Cyber Insurance Readiness

Why Cyber Insurance Has Become Harder to Obtain

The cyber insurance market has hardened significantly over the past three years. Following a wave of large ransomware claims, insurers have overhauled their underwriting criteria. What was once a relatively straightforward policy renewal — tick a few boxes, confirm you have antivirus — has become a detailed technical assessment of your organisation's security controls.

For many SMEs, this has come as a shock. Firms that have held cyber insurance for years are finding that their existing controls no longer meet the standard their insurer now requires. Premiums are rising sharply, excesses are increasing, and coverage is being narrowed. Some businesses are being declined or offered cover with exclusions that make the policy of limited value.

The businesses most at risk are those whose IT has grown organically — decent controls, broadly speaking, but not documented, not consistently applied, and not something you could explain to an underwriter in a 30-minute call. That is exactly where Northstar works.

Insurers are not looking for perfection. They are looking for evidence that someone is paying attention — that IT risk has a named owner, that controls are in place and tested, and that the business would know what to do if something went wrong.

What Insurers Are Looking For

Modern cyber insurance applications go well beyond basic questions about antivirus and backups. Underwriters are now asking detailed questions about your security controls, and the answers carry real weight in both the decision to offer cover and the premium you pay.

The controls most commonly scrutinised at renewal include:

• Multi-Factor Authentication: MFA on email, remote access, cloud platforms and privileged accounts is now a near-universal requirement. Firms without it are frequently declined or face significant premium loadings.
• Endpoint Detection and Response: Basic antivirus is no longer sufficient. Insurers expect EDR tooling that can detect, contain and respond to threats — not just flag known malware signatures.
• Privileged Access Controls: Who has admin rights across your systems? Insurers want to see that privileged access is restricted, audited and reviewed — not handed out as a convenience.
• Patch Management: A documented, timely patching process — for operating systems, applications and network devices — is a baseline expectation. Ad hoc patching is a red flag.
• Backup and Recovery: Tested, offline or immutable backups with documented recovery time objectives are expected. Insurers are alert to backup infrastructure that is itself vulnerable to ransomware.
• Incident Response Planning: A written, tested incident response plan — naming who does what, how the business communicates, and who contacts the insurer — is increasingly required, not merely recommended.
• Cyber Essentials Certification: Several insurers now offer preferential terms for Cyber Essentials certified organisations, and some require it outright for certain sectors or coverage levels.
• Third-Party and Supply Chain Risk: Underwriters are asking about your suppliers and whether you have assessed the IT risk they introduce. A breach via a supplier is still a claim on your policy.

The Two Situations We Most Commonly See

Businesses come to Northstar for cyber insurance readiness support from one of two positions.

Approaching renewal: The policy is due in the next three to six months. The business knows the questions are getting harder and wants to get ahead of the process — ideally achieving the controls that reduce the premium rather than simply hoping the renewal goes smoothly. This is the better position to be in, and the one where Northstar's support delivers the most value.

After a difficult renewal: The business has just received a premium increase it cannot justify, been declined cover, or been offered a policy with exclusions that make it inadequate. The immediate need is to understand what the insurer's concerns were, address them substantively, and either go back to the same insurer or approach the market in a stronger position.

In both cases, the work is the same — an honest assessment of where the business stands against the controls insurers expect, a clear remediation plan, and the IT governance evidence needed to support the application. What differs is the urgency.

How Northstar Approaches Cyber Insurance Readiness

Northstar's cyber insurance readiness engagement starts with a structured review of your current IT controls against the criteria commonly applied by UK cyber insurers. We use the Cyber Essentials framework as a baseline — it maps directly to insurer expectations and also provides an independent certification that carries weight in its own right — but our review goes further where insurers require it.

We produce a clear written report identifying gaps, prioritising remediation by risk and renewal timeline, and providing the language and evidence needed to answer insurer questions accurately and credibly. Where controls need to be implemented or improved, we can either manage that work directly or work alongside your existing IT supplier to ensure it is done properly.

We also prepare a cyber insurance readiness summary — a short, structured document you can provide to brokers and underwriters that sets out your controls clearly and demonstrates board-level ownership of cyber risk. This alone materially improves how insurers view an application.

Because Northstar is entirely independent — no vendor relationships, no managed service contracts — we have no interest in recommending tools or services beyond what your situation genuinely requires. Our recommendations are driven by your renewal needs and your budget, not by margins.