Questions insurers commonly ask
- Is multi-factor authentication switched on for email and remote access?
- Do you take regular backups, stored separately, and have you tested restoring them?
- Are systems patched and supported?
- Do staff get phishing awareness training?
- How do you verify changes to supplier or customer bank details?
Free starting points
In the UK, the NCSC’s Small Business Guide and Cyber Essentials scheme set out the basics. In the US, CISA publishes free resources for small businesses. Working through them helps with insurer questions and reduces risk.
Invoice fraud and social engineering
Some of the most common losses involve fake invoices or emails convincing staff to pay into a criminal’s account. Many cyber policies cover this only as an optional extra or with a lower limit. Check the wording, and use call-back checks on known numbers before changing payment details.
Breach reporting
Under UK GDPR and EU GDPR, reportable personal data breaches must be notified to the regulator within 72 hours of becoming aware. A good cyber policy gives you fast access to legal and forensic help to meet that deadline. See our cyber insurance guide.
Last updated: 8 October 2026
