Cyber Insurance for UK Small Business Explained

Affiliate disclosure: Some links on this page may earn us a small commission at no extra cost to you.

The Cover Most Small Businesses Skip

You probably have public liability, and maybe professional indemnity. Cyber cover tends to be the one that gets left, either because it feels like a corporate concern or because people assume their existing policies stretch to it. They generally do not.

One incident, a phishing email, a ransomware attack, an email sent to the wrong recipient, sets off a chain of costs: emergency IT support, legal advice, notifying customers, an ICO deadline measured in hours, and potentially weeks of disrupted trading.

This explains what the cover does, what insurers now demand before they will sell it to you, what is commonly excluded, and the free £25,000 of cover a lot of UK small businesses already qualify for without knowing.

What It Is

Cyber insurance, sometimes called cyber liability insurance, helps you recover from the financial and operational impact of an incident. Traditional business policies were written before any of this existed and were never designed for it.

It does not prevent attacks. It pays for the aftermath and, just as importantly, gives you people to call at 8am on the day it happens.

What It Covers

1. Breach Response Costs

Usually the most immediately valuable part, and the one that surprises people. After a breach you are looking at forensic investigation to establish what happened, legal advice on your notification duties, IT specialists to contain it, customer notification costs, and sometimes PR support.

Those costs reach tens of thousands even for a modest incident at a small firm. Most policies either pay them directly or give you access to a panel of incident response specialists, which for a business with no IT department is the real product.

2. UK GDPR and the ICO Clock

If a personal data breach is likely to result in a risk to people’s rights and freedoms, you must notify the ICO within 72 hours of becoming aware of it. If the risk to individuals is high, you must also tell them without undue delay. If you report late, you have to explain why.

Seventy-two hours is unforgiving. It starts when you become aware, not when you finish investigating, which is why the breach coach access in a policy matters more than the headline limit.

Two things the ICO also expects that are easy to miss. You must keep a record of every personal data breach, including the ones you decide not to report, with your reasoning. And the maximum penalty under UK GDPR is £17.5 million or 4% of global turnover, though for a small business acting in good faith and responding promptly the practical exposure is remediation rather than a fine. The response costs will usually dwarf any penalty.

3. Business Interruption

If ransomware takes you offline for days or weeks, revenue stops while fixed costs continue. Cyber business interruption compensates for that lost income during a defined period.

Check the waiting period, sometimes called a time excess. Many policies only start counting after a set number of hours, commonly eight or twelve, which matters if your typical outage is short but expensive.

4. Cyber Extortion

Ransomware is the dominant threat to small businesses. Policies generally cover the response: specialist negotiators, forensic support, and in many cases the ransom itself where payment is lawful.

Three caveats worth knowing:

• Extortion cover usually carries a sub-limit, often a proportion of the headline policy limit rather than the full amount
• Insurers require pre-approval from their incident response team before any payment
• Payment must be lawful, which means sanctions screening. Paying a sanctioned entity is a criminal matter regardless of what your policy says

UK government guidance discourages payment and does not prohibit it for private businesses outside sanctions situations. That may change in part: legislation going through Parliament proposes a targeted payment ban for public sector bodies and critical national infrastructure, alongside a pre-payment notification regime and mandatory incident reporting for larger organisations. As drafted it does not ban payments by SMEs, but it is worth watching if you are in a public sector supply chain.

5. Third-Party Liability

If your incident harms someone else, typically a client whose data you held, you may face claims. Cyber policies cover defence costs and compensation for those claims.

This sits alongside professional indemnity rather than replacing it. Some insurers bundle them, others do not, and the overlap is worth checking rather than assuming.

Exclusions to Read Before You Buy

State-backed attacks. Following a Lloyd’s market requirement, standalone cyber policies now generally exclude attacks attributable to a state actor. Attribution is contested and slow, so read how your policy defines it.

Failure to maintain. Cover can be reduced or refused where systems were unpatched or where the security measures you declared at inception were not actually in place. Your application answers become warranties.

Betterment. Insurers pay to restore what you had, not to upgrade you to something better.

Prior known incidents. Anything you were already aware of before inception is excluded.

