims is usually included. Some policies also cover computer-enabled fraud, which is why the wording matters.

The small print that catches people out

Policies are usually reassessed every 12 months, according to the NCSC. You are responsible for keeping your security details accurate and for telling the insurer when your circumstances change. Misstating your security measures can put a claim at risk. If a form asks whether you use multi-factor authentication on every account and you only use it on some, do not tick yes to be tidy. Get the answer right, or fix the gap first.

What does the market look like?

Insurance Business UK reports that the Association of British Insurers recorded UK cyber claims payouts of about £197 million in 2024, up from £59 million a year earlier, mostly from smaller organisations. It also cites Howden research finding that 52% of UK private-sector firms suffered at least one cyberattack in the past five years, at an average cost of 1.9% of annual revenue. These are industry figures reported by a trade publication, so treat them as a guide to scale rather than a forecast for your own business. The takeaway is simple: small firms do claim, and claims are not rare.

What to do this week

• Find your current business insurance documents and read what they say about cyber incidents.
• List the three things you could not afford to lose, and where they are stored.
• Check that you have a backup kept separate from your main network, and that you have tried restoring from it.
• Look at Cyber Essentials on the NCSC site and decide whether certification is realistic for you this year.
• Ask a broker the five questions above, and ask for the answers in writing.

If you would like help with the technical side, such as backups, access controls and securing your website and cloud accounts, our cloud and security service is built for small businesses. And remember: insurance helps you recover, but it is the everyday basics that make a claim less likely in the first place.