For many UK SMEs, a cyber insurance renewal is becoming a practical test of how well the organisation understands its own IT. Brokers and insurers may ask not only what security controls are in place, but how they are evidenced, maintained and tested.
That does not mean every insurer requires the same certifications or controls. Requirements depend on the insurer, policy and organisation. But the direction is clear: vague assurances are less useful than current, specific answers backed by evidence.
The National Cyber Security Centre’s guidance on cyber insurance notes that policies are commonly reassessed and that organisations should keep security information accurate and up to date. If a declared control is not actually in place, that may affect a claim. A renewal is therefore a good point to check whether the systems, suppliers and processes you rely on match what you intend to tell your broker.
Start with evidence, not a last-minute questionnaire
Before renewal discussions begin, gather a clear view of your technology estate: the systems that support the business, who owns them, which suppliers manage them and what would happen if they became unavailable.
For each important control, record its owner, the evidence available, when it was last reviewed or tested, and any gaps that need attention. Evidence might include current policies, access reviews, backup reports, recovery-test records, software inventories and supplier responsibilities.
This is not a box-ticking exercise. It helps decision-makers understand where operational risk sits and gives the broker more reliable information to work with. Ask your broker which questions and evidence the insurer wants: there is no single questionnaire that applies to every policy.
Cyber Essentials and ISO 27001: useful frameworks, not shortcuts
Cyber Essentials and ISO 27001 are relevant consultancy domains supported by Evestaff’s sister practice. They offer different ways to organise and demonstrate security work, but neither should be treated as a guarantee of insurance cover or a substitute for answering the insurer’s questions accurately.
The NCSC describes Cyber Essentials as a certification scheme built around five technical control areas: firewalls, secure configuration, security updates, user access control and malware protection. Cyber Essentials Plus includes independent technical testing. Certification can give an organisation a structured baseline and supporting evidence, while also helping it identify improvements.
ISO 27001 provides a framework for managing information security risks through an information security management system. For a renewal, useful evidence may include the certificate and its scope, relevant audit findings, risk treatment actions and records showing that controls are being reviewed. A certificate is only meaningful in context: the insurer may want to know whether its scope covers the business, systems and locations being insured.
The important distinction is between having a framework and operating the controls it describes. Keep certification current, understand its limits and disclose any relevant exceptions or outstanding actions.
Disaster Recovery: show that recovery works
A backup job reporting “successful” is useful, but it does not by itself prove that the business can recover. Insurers and brokers may ask whether Disaster Recovery arrangements are documented and tested. Businesses should be ready to explain what is backed up, how it is protected, who can access it and when a restoration was last tested.
Start by identifying the systems and information the organisation needs to operate. Then document recovery priorities, responsibilities and dependencies. A recovery plan should make clear what happens if key systems, cloud services or a supplier become unavailable, and how the business will make decisions while normal tools are offline.
Test restoration of important data and systems, record the outcome, and track any problems through to resolution. A practical test report can state what was restored, when it happened, who took part and what needs improving. This gives management a more useful view than a backup dashboard alone.
The NCSC also advises organisations to consider keeping backups separate from the network. Its cyber insurance guidance explains that separate backups can reduce the impact of ransomware. Evestaff’s Disaster Recovery consultancy can support businesses reviewing their recovery arrangements.
Ageing finance systems deserve a plan
An unsupported or ageing finance or ERP system can complicate security, continuity and recovery planning. It may depend on specialist knowledge, older infrastructure or integrations that are not well documented. The renewal conversation can expose those dependencies, but the decision to modernise should be driven by business requirements, not by a rushed response to a questionnaire.
For suitable organisations, a Dynamics 365 Jump Start can provide a supported route to assess and move from an ageing finance platform to Dynamics 365 Business Central, with implementation support. That work starts with strategy: understand current processes, data, reporting, integrations, risks and the organisation’s capacity for change. Then build a realistic migration plan, including testing, training and cutover arrangements.
Business Central is not an automatic fit for every organisation, and migration is not a quick patch for every legacy risk. The objective is to determine whether it supports the business’s future operating model and, if so, how to move responsibly. Microsoft’s Business Central documentation provides product information; Evestaff’s article on integrating Business Central with Microsoft 365 describes some of the wider workflow considerations.
IBM i: continuity should not depend on one person
Some businesses continue to rely on IBM i estates running on IBM Power Systems. These platforms may remain central to operations, but a continuity risk can arise when knowledge is concentrated in one specialist or documentation has not kept pace with changes.
Good preparation includes knowing which applications and processes depend on the environment, who can administer it, how support is arranged and how recovery would work. It also means planning for knowledge transfer and ensuring that responsibilities are understood by the business and its technical partners.
Evestaff provides specialist IBM i Management for IBM Power Systems estates. The aim is to strengthen continuity and provide managed support, not to assume that a long-standing platform must be replaced simply because it is specialised.
Technology Expense Management can reduce hidden risk
A renewal review is also a useful moment to examine software, licences, connectivity and supplier arrangements. Technology Expense Management (TEM) helps build a clearer view of what the organisation pays for, what it uses and who is responsible for each service.
That matters for more than the budget. Unapproved applications, duplicate tools, old accounts and unclear supplier ownership can create shadow IT: technology in use without an agreed owner or a clear place in the organisation’s security and support model. Rationalising the estate can reduce unnecessary spend while making it easier to understand where information is held and who can access it.
Review software and licence inventories alongside network and supplier dependencies. Make sure there is a named owner for services such as Cloud Solutions, Network Solutions and Voice and Connectivity. Confirm where Helpdesk Support begins and ends, and who coordinates an issue that crosses providers. These execution services should support a coherent IT strategy, rather than become a collection of disconnected contracts.
A consultancy-first approach brings those decisions together. Acting as a Fractal IT Director, David Evestaff can help shape the priorities, assess risks and set the plan; specialist channel partners can provide focused technical delivery where needed. Managed IT Services, network management, connectivity and licensing are bolt-ons to that strategy, not a substitute for it.
A practical pre-renewal checklist
Before the broker calls, consider whether you can:
- Describe the systems and suppliers that support your critical operations.
- Provide current Cyber Essentials or ISO 27001 information, where applicable, including scope and relevant actions.
- Explain how access, security updates and other important controls are managed.
- Show that backups are protected and that recovery has been tested.
- Find documented Disaster Recovery and incident-response arrangements, with clear owners.
- Identify unsupported systems, including ageing finance platforms, and explain the plan for managing them.
- Confirm who supports any IBM i environment and how essential knowledge is retained.
- Reconcile software, licences and connectivity costs against actual use and ownership.
- Disclose relevant changes, exceptions and incidents accurately to your broker.
The goal is not to promise that nothing will go wrong. It is to understand the risks, show what is in place and address gaps before they become urgent. Certification, documented recovery and a well-managed technology estate can support that work, but insurance terms and claim decisions remain subject to the policy and insurer’s assessment. Discuss cover and policy wording with your broker.
For an overview of Evestaff’s group services, visit evestaff.co.uk. For IT consultancy and support, see itandconsultancy.co.uk.
SEO tags: Cyber insurance renewal, UK SME cyber security, Cyber Essentials, ISO 27001, Disaster Recovery, Dynamics 365 Jump Start, Dynamics 365 Business Central, IBM i Management, Technology Expense Management, Cloud Solutions, Managed IT Services, Network Solutions, Helpdesk Support, Voice and Connectivity
Join The Discussion