In short
Cyber Essentials insurance is the cyber liability cover, including a 24-hour incident response helpline, that IASME arranges for organisations domiciled in the UK or Crown Dependencies with turnover under 20 million pounds that certify their whole organisation and opt in when they apply. IASME publishes the limit of indemnity as 25,000 pounds.
Get a quote for Cyber Essentials certification support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the included insurance is
When an eligible organisation certifies to Cyber Essentials and opts in, it is entitled to cyber liability insurance arranged by IASME, the NCSC's Cyber Essentials Delivery Partner. The NCSC confirms the entitlement on its own Cyber Essentials pages. It comes with the certification rather than being bought separately.
The policy includes a 24-hour incident response helpline that puts policyholders in touch with technical, legal and crisis management support. IASME and the NCSC both give the limit of indemnity as 25,000 pounds, and IASME notes that higher limits can be bought for an annual premium. IASME names Sutcliffe & Co as the insurance broker for queries about the cover.
We do not summarise the policy wording, excess or exclusions here, because they are set by the insurer and can change. Read the current terms and conditions on IASME's website before you rely on the cover.
Who qualifies
| Condition | What it means |
|---|---|
| Domiciled in the UK or Crown Dependencies | IASME's eligibility rule; the NCSC describes it as any UK-based organisation |
| Turnover under 20 million pounds | Organisations above that turnover are not eligible for the included policy |
| Whole-organisation scope | The certification must cover the entire organisation; a certificate for a sub-set does not qualify |
| You opt in | You choose the insurance during the application, where the question set asks whether you want it |
If you are weighing up a whole-organisation scope against a sub-set, the insurance is one more reason to certify everything you can. See Cyber Essentials scope for the rules.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Cyber Essentials Plus and renewal
The included cover comes with Cyber Essentials certification. Cyber Essentials Plus builds on a current Cyber Essentials certificate, so check IASME's insurance page for how the cover applies to Plus holders and how it relates to your certificate dates.
Certificates expire after 12 months, so plan your Cyber Essentials renewal to avoid a gap in certification.
What it does not replace
The included policy is a useful starting point, not necessarily all the cover an organisation needs. Organisations that handle a lot of sensitive data, or whose contracts require specific insurance, should check the limits and exclusions against their own risks and talk to an insurance broker about standalone cyber insurance. Forever Systems is not an insurer or broker and does not give insurance advice.
Insurers offering standalone cyber cover may ask about controls beyond the five Cyber Essentials controls, as well as the ones it covers. Two examples:
- MFA on email, remote access and admin accounts, which Cyber Essentials already requires for cloud services; see MFA for cyber insurance
- Staff training on phishing and social engineering, which Cyber Essentials does not assess; see cyber insurance security awareness training
Backups and incident response plans are common questions too, and neither is a Cyber Essentials technical requirement.
Is Cyber Essentials certification support the right fit for you?
We will check it against your systems and requirements and recommend the right option, with no obligation.
How we help
Forever Systems prepares organisations for Cyber Essentials and supports them through assessment alongside an IASME-licensed Certification Body. We get the controls in place, including MFA, patching and malware protection, so you can certify your whole organisation and answer security questionnaires with confidence. For fees, see Cyber Essentials certification cost. Contact us to get started.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
Does Cyber Essentials come with insurance?
Yes, for eligible organisations. IASME arranges cyber liability insurance, including a 24-hour incident response helpline, for organisations domiciled in the UK or Crown Dependencies with turnover under 20 million pounds that certify their whole organisation and opt in. IASME's insurance page has the current terms.
Who is eligible for Cyber Essentials insurance?
Organisations domiciled in the UK or Crown Dependencies, with turnover under 20 million pounds, that certify their whole organisation and opt in during the application. A certificate that covers only a sub-set does not qualify.
Does Cyber Essentials Plus include insurance?
The included cover comes with Cyber Essentials certification, which Plus builds on. Check IASME's insurance page for how it applies to Plus holders and how it relates to your certificate dates.
How much cover does the Cyber Essentials insurance provide?
IASME and the NCSC give the limit of indemnity as 25,000 pounds, and IASME says higher limits can be bought for an annual premium. The excess and exclusions are in the policy terms, which can change, so read the current terms on IASME's website and compare them with your own risks.
Is the included insurance enough on its own?
It depends on your organisation. IASME itself notes that the included limit may suit a small incident but not a serious one or more than one. Check the limits and exclusions against your risks and contracts, and speak to an insurance broker if you need more cover.
Still have a question about Cyber Essentials certification support?
Ask us and a member of our team will reply by email.