FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Proposal form guides
A walkthrough of Apex's cyber proposal form for UK businesses. It explains what each section asks, why underwriters ask it, and which answers most often cause problems later.
Part of: Cyber insurance guide
In short
The cyber proposal form is short, but most of its questions are about security controls, and the policy is priced and worded on the basis that those controls are in place. Underwriters focus on your website domain, the personal data you hold, multi-factor authentication, separated and tested backups, patching, and how payment requests are verified. Past incidents, including a hacked mailbox that cost nothing, must be disclosed. Check the security answers with whoever runs your IT before you sign, because under the Insurance Act 2015 the business is treated as knowing what a reasonable search would reveal.
A cyber proposal form is short compared with a professional indemnity form, but each answer carries more weight. Most of the questions are about controls, and an underwriter prices and words the policy on the assumption that the controls you describe are actually in place.
For a business, the form sits inside the duty of fair presentation under the Insurance Act 2015. You must disclose every material circumstance you know or ought to know, or enough to put the insurer on notice to ask more, whether or not a question asks about it. Our page on the duty of fair presentation explains the principle.
The consequences of getting it wrong are set by the Act. If a control you described turns out not to be in place, the insurer's remedy depends on whether the misstatement was deliberate or reckless, and on what it would have done had it known the truth. That can mean the policy being avoided, different terms being applied as if they had been agreed, or a claim being paid in proportion to the premium that was actually charged. None of these outcomes is attractive in the middle of a ransomware event.
"Ought to know" matters here because the person signing is rarely the person who runs the IT. If an external provider manages your systems, ask them to confirm the security answers in writing before you submit. Have to hand: revenue figures, a rough count of the personal data you hold, how card payments are taken, your IT provider's details, and a record of any past incident.
The form asks for the trading name and every subsidiary or trading style to be insured, your website domain, address, date established, a plain description of what you do, last year's revenue, any revenue from the USA or Canada, and total staff.
The website domain is, as the form says, the single most important field. Many cyber insurers run an external scan of your domain before quoting, looking for things like exposed remote-access services, out-of-date software visible from the internet, and weak email-authentication settings. Give every domain you use, including old ones that still resolve and any used only for email. A scan that finds an issue you did not mention is a harder conversation than one you raised yourself.
Revenue sizes the business-interruption exposure: how much a week of downtime would cost. North American revenue is asked for separately because claims and regulatory regimes there are treated differently, so give a realistic percentage, not "minimal". Staff numbers matter because every mailbox is a route in for phishing.
The business description should say what you sell and to whom, and should mention anything that makes you a higher-value target: handling client money, holding client systems or data, or providing a service other businesses depend on.
This section asks roughly how many individuals' personal data you hold, whether any of it is especially sensitive, how card payments are handled, and whether an external provider manages your IT.
Record numbers drive the cost of responding to a breach: notifying people, handling their queries and dealing with any claims. Count everyone whose details sit anywhere in your systems, including the CRM, mailboxes, old spreadsheets, former employees and lapsed customers. Firms routinely undercount because they think only of current customers. Deleting data you no longer need is one of the cheapest ways to reduce exposure.
Sensitive data means health, financial or children's data. Health data is special category data under UK GDPR, and all three attract closer scrutiny after a breach. Say what kinds you hold and roughly how much.
Card payments: "fully outsourced" means a payment provider or your bank's terminal handles the card data and you never store it. If card details pass through or are stored in your own systems, say so: that brings the card industry's PCI DSS obligations into play, and a breach there carries costs of its own.
If an external IT provider manages your systems, name them. Underwriters want to know who holds administrator access, because an attack on a managed service provider can reach every client it looks after.
Five questions: multi-factor authentication, backups, patching and unsupported software, endpoint protection, and how payment requests are verified. These are the controls underwriters weigh most heavily, and the answers have to be accurate on the day you sign.
MFA. The form's top answer means MFA on email, remote access and key systems. Before choosing it, check administrator accounts, shared mailboxes, old remote-access routes and any cloud service that still accepts a password alone. If there are exceptions, choose the answer that fits and explain them. Overstating MFA is one of the most serious misstatements on a cyber proposal, and some policies make specific controls a condition of cover.
