Cyber Essentials and cyber insurance

What insurance comes with Cyber Essentials?

Cyber Essentials comes with free cyber liability insurance for eligible UK organisations that opt in; the Danzell question set states there is no additional cost.

Every Cyber Essentials self-assessment certificate can carry cyber liability insurance at no extra cost, provided the organisation is eligible and opts in. The cover has a £25,000 limit and includes a 24/7 incident response helpline. It is arranged through the scheme, the Danzell question set states there is no additional cost, and the scheme fee of £320 to £600 ex VAT is the only payment. IASME's cyber liability insurance page sets out the eligibility rules and the broker's contact details.

Section A3 of the question set handles it. A3.1 asks whether your head office is domiciled in the UK or Crown Dependencies and whether gross annual turnover is under £20 million. A3.2 asks whether you want to opt in. A3.3 asks for the email address the insurance documents should go to.

Who is eligible for the included cyber insurance?

An organisation is eligible if its head office is in the UK or Crown Dependencies, its turnover is under £20 million (A3.1), it certifies the whole organisation, and it opts in (A3.2).

Four conditions, all of which must be true:

The scope condition catches people out. A certificate for a defined sub-set, for example one office or one business unit, does not carry the insurance. If the included cover matters to you, that is a reason to certify the whole organisation.

What does the included cover include?

It is a cyber liability policy that IASME describes as having a £25,000 limit and a 24/7 incident helpline; the policy document sets the exact terms.

The policy is a cyber liability policy with a £25,000 limit and a helpline you can call at any hour when you suspect an incident. The insurer's policy document defines the insured events, exclusions and any excess, and you should read it when it arrives rather than rely on a summary.

How does Cyber Essentials affect a standalone policy?

It can make a standalone policy easier to obtain, because insurers ask about the same controls, but any discount depends on the insurer.

Proposal forms commonly ask about the same controls Cyber Essentials checks: MFA, patching, supported software and administrator accounts. A current certificate gives you a tested set of answers, dated, that you can give the broker. Some insurers offer discounts for certified organisations, according to the NCSC's cyber insurance guidance; ask yours.

The NCSC Annual Review 2025 reports that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance, based on data from the Cyber Essentials insurance company (NCSC Annual Review 2025).

Does Cyber Essentials Plus change the insurance?

No. Cyber Essentials Plus does not add to the included cover. The included cover attaches to the self-assessment certificate on the same terms whether or not you also hold Plus. Plus provides independent technical evidence, which is useful when a broker or insurer wants more than a declaration. The £25,000 included cover does not increase.

How do you make sure the cover is in place?

Answer A3.1 accurately, opt in at A3.2 and give a monitored mailbox at A3.3.

Then file the policy document when it arrives. Add the certificate expiry date to the same reminder as the insurance renewal, because the cover runs with the certificate and lapses when it does. When you renew, opt in again.