Questions · 12 November 2026 · By Dorian, founder

The insurance form asks about cyber security. What do we answer?

Cyber insurance forms, and some other business policies, ask the same handful of questions. Answer what is true today. The Insurance Act 2015 asks a business to give the insurer a fair presentation of the risk: a wrong answer can reduce what a claim pays, or void the policy.

The questions, in plain words

Is multi-factor authentication on for email and remote access?

A second step, a code or an app, when someone signs in to email or connects to the office from outside. Answer yes only if every account has it, the admin accounts included.

Do you back up, keep a copy separate, and test restores?

A copy an attacker cannot reach from your network, and proof that you have restored from it. A backup nobody has restored from is only a hope.

Are security updates installed within 14 days?

Laptops, phones, the router and the website. Fourteen days is also the Cyber Essentials rule for critical and high-risk updates.

Do you use anti-malware and a firewall?

Switched on and up to date on every computer. Built-in protection usually counts if it is on and current.

Are staff trained to spot phishing?

People know what a fake login page or a fake invoice looks like, and whom to tell. A short session once a year, with the date written down, is a fair start.

Do you check payment requests and changed bank details by phone?

Before paying new bank details, call the supplier on a number you already have, never the one in the email.

Do you hold Cyber Essentials?

The government-backed certificate for five technical basics: firewalls, secure settings, user accounts and access (multi-factor authentication included), malware protection and security updates. It does not cover backups or training. Some insurers ask for it.

Before you answer yes

• If an answer is no today, say so, and say when it will be done.
• Keep the evidence: a screenshot of each setting, the last restore test, the training date.
• This page is general information, not insurance advice. Your broker or insurer decides what each question covers.

How DARCH helps

For every DARCH client, encrypted backups run every night and a restore is tested every month.