Sound familiar?
- Your broker has sent a long security questionnaire
- You are not sure whether 'MFA on all remote access' is true
- Your renewal premium went up or cover was declined
- The insurer asks about EDR and you only have antivirus
- You cannot say when backups were last tested
- You want Cyber Essentials but do not know where to start
Key facts
- Insurer questionnaires commonly ask about MFA, backups, EDR, patching and admin accounts
- An answer that turns out to be untrue can put a claim at risk
- Cyber Essentials v3.3, in force from 27 April 2026: MFA always required on cloud services
- Cyber Essentials: critical and high-risk updates (CVSS 7 or above) within 14 days
- UK organisations under £20m turnover certifying their whole organisation get cyber liability insurance through IASME, per the NCSC
- The NCSC's cyber insurance guidance suggests putting basic controls such as Cyber Essentials in place first
- Review: £45 an hour + VAT; ongoing upkeep in the Complete plan, £99 a month + VAT
Why the questionnaire matters
Cyber insurers price and accept risk based on what you tell them. The proposal form or questionnaire asks yes or no questions about your security, and those answers become part of the basis of the policy. The NCSC's cyber insurance guidance makes the point that if security measures the insurer relies on are not actually in place, the insurer may not be obliged to pay a claim. Ticking yes to "MFA on all email accounts" when the shared finance mailbox has no MFA is exactly the kind of gap that causes trouble after an incident.
We do not sell insurance or advise on policies. We make sure your honest answers can be yes.
The controls insurers usually ask about
Questions vary by insurer, but these come up again and again:
- Multi-factor authentication on email, on remote access such as VPN or remote desktop, and on every admin account. See password and MFA setup.
- Backups that are separate from your main systems, ideally offline or immutable, and tested by actually restoring something. See data backup and recovery and Microsoft 365 backup.
- Endpoint detection and response (EDR) rather than basic antivirus alone. See antivirus and endpoint protection.
- Patching within a set number of days, and no unsupported software such as Windows 10 without extended updates.
- Admin rights limited to separate admin accounts, not everyday logins.
- Email filtering and SPF, DKIM and DMARC. See email security.
- Staff training on phishing, and a written incident response plan with the insurer's helpline in it.
- Payment verification for changes to supplier bank details, to stop invoice fraud.
Cyber Essentials covers much of this
Cyber Essentials, the government-backed scheme run by the NCSC with IASME, sets out five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Version 3.3 of the requirements, in force from 27 April 2026, says authentication to cloud services must always use MFA, and that critical or high-risk updates, those with a CVSS v3 score of 7 or above, must be applied within 14 days of release. It also says cloud services cannot be left out of scope.
The NCSC says any UK organisation with a turnover under £20m that certifies its whole organisation is automatically entitled to cyber liability insurance arranged by IASME, including 24/7 incident response. Check the current terms with IASME, as this is limited cover and may not replace a full policy. The NCSC also notes that some insurers offer discounts to certified organisations. Our Cyber Essentials readiness service gets you ready for the assessment; we are not a certification body.
How we get you ready
- Read the questionnaire from your broker or insurer with you, question by question.
- Check the reality: Microsoft 365 MFA and Conditional Access reports, device patch status in Intune or your management tool, backup logs, admin role assignments.
- List the gaps in plain English, with the effort to close each one.
- Fix them: enforce MFA, turn off legacy authentication, set up tested backups, move to EDR, set patching rules, separate admin accounts.
- Write it down: a short record of what is in place and when it was checked, which helps with the insurer and with Cyber Essentials.
You answer the questionnaire yourself; we give you the facts to answer it accurately. For a wider review, see our security audit.
Pricing
A questionnaire review and gap list usually takes a few hours at £45 an hour + VAT. Fixes are charged the same way, or quoted for larger work such as replacing old servers. Keeping the controls in place month to month, with patch checks, backup tests and Microsoft 365 helpdesk support, fits the Complete plan at £99 a month + VAT, which includes 3 hours of work. Background: our Cyber Essentials explained guide.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
What do cyber insurers usually ask small businesses?
Common questions cover MFA on email, remote access and admin accounts, backups that are separate and tested, EDR on devices, how quickly updates are applied, unsupported software, admin rights, staff training and how you verify payment changes. dijitul checks each one against your real systems.
Does Cyber Essentials include insurance?
The NCSC says UK organisations with turnover under £20m that certify their whole organisation are automatically entitled to cyber liability insurance arranged by IASME, with 24/7 incident response. Check IASME's current terms and whether you need more cover.
What is EDR and do insurers require it?
Endpoint detection and response watches devices for suspicious behaviour, such as ransomware starting to encrypt files, and can isolate a device automatically. Many insurer questionnaires ask about it. dijitul can deploy it, often using Microsoft Defender for Business where licensing allows.
What happens if I answer the questionnaire wrongly?
The NCSC warns that if the security measures an insurer relies on are not in place, it may not be obliged to pay a claim. It is better to fix a gap, or describe it honestly, than to tick yes and hope.
How long does it take to get ready?
A review takes a few hours. Simple fixes like enforcing MFA can be done the same week. Replacing old systems or moving to EDR across every device takes longer. dijitul gives you a prioritised list at £45 an hour + VAT.
Do you sell cyber insurance?
No. dijitul is an IT support company, not an insurer or broker, and we do not advise on which policy to buy. We make sure the security controls you tell your insurer about are really in place.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.