Backups. A separated copy is one a compromised administrator account could not delete, offline or in a separately secured service. A recovery that has been tested is worth more than one that has not. Ransomware recovery largely turns on this answer; see ransomware and professional firms.
Patching. Insurers look for security updates applied promptly and no software so old its maker no longer supports it. If one old machine runs an unsupported system for a specific piece of equipment, say so and describe how it is isolated.
Endpoint protection. "All company computers" includes laptops used at home and any server. If some devices are not covered, say which.
Payment verification. Confirming bank-detail changes and large payment requests by a second person or a known phone number is the control that stops invoice fraud. The form notes it also unlocks crime cover, which is usually a separate section with its own conditions; see wire fraud and social engineering cover.
The form asks about any cyber incident in the last five years, any data protection regulator investigation or complaint, any circumstance that might lead to a claim, existing or previous cyber cover, and any declined, cancelled or specially-rated application.
"Incident" is broad: ransomware, a hacked mailbox, money sent to a fraudster, a data breach, or an outage caused by an attack. A compromised mailbox that cost nothing still counts. Describe what happened, the cost or disruption, and what changed afterwards; the remediation is what an underwriter most wants to read.
Regulator contact includes complaints made to the ICO about you, even if nothing came of them. Under UK GDPR a personal data breach that meets the reporting threshold must be reported to the ICO within 72 hours of becoming aware of it, so any breach you reported belongs here. Our page on GDPR fines and civil claims covers what cyber policies can and cannot respond to.
The circumstances question captures the suspicious login alert not yet investigated, a warning from your IT provider about a vulnerability, or a supplier who has told you they were breached. If you already hold cyber cover, report anything like this to that insurer under its terms, then disclose it here.
You choose a limit (the form offers options from £250k to £5m, or other) and a start date.
The right cyber limit depends on three things: how many records you hold, how long you could operate without your systems and what that downtime would cost, and what your client contracts require. Contract-driven limits are common where you hold client data or access client systems. If you are unsure, pick the nearest option and tell us why. It also helps to know which parts of cover matter most to you; our page on first-party and third-party cyber cover explains the difference. Our cyber insurance guide sets out how the main sections of cover respond.
If you have an existing policy, give the renewal date so there is no gap. Cyber cover is separate from professional indemnity, and the two can overlap or leave gaps; see where cyber cover ends and PI begins.
You give your name and position, such as director, owner or IT manager. The declaration confirms the answers are accurate and complete.
Whoever signs should have authority to bind the business, and should have checked the security answers with whoever actually runs the systems. Under section 4 of the Act, what the business knows includes what its senior management and the people responsible for its insurance know, and what a reasonable search would reveal, including enquiries of an outsourced IT provider.
The duty applies until the contract is entered into. If an incident happens or a control changes after you submit but before cover starts, tell us.
Many cyber insurers scan a business's public internet footprint before quoting, looking for exposed services, out-of-date software and weak email security. The domain is where that scan starts, so list every domain you use.
Choose the answer that is true and explain the exceptions. Overstating MFA is one of the most serious misstatements on a cyber proposal, and some policies make specific security controls a condition of cover.
Yes. The form asks about any cyber incident in the last five years, including a compromised mailbox, whether or not money was lost. Describe what happened and what you changed afterwards.
Whoever actually manages your IT, whether an internal person or an external provider, should confirm those answers. A director can sign the declaration, but the business is treated as knowing what a reasonable search would reveal.
No. Cyber insurance mainly covers your own costs after an attack or breach and certain liabilities arising from it; professional indemnity covers claims that your professional work was negligent. They can overlap. See where cyber cover ends and PI begins.
No. It follows the questions on Apex's own online cyber proposal form and explains why underwriters ask them. An insurer may ask further questions, and those answers need the same care.
Start your proposal online and save it as you go, or upload a completed proposal from your current broker on the first page. Or call 0117 325 0027.
Start your proposal Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. It explains the kinds of question asked and does not reproduce any insurer's form or guarantee that cover will be available or on what terms.
