Cyber insurance
Cyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware. Cyber Essentials includes free cyber liability cover for organisations with a UK or Crown Dependencies head office, turnover under £20 million and whole-organisation scope that opt in. A3.1 to A3.3 cover it and do not affect your result.
- Term
- Cyber insurance
- Also known as
- cyber liability insurance, included cyber insurance
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term cyber insurance mean in Cyber Essentials?
Cyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware.
How does cyber insurance apply to Cyber Essentials?
In plain terms
It works like buildings insurance, but for IT disasters. If criminals lock your files or steal customer data, the policy helps pay for recovery, specialist help and some of the knock-on costs, up to its limit.
What Cyber Essentials asks
The insurance section of the Danzell question set says eligible organisations "can opt into automatic cyber insurance if they achieve Cyber Essentials certification" and that "The insurance is free of charge". A3.1 checks eligibility: a head office domiciled in the UK or Crown Dependencies and gross annual turnover under £20 million. A3.2 is the opt-in or opt-out, and A3.3 asks for the email address the broker should use. The guidance states: "The answers to these questions will not affect the result of your Cyber Essentials assessment." The NCSC describes the cover as available to UK organisations under £20 million turnover that certify their whole organisation, with a 24-hour helpline to report an incident and a total liability limit of £25,000.
Common mistakes
Treating the included cover as a full insurance programme. It supplements a standalone policy rather than replacing one. Another is a late or unsigned declaration: the question set asks for board-level sign-off "to avoid any delays to the insurance policy being issued".
Insurers may also ask for Cyber Essentials when you buy a separate policy. A1.10 lists "required by insurer" as one of the reasons for applying.
See Cyber Essentials and cyber insurance, whole-organisation scope and the insurance questions.
Related terms
- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
- Danzell question setThe Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
- Def Stan 05-138Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.
- DSPT (Data Security and Protection Toolkit)The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
- EvidenceEvidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
Frequently asked questions
Cyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware.
In the 2026 Danzell question set, cyber insurance comes up at A3.1, A3.2, A3.3. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.