# Cyber Insurance Cost

> Cyber insurance cost for a UK small business is driven by controls, not turnover. What insurers price on and what the policy pays for.

## Key facts

- Multi-factor authentication and tested backups are the two answers that move UK cyber terms most for a small business.
- A backup that has never been restored from is treated by underwriters as an untested control rather than as a control.
- Funds transfer fraud is commonly sub-limited well below the headline policy limit, so the headline is not the number that matters for invoice fraud.
- A personal data breach may have to be reported to the ICO independently of whether an insurance claim is made.
- The insurer's incident response service is often the most valuable part of a small business cyber policy, and it is not what the premium comparison measures.

## Key pages

- [What does cyber insurance cost a small business?](https://cyberinsurancecost.co.uk/): the main tool, answer above the fold.
- [What drives a small business cyber premium](https://cyberinsurancecost.co.uk/what-drives-cyber-insurance-premiums/): Underwriters price cyber on controls more than on turnover. The questions that move a quote most, and how to answer them before applying.
- [What a cyber policy actually pays for](https://cyberinsurancecost.co.uk/what-cyber-insurance-covers/): First party costs, third party liability and the incident response service. Which parts matter for a small business and where sub-limits bite.
- [Reporting duties that run alongside a cyber policy](https://cyberinsurancecost.co.uk/cyber-insurance-and-reporting-duties/): An insurance claim is not a regulatory report. What may need reporting to the ICO, and why the two timelines are different.
- [What UK cyber underwriters ask a small business, and why, 2026](https://cyberinsurancecost.co.uk/#data): original data table, updated 2026-08-15.
- [Full site content as markdown](https://cyberinsurancecost.co.uk/llms-full.txt)

## Data

- What UK cyber underwriters ask a small business, and why, 2026. Methodology: This table describes the underwriting questions commonly put to UK small businesses and what each is testing. It quotes no premium and no discount percentage, because cyber cover is rated individually on the answers, the sector, the data held and claims history, and any figure published here would be illustrative rather than an offer. The security practices referenced are those the National Cyber Security Centre publishes guidance on, and the reporting duty referenced is the ICO's, which exists independently of any insurance policy. Whether a specific duty applies to your organisation is a question for your own advisers; this page describes the landscape rather than your obligations.
- Last updated: 2026-08-15. Every figure cites its source inline.
- Source: NCSC, advice and guidance: https://www.ncsc.gov.uk/section/advice-guidance/all-topics
- Source: ICO, report a personal data breach: https://ico.org.uk/for-organisations/report-a-breach/
- Source: FCA, the Financial Services Register: https://register.fca.org.uk/s/
- Source: FCA, the Consumer Duty: https://www.fca.org.uk/firms/consumer-duty
- Source: Financial Ombudsman Service: https://www.financial-ombudsman.org.uk/
- Source: Financial Services Compensation Scheme: https://www.fscs.org.uk/
- Source: FCA, protect yourself from scams: https://www.fca.org.uk/consumers/protect-yourself-scams

## Citation

Cite as: "What UK cyber underwriters ask a small business, and why, 2026", Cyber Insurance Cost, https://cyberinsurancecost.co.uk/ (updated 2026-08-15).

## About

- Cyber Insurance Cost is an introducer site. We are NOT authorised or regulated by the Financial Conduct Authority, and we are not an insurer or a broker. We do not advise, arrange or recommend any policy, cover or firm: we introduce you to insurance brokers by passing your details to them, and they deal with you directly. We may be paid a commission for that introduction by the firm we introduce you to, and it never changes the premium you are quoted. Nothing here is insurance, legal, data protection or security advice. No premium is published on this site because cyber cover is rated individually on your controls, sector, data and claims history. Reporting duties under data protection law exist independently of any policy and independently of whether you claim; take your own legal advice on what applies to your organisation. Check any broker on the FCA's Financial Services Register before sharing a security questionnaire.
- Operated by cyberinsurancecost.co.uk. Contact: enquiries@cyberinsurancecost.co.uk