Checklist for Cyber Insurance: Risk Assessment, Pricing and Premium

Cyber insurance is often treated as a financial safety net that a business purchases after implementing its cybersecurity controls. In reality, it should be part of a much broader conversation about risk, resilience and business continuity. Organisations increasingly depend on cloud platforms, external software providers, managed IT services and interconnected digital infrastructure, which means that a cyber incident does not have to originate inside their own network to cause significant disruption. A weakness in a supplier’s environment, a compromised cloud account or an outage affecting a widely used technology provider can affect an organisation’s ability to operate, even when its own systems have not been directly attacked.

This creates an important challenge for businesses reviewing their cyber insurance: what risks should be reduced, what risks can be transferred through insurance, and what risks will the organisation still have to absorb itself? Answering this question requires more than comparing insurance quotations. It means understanding the organisation’s technical environment, identifying dependencies, estimating the financial consequences of disruption and selecting coverage that reflects the risks the business actually faces.

A useful starting point is to identify the systems and services your organisation depends on, including cloud platforms, business applications etc. Consider what would happen if a critical system became unavailable or an attacker compromised an account with access to several services. Could your organisation continue operating, or would the disruption affect customers, revenue and essential business processes?

A second example could be: if your production systems and backups rely on the same cloud environment, a serious incident affecting that environment could weaken both your operations and your ability to recover. This was seen during global IT disruption caused by a faulty CrowdStrike software update in July 2024. This demonstrated how a problem involving a widely used technology component can disrupt organisations across multiple industries. Although it was not a cyberattack, it highlighted the importance of understanding technology dependencies and planning for service interruptions.

Cyber insurance may cover certain losses, but it does not automatically protect you against every cloud outage or supplier failure. Strong security, independent backups and recovery plans help reduce the risk, while carefully checking policy exclusions and business interruption coverage helps ensure you are not left carrying unexpected costs yourself. This is where risk transfer matters and where insurers assess factors such as the organisation’s size, industry, data sensitivity, claims history, security controls and dependence on critical technology services. Infrastructure and resilience also matter because they influence how disruptive and expensive an incident could become.

Imagine two organisations using the same cloud platform. One has independent backups, strong access controls and a tested recovery plan. The other depends on the same environment for its applications, administrative access and recovery resources. The second organisation may be more vulnerable to a single incident affecting multiple services. Depending on the insurer, its risk profile and the policy terms, this could contribute to a higher premium, a larger deductible or more restrictive coverage conditions. However, a higher premium is not automatically evidence of poor security, just as a lower premium does not guarantee adequate protection.

Before buying or renewing a policy, some important questions to ask could be: Have we identified our critical systems, sensitive data and third-party dependencies, Are multi-factor authentication, patch management and access controls consistently implemented, Are backups protected, independent where appropriate and regularly tested, Can we continue essential operations if a critical cloud or software provider becomes unavailable, Does the policy cover the cyber incidents and business interruption scenarios most relevant to us, Can we afford the deductible, and are important risks excluded or subject to lower sub-limits and Are the answers provided to the insurer accurate and supported by evidence?

In conclusion, cyber insurance should complement, not replace, cybersecurity and business continuity measures. A realistic risk assessment helps an organisation understand what it needs to protect, which risks it can reduce, which financial consequences it can transfer and which losses it must retain. Ultimately, the right policy is not necessarily the cheapest one. It is the policy that aligns with the organisation’s actual exposure, infrastructure and recovery capabilities.