Checklist: taking out cyber insurance without jeopardising cover
For: Management and IT leads in SMEs
Updated: 2026-11
Cyber insurance is taken out properly in seven steps: clarify needs and risks, implement the baseline measures the insurer requires, answer the questionnaire honestly and checked by IT, compare cover and limits, understand exclusions, add emergency rules to the incident response plan and keep evidence current.
Insurers now require a minimum security standard and check it via questionnaires. False answers can cost cover in a claim.
This checklist describes preparation from the company’s perspective. It does not replace advice from an insurance professional.
The checklist
- 01
Clarify needs
Record which systems and data are business-critical and what damage an outage would cause.
Done when: A short overview lists critical systems, data and estimated consequences of an outage.
- 02
Implement baseline measures
Ensure MFA for email and remote access, backups with an offline copy, current updates and endpoint protection.
Done when: The usual requirements are implemented and documented with dates.
- 03
Answer the questionnaire honestly
Have IT check the answers and state gaps openly rather than glossing over them.
Done when: Every answer is confirmed by IT and evidence is filed.
- 04
Compare cover
Compare own damages, business interruption, liability, crisis communication and limits across offers.
Done when: A comparison of offers with cover components and limits exists.
- 05
Understand exclusions
Read exclusions, deductibles and obligations, for example on extortion, war or missing updates.
Done when: The main exclusions and obligations are summarised in writing.
- 06
Adopt emergency rules
Add the emergency number and notification duties towards the insurer to the incident response plan.
Done when: The plan names the emergency number, notification deadlines and who informs the insurer.
- 07
Keep evidence current
When IT changes, check whether the information given to the insurer is still correct.
Done when: An annual review of the information is scheduled.
Common mistakes
- —Answering the questionnaire too optimistically and being left without cover in a claim.
- —Comparing only premiums, not cover and exclusions.
- —Engaging your own providers first in an emergency although the policy requires calling the insurer.
- —Treating insurance as a substitute for security measures.
What this checklist does not cover
- —The checklist does not replace advice from an insurance professional.
- —Cover and terms differ widely between providers and change constantly.
- —Statutory reporting duties apply regardless of insurance.
Parent service: Cyber readiness & IT security
FAQ
Is cyber insurance worthwhile for small companies?
Often yes, because an incident without insurance can threaten the business. What matters is that cover fits the risk.
Does insurance pay ransoms?
It depends on the policy and applicable law. Many companies rely on restoring from backups anyway.
What happens with false information?
The insurer may reduce or refuse payment. Answers should therefore be checked and evidenced by IT.
More checklists
Checklist: securing MCP servers and AI agents
An MCP server is secured in seven steps: narrowly limit the use case, grant least privilege per tool, use dedicated credentials instead of shared accounts, tie consequential actions to human approval, treat content from external sources as data, log all calls and introduce new servers through an approval process.
Checklist: creating a first business continuity plan
A first business continuity plan is created in seven steps: identify critical processes, assess the impact of an outage, set recovery objectives, describe fallback procedures for each critical process, make contacts available offline, exercise the plan and update it regularly.
Checklist: optimising a Google Business Profile
A Google Business Profile is optimised in seven steps: verify the profile, choose the right primary category, record name, address, phone and opening hours correctly, describe services, upload real photos, gather and answer reviews fairly and keep details consistent with website and directories.