Fast Cyber Essentials for cyber insurance

Insurance renewal dates are the least flexible Cyber Essentials deadline, because unlike a tender or a contract there is nobody on the other side with an incentive to move it. Before you buy, check one thing in the policy or the broker's request: whether it asks for Cyber Essentials or Cyber Essentials Plus. The second takes two to three weeks longer, and the wording is easy to skim past.

What insurers are actually asking for

Cyber insurers and brokers use Cyber Essentials as a proxy for basic control hygiene, because the five controls map closely onto the causes of the claims they pay. Expect one of these:

• A question on the proposal form. Answer it accurately. A misstatement here is a misrepresentation that can affect a claim, which is a far worse outcome than a higher premium.
• A condition precedent to cover. The policy will not respond unless you hold certification. This is the serious one, and it is worth reading carefully.
• A premium or excess incentive. Certification reduces the premium or the excess rather than gating cover.
• A subjectivity at renewal. Cover continues, subject to you certifying within a stated window, often 30 or 60 days.

Some UK cyber policies for smaller organisations bundle Cyber Essentials certification, and IASME includes cyber liability insurance with Cyber Essentials for UK organisations under a turnover threshold. Check what you already have before buying either twice.

The Cyber Essentials Plus trap in policy wording

Insurance wording, and what it requires from you

Wording	What you need	Lead time
"Cyber Essentials certification"	Verified self-assessment	Days to weeks
"Cyber Essentials Plus" or "independently audited"	Hands-on technical audit	Add 2 to 3 weeks for scheduling
"Cyber Essentials or equivalent"	IASME Cyber Assurance or ISO 27001 may satisfy	Ask the broker
"Maintained throughout the period of insurance"	Annual recertification	Diarise at 10 months

If the policy says Plus and your renewal is inside three weeks, tell your broker now. Insurers routinely grant a subjectivity period when they can see you are in assessment with a named certification body. They grant nothing at all if you go quiet and miss the date.

Certifying before a renewal date

1. Confirm which certification the wording requires, and whether it is a condition precedent or a subjectivity. These have very different consequences if you miss.
2. Take the gap analysis if you are not confident. £300, and it removes the risk of a failed submission close to a fixed renewal date.
3. Add urgent turnaround, £100, so assessment happens within one business day of you submitting.
4. Send the broker the certificate and the registry link. Underwriters increasingly verify rather than take a PDF at face value.

Do not let the deadline push you into a bad answer

The single worst outcome here is certifying on answers that are not quite true to hit a renewal, and then having a claim examined. Cyber Essentials is a self-assessment that you sign. If your MFA coverage has a gap, say so, fix it and certify late rather than certify on time and discover at claim stage that your cover was built on an inaccurate declaration. We will not pass a submission we know to be inaccurate, and any certification body that would is not doing you a favour.

Price

Cyber Essentials, Solusec pricing (excluding VAT)

Organisation size	Certification	+ urgent	+ gap analysis
Micro, 1 to 9 staff	£320	£420	£720
Small, 10 to 49 staff	£440	£540	£840
Medium, 50 to 249 staff	£500	£600	£900
Large, 250+ staff	£600	£700	£1,000

Common questions