What is cyber insurance (and do I need it)?

To help protect your Charity online, the NCSC has developed a series of resources that you can use as a first port of call. It’s vital that the appropriate defences are put in place to protect your charity. We are increasingly being asked complementary solutions such as cyber insurance, and about how these solutions can fit within an organisation’s overall approach to cyber risk.

While we can’t tell you what your exact insurance needs are, we have looked at useful cyber security considerations, and come up with some questions that can help you work out what - if anything - is right for your organisation.

This new guidance is not a buyers guide to cyber security insurance. What it will do is help you decide if cyber insurance could contribute to how you manage your cyber risk.

Some of these questions may help you think about what cyber security defences you already have in place, and what you want to protect the most. Most importantly, buying cyber insurance doesn’t mean you no longer have to worry about cyber attacks. You can protect your organisation by ensuring you have fundamental cyber security safeguards in place, such as those certified by Cyber Essentials, or Cyber Essentials Plus For organisations with turnovers of less than £20 million, achieving either certification now automatically gives you £25,000 limit of cyber indemnity insurance cover.

We have also suggested a couple of questions you may wish to discuss with your insurance broker or provider, to help you understand:

• what services and support are available to deal with a cyber incident
• how cyber insurance could help your organisation get back on its feet, should something cyber-related go wrong

To fully understand what kind of cyber insurance policy is right for you, you need to identify the risks your charity faces. Many organisational risks (such as financial risk or legal risk) have a cyber component to them, so it’s really important to look at cyber security as an integral part of your organisational risks. Good risk management will help you to make better, more informed decisions about your overall cyber security, and help you understand if cyber insurance should be part of that.