FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
Cyber underwriting for an IT company is the insurer's assessment of your security controls, client access and incident history before it sets terms. Your answers usually decide excess, sub-limits, conditions and whether cover is offered.
Part of: IT and technology business insurance
In short
Cyber underwriters assessing a UK IT company with £10m to £50m turnover commonly ask about MFA, endpoint detection and response, privileged access, tested backups, patching, remote access to client systems, email security and incident history. IT firms, especially MSPs, face more questions because one compromise can reach many clients. Certifications such as Cyber Essentials Plus help but do not answer everything; backups, for example, are not a scheme requirement. Answers must be accurate under the Insurance Act 2015 and usually drive the excess, sub-limits and conditions you are offered.
Cyber underwriters assessing an IT company with £10m to £50m turnover want evidence that the most common attack routes are closed and that the business can recover quickly. In practice that means multi-factor authentication, endpoint detection and response, control of privileged accounts, tested backups, prompt patching, and tight control of the remote access tools you use to reach client systems. Your answers usually decide whether you get cover, at what excess, with which sub-limits, and on what terms. For the wider buying picture, see cyber insurance for scaling tech companies.
IT companies are asked more than most because a compromise of your tools can reach many clients at once. That is why managed service providers and software businesses often face a longer proposal form than other firms of the same size.
| Area | What is commonly asked | Evidence that helps |
|---|---|---|
| Multi-factor authentication | MFA on email, remote access, cloud services, admin accounts and backups | Coverage figures, exceptions list, conditional access policy |
| Endpoint detection and response | Which tool, how many endpoints covered, who monitors alerts and out of hours | Deployment percentage, managed detection contract |
| Privileged access | Separate admin accounts, privileged access management, number of domain admins | Admin account count, access review records |
| Backups and recovery | Offline or immutable copies, separate credentials, how often restores are tested | Last restore test date and recovery time achieved |
| Patching | Time to patch critical vulnerabilities, end of life systems | Patch reports, vulnerability scan summaries |
| Supplier and client access | Remote monitoring and management tools, how client access is segregated and logged | Architecture summary, MFA on tooling, access logs |
| Email security | Filtering, domain authentication, staff training and phishing tests | Training completion, simulated phishing results |
| Incident history | Incidents, near misses and claims, what changed afterwards | Short incident log with lessons learned |
The questions on client access matter most for MSPs. If an attacker takes over a remote management tool, every connected client may be affected. That concentration is explained in one to many aggregation risk and managed service providers insurance. Proposed UK law on MSP security is tracked in the Cyber Security and Resilience Bill and MSPs.
Underwriters commonly ask whether you hold Cyber Essentials, Cyber Essentials Plus, ISO 27001 or a SOC 2 report, and what scope each covers. Certification helps, but it is not a substitute for answering the specific questions.
The NCSC describes Cyber Essentials as a combination of self-assessment and independent audit covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus has the same protections but with more rigorous, independent technical testing of whether the controls work in practice.
The NCSC Cyber Essentials requirements for IT infrastructure (v3.3) say authentication to cloud services must always use MFA, and that updates fixing vulnerabilities described as critical or high risk must be applied within 14 days. They also state that backing up data is not a technical requirement of the scheme, although it is highly recommended. Backups are one of the first things a cyber underwriter will ask about, so certification alone does not answer the question. More on how the scheme interacts with cover is in Cyber Essentials and cyber insurance.
For ISO 27001 and SOC 2, the scope is the point. A certificate covering only one product or office says little about the rest of the business, so describe the scope accurately.
Underwriters use answers to decide several things at once, subject to their own appetite:
Answers become part of the presentation of risk. Under the Insurance Act 2015, section 3 you must disclose every material circumstance you know or ought to know, and every material representation of fact must be substantially correct. An answer that says MFA is on everywhere, when one legacy system is excluded, is a misrepresentation that could affect a claim. Say what is true, and explain the exceptions and compensating controls.
The cost side is covered in cyber insurance cost for technology companies.
Start 90 to 120 days before renewal; see the tech PI and cyber renewal checklist for IT finance directors. For the wider programme, see insurance for mid-sized IT companies and IT and technology business insurance.
Apex arranges cyber and tech PI for IT companies and prepares the submission with you; a broker reads every enquiry.
Commonly: MFA coverage, endpoint detection and response, privileged access controls, backup and restore testing, patching times, how you access client systems, email security and incident history. IT companies, especially MSPs, are asked more because a compromise of their tools can reach many clients at once. Answers usually drive excess, sub-limits and conditions.
No. Cyber Essentials Plus shows that five technical controls have been independently tested, which helps. But underwriters also ask about areas the scheme does not require, such as backups, endpoint detection and privileged access management. The NCSC requirements state that backing up data is not a technical requirement of the scheme.
Because an attacker who takes over a remote monitoring and management tool may reach every client connected to it. That creates a large, correlated loss. Underwriters want to know that MFA protects the tool, access is segregated by client, activity is logged and monitored, and the tool is patched promptly.
Under the Insurance Act 2015, material representations of fact must be substantially correct. If an answer was wrong, the insurer's remedy depends on what it would have done with the correct information, which can range from applying different terms or reducing a claim proportionately to avoiding the policy in serious cases. Describe exceptions honestly and correct errors as soon as you find them.
Close the gaps underwriters focus on before renewal: MFA everywhere including remote tools and backups, EDR on all endpoints with monitored alerts, fewer privileged accounts, immutable backups with a recent restore test, and fast patching. Present clear evidence and a dated plan for anything still in progress.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