What Insurers Now Require

Underwriting has tightened considerably since ransomware became routine. Expect these to be conditions rather than questions.

Multi-factor authentication. Near-universal now. Without MFA on email, cloud systems and remote access, many insurers will decline or impose restrictive exclusions. Enable it on Microsoft 365 or Google Workspace, your accounting software, your CRM, and above all on VPNs and remote desktop access.

Backups that have been tested. The 3-2-1 approach, three copies on two media types with one offsite, is the usual expectation. The word that matters is tested: an untested backup is a hope, not a control.

Patching. A process for applying security updates promptly. For most small businesses that means automatic updates, confirmed to be actually running.

Staff training. Phishing remains the main entry point, and insurers increasingly ask whether staff have had any awareness training. Free resources count.

Endpoint protection. Business-grade antivirus or endpoint detection and response across devices. Consumer free antivirus usually will not satisfy an underwriter.

The Free £25,000 You May Already Qualify For

This is the part most guides leave out.

Cyber Essentials is the UK government-backed certification scheme, delivered by IASME. Achieving self-assessed certification across your whole organisation entitles UK-domiciled businesses with group turnover under £20 million to £25,000 of cyber liability insurance at no extra cost, provided you opt in. It includes incident response support, which for a micro-business is often the most useful component.

Two honest caveats. £25,000 is a small limit for anything beyond a contained incident, and it is an aggregate rather than per claim. And the certification has to cover the entire organisation, not a convenient subset.

Even setting the insurance aside, certification is worth considering: it is specified in many public sector tenders and increasingly in private supply chains, and several insurers price certified businesses more favourably.

Note that the scheme updated its requirements in April 2026, making multi-factor authentication mandatory wherever a cloud service supports it, retaining a 14-day window for applying critical and high-risk updates, and preventing cloud services from being excluded from scope. Those are sensible controls to have in place regardless of whether you certify.

Is It Worth It?

For most small businesses that hold personal data, take payments, or depend on digital systems to trade, yes.

The usual objection is being too small to be a target. Automated attacks do not select by size, and small businesses are often easier. The question is not whether you could be hit, but whether you could absorb the cost if you were.

Premiums for a small business with modest limits are commonly reported in the hundreds to low thousands a year, varying with turnover, sector, data held and the controls you can evidence. Get quotes rather than assuming.

FAQ

Does my public liability or professional indemnity cover cyber incidents?

Not meaningfully. Those wordings predate digital operations and typically exclude or heavily limit cyber events. Check your own policy, but assume you need dedicated cover.

I hold hardly any customer data. Do I still need it?

Even a handful of names and email addresses creates UK GDPR obligations. And the data is only half of it: ransomware that takes out your email, accounting software and online banking hurts regardless of how little you store.

What is the difference between first-party and third-party cover?

First-party pays your own costs: response, interruption, extortion. Third-party pays claims made against you by others. Most comprehensive policies include both; confirm before buying.

Will it pay a ransom?

Often, where payment is lawful, subject to a sub-limit and the insurer’s pre-approval. Sanctions screening applies, and government guidance discourages payment.

How does this interact with Making Tax Digital?

No direct interaction, but a practical one. If an incident takes your accounting software offline or corrupts records, your quarterly MTD updates and VAT deadlines do not move to accommodate it. Interruption cover and incident response help you get back inside the deadline.

Cyber Insurance for UK Small Business: The Bottom Line

Assess your exposure honestly: how much you depend on digital systems, what personal data you hold, and whether you could survive a month of disruption.

Before you approach an insurer, do the controls: MFA everywhere, tested backups, updates applied, staff told what phishing looks like. Those improve both your insurability and your actual security, and most are free.

Then check whether Cyber Essentials gets you £25,000 of cover for the price of certification before you buy a standalone policy.

When you do compare policies, read the exclusions, the extortion sub-limit, the business interruption waiting period and the definition of a cyber event. The access to breach coaches and legal advice is frequently worth more than the limit on the front page.

This article is general information about insurance and UK data protection, not advice, and it does not take account of your circumstances. Policy wordings, exclusions and certification requirements change. Speak to an FCA-authorised broker and check the current position with the ICO and the NCSC before relying on anything here.