FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
A tech PI and cyber renewal checklist is the set of information an IT company gathers before renewal so underwriters can price and cover the risk properly. It matters because a late or patchy submission usually means narrower terms and less choice.
Part of: IT and technology business insurance
In short
Start 90 to 120 days before expiry. Gather revenue split by service line and territory, especially US revenue; your largest contracts and their liability caps; a claims, complaints and incident log; evidence of security controls; headcount; and any plans for acquisitions, investment or new services. Under the Insurance Act 2015 you must make a fair presentation of the risk, so disclose material circumstances clearly. Then ask your broker about limits, aggregation, exclusions, and whether tech PI and cyber should share a limit or sit separately.
For an IT company with £10m to £50m turnover, tech PI and cyber are usually the most negotiated lines in the programme. Underwriters will want detail on what you sell, who you sell it to, what you have promised in contracts, and how well your own systems are defended. A broker can only negotiate well with a complete, consistent submission in hand early enough to approach more than one market.
A sensible timetable is to begin gathering information 120 days out, have the submission with your broker by about 90 days, and allow the final month for negotiation and sign-off. The general approach in our business insurance renewal checklist applies; this page covers what is specific to technology professional indemnity and cyber.
A clean submission usually has three parts: completed proposal forms for each line, a short covering narrative explaining what the business does and what has changed in the year, and supporting documents such as financial statements, a contracts schedule and a security controls summary. The narrative is often the most useful part, because it lets underwriters understand context that a tick-box form cannot capture, such as why a service line has grown or how an incident was handled.
Commercial insurance in the UK is governed by the Insurance Act 2015. Under section 3, before the contract is entered into the insured must make a fair presentation of the risk. That means disclosing every material circumstance the insured knows or ought to know, in a manner reasonably clear and accessible to a prudent insurer. The duty generally applies again at renewal, because a renewal is usually treated as a new contract.
Section 7(4) gives examples of what may be material, including special or unusual facts relating to the risk and any particular concerns that led you to seek cover. Dumping thousands of pages on an insurer is not a fair presentation; the information must be organised so a prudent underwriter can find it. More detail is in our guide to the fair presentation duty.
| Item | What to provide | Why underwriters ask |
|---|---|---|
| Revenue by service | Software licensing, SaaS, managed services, consultancy, development, hardware resale, last year actual and next year forecast | Different services carry different claim patterns |
| Revenue by territory | UK, EU, US and Canada, rest of world, and where clients are domiciled | US exposure is commonly rated and worded separately |
| Top contracts | Ten largest clients, sector, contract value, liability cap, any uncapped or super-capped liabilities | Caps drive limit adequacy and contractual liability exposure |
| Claims and incidents | Five-year log of claims, complaints, disputes, service credit events, cyber incidents and near misses | The best guide to future losses |
| Security controls | MFA coverage, endpoint detection, privileged access, backups and recovery testing, patching, certifications | Drives cyber terms and sometimes tech PI terms |
| People | Headcount by function, use of contractors and offshore teams | Shows capacity and control over delivery |
| Corporate changes | Acquisitions, investment rounds, new subsidiaries, planned sale | Affects who is insured and run-off needs |
For the security section, the government-backed Cyber Essentials scheme from the NCSC is a common baseline. Cyber Essentials Plus adds independent technical testing of your systems. Our page on what cyber underwriters ask a mid-sized IT company sets out the detailed questions.
These examples are illustrative only.
A £22m managed services business signs a contract with a US-headquartered client two weeks before renewal and does not mention it. If a claim later comes from that client, the insurer may argue the presentation was not fair. Raising it early lets the broker seek appropriate territorial and jurisdiction cover. See US clients and tech E&O.
A software house had a ransomware attempt contained by endpoint tooling. It did not record it because nothing was lost. Underwriters often see a well-handled near miss positively, as evidence that controls work, but only if it is disclosed with the lessons learned.
An IT group is buying a smaller consultancy. The renewal needs to address whether the target is added, on what retroactive date, and whether the target's own policy needs run-off. See insurance when an IT company takes investment or is sold.
Apex arranges tech PI and cyber for IT and technology businesses and can run an insurance programme review ahead of renewal; a broker reads every enquiry.
Around 90 to 120 days before expiry is a sensible target for a business at £10m to £50m turnover. That allows time to gather contract and security information, prepare a clean submission, approach more than one insurer and negotiate wording. Starting a few weeks out usually limits the options available.
It is usually wise to. Under the Insurance Act 2015 you must disclose material circumstances you know or ought to know, and an attempted attack may be relevant to a cyber underwriter. A contained incident with clear lessons learned can also show that your controls work. Check too whether it needs notifying under your current policy.
Typically your largest client contracts, their value and sector, the liability cap in each, any uncapped or super-capped liabilities such as data protection or IP, and any indemnities or service credit regimes. Underwriters use this to judge whether your limit is adequate and whether you have taken on liability beyond negligence.
Not usually as a strict requirement, but it is a commonly recognised baseline. Cyber Essentials is a government-backed scheme run with the NCSC covering five technical controls, and Cyber Essentials Plus adds independent technical testing. Insurers more often ask about specific controls such as MFA, endpoint detection and backups.
Yes. Each renewal is generally treated as a new contract of insurance, so the fair presentation duty under section 3 of the Insurance Act 2015 applies again. Anything material that has changed since the last renewal, such as new services, territories, contracts or incidents, should be disclosed clearly.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
