On this page
What security evidence does a small business need for cyber insurance?
Start with the insurer’s actual questions and the systems they cover. Where the form asks for them, gather dated records for your devices, account protection, backups, training and who handles an incident. Keep verified facts apart from gaps and planned changes.
Requirements differ from policy to policy. A security report on its own does not guarantee acceptance, cover or a successful claim.
What is cyber insurance?
What cyber insurance is.
A policy that can pay towards the cost of recovering after a security incident, and sometimes brings in people to help. Before it offers or renews one, the insurer asks how you protect your devices, accounts and data.
What it covers, and on which conditions, depends on the policy. Read it with your broker or adviser.
Where small companies stand
59%
of small and medium companies were attacked in the past twelve months. That is the risk an insurer is asked to cover, so its questions get specific.
Source: Hiscox Cyber Readiness Report 2025
4%
of companies count as fully prepared in Cisco’s yearly study. Most are still getting there, and an honest answer with dates is a good place to start.
Source: Cisco Cybersecurity Readiness Index 2025
Read the questions before you collect screenshots.
An application asks whether all work devices are protected. You know yours is. But what about the freelancer who joined last week? Another question asks about multi factor authentication, the second step when someone signs in. It could mean email, remote access or admin accounts. The word “all” can turn a familiar setting into a much wider business question.
Ask the insurer or broker to explain unclear wording and to say which systems are in scope. Keep that answer with the application. Then start an answer sheet: the question, the person responsible, the date of the evidence and any exception. Do not tick “yes” because you plan to fix a gap later. Describe where you stand today, and agree how an improvement should be reported.
Official guidance: NCSC (United Kingdom): cyber insurance guidance
answer sheet · renewal26.09.2026
| Question | Dated record | Gap or exception |
|---|---|---|
| Are all work devices protected?Owner: Ana | Protection on 4 of 4 company Macs, seen on 26.09.2026. | A contractor’s own laptop, used for client work, was not assessed. |
| Is multi factor authentication on?Owner: Luca | Email asks everyone for a second step, checked on 26.09.2026. | It may also mean admin accounts. Luca has asked the broker. |
| Are backups tested?Owner: Mira | The backup job ran on 26.09.2026. | Nobody has tried a restore yet. |
Group the evidence by what it actually proves.
For devices, gather the list of work computers and their records for protection, disk encryption and updates. For accounts, check the services the question names and how people really sign in. For backups, find out what is saved, where it is stored and whether anyone has tested a restore. Each group answers a different part of the question.
Training records show who completed which lessons. An incident plan names who handles a problem and how to reach them. A healthy laptop proves neither. Keep the records apart but easy to find, and use one date format throughout. Then the next person does not have to work out which screenshot belonged to which answer.
What is an incident response plan?
What an incident response plan is.
A short document that says who does what when something goes wrong: who decides, who to call, how to reach them and what to write down while it happens.
Insurance forms often ask whether you have one. It is a separate record from anything a laptop can show.
Write down the awkward exceptions.
Say four company Macs are checked, but a contractor works on client files from a laptop nobody assessed. The evidence covers four Macs. It does not cover everyone on the project. Record that difference, give someone the job of resolving it and ask how the insurer wants the exception shown. Hiding the gap makes the whole answer less reliable.
Or take a backup that ran without problems, although nobody has tried to restore it. Say what you know: the job ran, and the restore test is still open. A control that is planned, one that is switched on and one that was tested give three different answers. Keeping them apart shows the business its next step, instead of turning the form into a hunt for reassuring words.
A backup that ran is not a backup that was tested.
Make the renewal a review, not a new investigation.
Keep the submitted application, the evidence you used and your answers to any follow up questions in one place. Look at the records again when people, devices or important services change. Before the renewal, compare the current questionnaire with your current setup, because both may have changed since the last application. Ask the broker how to report a material change.
Go through the policy’s incident contact route, its exclusions and its conditions with the right adviser. Insurance can help a business recover, financially and in the way it operates. It does not prevent anything. So keep protection and recovery work going after the application is sent. What you want is a routine you can keep up, not a folder nobody opens until the next renewal.
Use device records for the device questions.
cybee’s Trust Passport is a dated record of technical controls on the assessed Macs. It can support your answers about those devices. For questions about accounts or training, check the separate Google Workspace and training records. A record of your Macs is not proof about every account or business process.
26.09.2026 09:45 · prepared for an insurance renewal
Four Macs. Every check holds. One day not observed.
- Macs protected
- 4 of 4
- Checks holding
- 118 of 118
- Days observed
- 89 of 90
| Control | Since |
|---|---|
| Disk encryption | since 12.03.2026 |
| Behavioural protection | since 12.03.2026 |
| Screen lock | since 26.09.2026 09:42 |
- Not observed: one Mac on 21.09.2026, offline.
- Not covered: your policies, your people, your cloud. Not a certification.
What exactly is a Trust Passport?
The Trust Passport.
The Trust Passport is a dated record of how your Macs are protected. Your client or insurer opens it through one link and sees what holds, since when, and what cybee could not see. It is not a certification or an audit, and it does not answer for your policies, your people or your cloud. It says so on the page.
Sealed means the record carries a fingerprint, a short code made from its content. Your client can compare it with the copy cybee sealed and see whether anything was changed afterwards. That shows the record was not edited. It does not check the facts a second time.
You still need to check the policy wording and answer for areas such as backups, suppliers and who handles an incident. cybee does not judge your eligibility, and it does not decide what an insurer accepts. It replaces guesses about your devices with a record you can inspect, and it leaves the other questions visible for the right person to answer.
What to remember.
- Work from the actual policy questions and what they cover.
- Date the evidence, and state the exceptions honestly.
- A device report supports specific answers. It does not establish insurance cover.
Sources and further reading.
Written by cybee for small teams. Product scope and provider guidance can change, so check the linked source for your own setup. The two figures under the short answer come from the Hiscox Cyber Readiness Report 2025 and the Cisco Cybersecurity Readiness Index 2025.
Know what the insurer will read.
Go through a Trust Passport line by line: the dates, the gap and what it does not cover.
