Cyber insurance, and the free cover that comes with Cyber Essentials

Many small businesses don't realise that Cyber Essentials can come with free cyber insurance. Here's how it works, and what cyber insurance covers.

The free £25,000 of cover

When a UK business certifies to Cyber Essentials, it can opt in to £25,000 of cyber liability insurance at no extra cost, arranged by IASME, if it meets these conditions:

• It's based in the UK or the Crown Dependencies.
• Its annual turnover is under £20 million.
• The whole organisation is certified, not just part of it.
• It opts in during certification.

The cover includes access to incident response support. Higher limits can be bought as a paid upgrade through IASME's broker, Sutcliffe & Co.

What cyber insurance usually covers

• Incident response: experts to contain an attack and get you running again.
• Data recovery and rebuilding systems.
• Business interruption: lost income while you're down.
• Liability if customers' or staff data is affected, plus legal and notification costs.

Policies vary a lot, so check the limits, the excess and the exclusions. Paying a ransom, social-engineering fraud and failing to keep systems updated are common areas with conditions attached.

What insurers expect from you

Insurers increasingly ask about basic controls before they'll offer cover or a good price. The usual questions are about multi-factor login, backups, updates and malware protection. These are the same things Cyber Essentials checks, which is why certification tends to make insurance easier to get.

Almost half of UK businesses (47%) reported having some form of cyber insurance in the 2025/26 Cyber Security Breaches Survey.

Is £25,000 enough?

For many micro and small businesses with modest amounts of data, the free cover is a useful safety net. If you hold a lot of personal data, take card payments online, or couldn't afford to be offline for a week, speak to a broker about higher limits. Treat the free cover as a first layer.