Cyber insurance and penetration testing

The NCSC’s cyber insurance guidance explains that insurers may ask about your security controls, covering technical, procedural and human measures, when you apply and when the policy is reassessed at renewal. The responsibility for keeping those answers accurate sits with you, and the NCSC warns that misstating your controls could mean a claim is not paid.

That makes the proposal form a security document. Each answer, whether about multi-factor authentication, updates, backups or remote access, is a statement you may later have to stand behind.

• Check your answers are true. An external test shows what is exposed to the internet, so your answers about it rest on evidence.
• Find gaps before renewal. Testing ahead of renewal gives you time to fix issues before you answer the questions again.
• Provide evidence if asked. A recent report, with fixes and a retest, shows the insurer what you tested and what you did about it.
• Show baseline controls. Cyber Essentials Plus independently verifies five baseline controls, and the NCSC notes some insurers offer discounts for recognised defences such as Cyber Essentials.

The NCSC’s penetration testing guidance describes a test as a snapshot in time, so keep testing as part of your routine rather than once for the insurer.

According to the NCSC’s Cyber Essentials overview, eligible small organisations that certify their whole organisation to Cyber Essentials are entitled to cyber liability insurance arranged through IASME. That cover has its own limits and conditions, so read it alongside any other policy you hold, and check the current eligibility with your certification body.

The NCSC suggests checking what a policy excludes as well as what it covers. In particular:

• Exclusions: some policies do not cover money lost through business email compromise fraud, for example.
• Limits, and whether claims from third parties are covered.
• Which incident support comes with the policy, such as forensic, legal or public relations help.
• Any security conditions you must keep meeting during the policy, including testing.

If a condition mentions penetration testing, ask your broker what scope and frequency it means, then use the scoping template so every firm quotes for that.