How Do I Prepare for Cyber Insurance Renewal?

Why Renewals Are Difficult

The market has changed:

• Insurers lost money on ransomware claims
• Underwriting is stricter
• Questions are more detailed
• Evidence is required, not just assertions
• Premiums remain elevated

What used to work: "Yes, we have antivirus and backup."

What works now: "We have EDR deployed on 100% of endpoints, MFA enforced via Conditional Access, immutable backups tested monthly. Here's the evidence."

Timeline for Renewal

4 months before: Assessment

Review current state:

• What security improvements since last year?
• What gaps remain?
• What questions did you struggle with last time?

Gather evidence:

• MFA deployment reports
• EDR coverage reports
• Patch compliance reports
• Backup test records
• Training completion records

3 months before: Gap closure

Fix what you can:

• Enable MFA everywhere (non-negotiable)
• Deploy EDR if only using antivirus
• Test backup recovery
• Complete security training
• Update incident response plan

Document improvements: Insurers like to see progress. "Last year we had X, now we have Y."

2 months before: Application

Complete application carefully:

• Answer honestly (misrepresentation voids policies)
• Provide specifics, not generalisations
• Attach evidence where requested
• Highlight improvements

Work with your broker: Specialist cyber brokers know which insurers want what. They match your profile to appropriate markets.

1 month before: Clarifications

Respond quickly: Insurers will ask follow-up questions. Quick, detailed responses keep the process moving.

Negotiate: Multiple quotes enable negotiation. Your broker should be shopping the market.

What Insurers Ask

Must-haves (deal-breakers)

MFA: "Is MFA enabled for all remote access, email, and admin accounts?"

• Answer must be yes
• Evidence: Conditional Access policies, configuration screenshots

EDR: "What endpoint detection and response solution do you use?"

• Antivirus alone may not be sufficient
• Name the product, deployment percentage

Backup: "Are backups stored offline or immutable? When were they last tested?"

• Must be ransomware-resistant
• Evidence: Backup reports, test records

Patching: "What is your patch deployment timeframe for critical vulnerabilities?"

• 14-30 days expected
• Evidence: Patch compliance reports

Increasingly required

Security awareness training: "Do you conduct regular security awareness training?"

• Annual minimum, regular better
• Evidence: Completion records

Privileged access management: "How do you control privileged/admin access?"

• Limited admin accounts, just-in-time access
• Evidence: Access reports

Incident response plan: "Do you have a documented incident response plan?"

• Written plan, ideally tested
• Evidence: Plan document, tabletop records

Vendor management: "How do you assess third-party security?"

• Due diligence process
• Evidence: Questionnaires, assessments

What Affects Premium

Lower premium:

• Strong security controls
• Certifications (CE Plus, ISO 27001)
• No claims history
• Security improvements year-on-year
• Lower coverage limits
• Higher deductibles

Higher premium:

• Weak controls
• Previous claims
• High-risk industry
• Large data holdings
• Revenue growth
• Higher limits, lower deductibles

Getting Better Terms

Demonstrate improvement: Year-on-year security improvements show commitment. Document and highlight them.

Get certified: Cyber Essentials Plus and ISO 27001 provide independent validation. Insurers trust them.

Use a specialist broker: Generalist brokers don't know the cyber market. Specialists place you with appropriate insurers.

Consider your limits: Do you need £5M coverage or would £1M suffice? Higher limits cost more.

Adjust deductibles: Higher deductibles reduce premiums. But ensure you can cover the deductible.

What We Provide

We help clients become insurable and stay insurable:

Technical controls:

• MFA, EDR, backup—properly implemented
• Evidence and reporting for applications
• Ongoing compliance with policy conditions

Renewal support:

• Security posture documentation
• Gap identification and closure
• Evidence gathering
• Improvement roadmap

Insurance renewals go smoother when security is genuinely managed, not assembled for the application.

*Disclaimer: This is general guidance, not insurance advice. Work with a specialist cyber insurance broker for advice on your coverage needs. Policy terms and insurer requirements vary.*