Cyber Essentials and insurance: two questions people run together
“Does the certificate come with insurance?” and “will it help with my insurance?” are different questions with different answers — one belongs to IASME’s terms, the other to your insurer. Here are both, answered as far as honesty allows, with where to verify the rest.
Question 1: the insurance bundled with certification
The scheme has offered included cyber insurance to qualifying UK organisations that certify — historically subject to conditions such as where the head office is and a turnover threshold, with the cover level, excess and claims process set by IASME’s insurance arrangement, not by anyone who helps you prepare. We deliberately don’t restate the current eligibility rules or cover figures here, because they are IASME’s to change: check the certification pages and FAQ on iasme.co.uk (linked under Sources) at the moment you certify, and read the policy summary like any insurance document. Treat whatever is offered as a welcome extra — if included cover is the main reason you’re certifying, talk to a broker instead, because a bundled policy is unlikely to be shaped to your specific risk.
Question 2: what your own insurer wants
Cyber insurance proposal forms increasingly ask security questions that map closely onto the Cyber Essentials controls: is MFA enforced, are systems supported and patched, how is access controlled, what happens when someone leaves. Some insurers ask directly whether you hold the certificate; some price around it; some make specific controls a condition of cover. Two honest cautions. First, pricing is each insurer’s decision — nobody outside your insurer can promise the certificate lowers your premium. Second, and more important: answers on a proposal form are the basis of the contract, so claiming “MFA enforced everywhere” matters in exactly the way claiming it to an assessor does. Certifying first means those answers have been reviewed by an assessor before they’re underwritten.
Where the certificate genuinely helps
- Form-filling with evidence: one certificate answers a page of security questions, on a public register the insurer can verify.
- Fewer incidents to claim for: the controls target the common attacks — password guessing, unpatched software, malware — that generate small-business claims in the first place.
- A cleaner claims position: if the worst happens, being able to show the baseline was certified and maintained is a better conversation than discovering a proposal-form answer was optimistic.
What this page won’t do
We’re not insurance advisers and this isn’t advice on whether, or how much, to insure — that’s a judgement about your residual risk, best made with a broker. What we can say: the certificate and the controls behind it make you a more legible risk, whichever way that judgement goes. If a renewal form has just landed and prompted all this, the step-by-step guide is the route to being able to answer it truthfully.
Frequently asked questions
Does Cyber Essentials come with free insurance?
The scheme has offered included cyber insurance to qualifying UK organisations, subject to eligibility conditions and terms set by IASME and its insurance partner — not by ReadyCert. Verify the current offer, conditions and cover level on iasme.co.uk before relying on it.
Will Cyber Essentials lower my cyber insurance premium?
Sometimes. Insurers increasingly ask whether you hold it, and some price around it or expect the controls it certifies — but pricing is each insurer’s decision. What the certificate reliably does is let you answer their security questions with evidence.
Is the included insurance a reason to certify?
Treat it as a bonus, not the business case. The commercial case is contracts and clients; the security case is the controls themselves. Any bundled cover has conditions and limits you’d need to read like any policy.
Do I still need separate cyber insurance?
That’s a judgement about your risk, not a certification question — and we’re not insurance advisers. Cyber Essentials reduces the chance of the common incidents; whether to insure the residual risk is between you and a broker.