About Author
Hannah Lloyd
Hannah Lloyd is CRO and co-founder of enhanced.io. She leads global new business generation and works directly with MSP partners to build and sell security practices.
enhanced.io, the channel-only Open XDR SOCaaS for MSPs
TL;DR
Cyber Essentials covers 5 technical controls: firewalls, secure configuration, access controls, malware protection and patch management. It is a solid baseline.
Cyber insurance questionnaires go significantly further. They ask about incident response planning, privileged access management, continuous monitoring, backup testing, and identity controls that Cyber Essentials does not cover.
The gap is not a reason to dismiss Cyber Essentials. It is a reason to understand what it covers and what sits above it, and to build the client conversation accordingly.
From what I've seen, clients who hold Cyber Essentials certification often assume they have answered the insurance question. That assumption is what gets them into difficulty at renewal.
MSPs who understand both frameworks are well placed to have a structured conversation about what the client already has and what still needs to be evidenced.
A conversation I keep coming back to
I was on a call a while back with a partner who told me that one of her clients had failed their cyber insurance renewal despite holding Cyber Essentials Plus certification. The client was genuinely surprised. They felt they'd done the right thing, invested in the certification, and expected it to carry more weight than it did. What the insurer was asking about went well beyond what Cyber Essentials covers, and the client simply didn't have documentation ready for those additional areas.
I've heard versions of this story quite a few times since then, and I think it points to a misconception that's worth addressing directly. Cyber Essentials is a well-designed certification that covers the foundational technical controls. It is not a comprehensive insurance questionnaire preparation tool. The two serve different purposes, and conflating them creates a gap that tends to surface at exactly the wrong moment. The reason I mention this is not to undermine Cyber Essentials, which I think is genuinely useful, but to help MSPs position it correctly with their clients.
What Cyber Essentials covers
Cyber Essentials covers 5 control areas: boundary firewalls and internet gateways, secure configuration of devices, access controls and administrative account management, malware protection, and patch management. The Plus version adds an independent technical audit of those controls, which gives it more credibility for insurers than the basic self-assessment.
These are the right controls to have. An organization that genuinely meets Cyber Essentials Plus is in a better security position than one that does not. The point is not that these controls are unimportant. It is that the compliance landscape your clients are navigating extends considerably beyond them, and the insurer questionnaire reflects that broader landscape.
What insurers ask for that Cyber Essentials does not cover
Incident response planning
Cyber Essentials does not require a documented incident response plan. Insurers do. They want to see a plan that names roles and responsibilities, defines escalation paths, covers communication procedures and has been reviewed within the last 12 months. From what I've seen, this is the single most common gap for clients who hold Cyber Essentials but are encountering a detailed insurer questionnaire for the first time.
Privileged access management
Cyber Essentials covers access controls at a fairly high level: administrative accounts should be separate from day-to-day accounts and should be used only for administrative tasks. Insurer questionnaires go further, asking about step-up authentication for admin access, privileged access workstations, just-in-time access provisioning and a formal review process for admin rights. Most SMB clients have not implemented these controls at the level insurers are now asking about.
Continuous monitoring and detection
Cyber Essentials does not require continuous security monitoring or a formal detection and response capability. Insurer questionnaires increasingly ask about both. The specific questions tend to cover whether the organization has an EDR tool deployed and actively managed, whether there is a process for reviewing security alerts, and whether there is a record of how recent alerts were handled. The difference between proactive and reactive detection matters here because insurers are starting to distinguish between organizations that detect incidents quickly and those that find out about them days or weeks later.
Backup testing
Cyber Essentials requires that backups exist and are configured appropriately, but does not require evidence of successful recovery testing. Insurers ask specifically about this. When were backups last tested? Was recovery successful? Is there a documented record of the test? A backup that has never been tested for recovery is one of the highest-risk assumptions in a client environment, and insurers are increasingly treating untested backups as a material risk factor in renewal decisions.
Identity and email controls
Insurers now routinely ask about multi-factor authentication coverage in detail, DMARC and SPF configuration for email domains, and controls around phishing. Cyber Essentials covers access control and configuration broadly, but does not drill into email authentication controls at the level insurers have started to require. For clients who have had their Cyber Essentials certification for more than a year or two, what the questionnaire is actually asking about in these areas is likely to be more detailed than what the certification required at the time.
How to position this with clients
One of the things I find most useful in this conversation is the iceberg analogy. Cyber Essentials is the visible part of the iceberg: the baseline that everyone should have and that's visible to anyone looking at the organization's security posture. What insurers are asking about is the part below the waterline: the monitoring, the incident response planning, the identity controls, the evidence trail. That part is harder to see but it's what determines whether a claim gets paid.
The reason I like that framing is that it doesn't dismiss what the client has already done. They've invested in Cyber Essentials. That's a good thing and worth acknowledging. What the conversation then does is open up the question of what sits above it and how to evidence it. That's a much more productive conversation than telling a client their certification is inadequate. And it maps well to how the myths that prevent MSPs from selling more security tend to operate in practice: clients who believe they've done enough often need a gentle and specific conversation about what 'enough' means for their insurer's purposes.
What I've seen work is running a structured gap analysis between the client's current Cyber Essentials coverage and a typical insurer questionnaire, and presenting the results as a prioritized list of what needs to be added and evidenced. It gives the client something concrete to act on and gives the MSP a clear scope of work. The gaps between what Cyber Essentials covers and what insurers assess tend to fall into a consistent pattern once you've done a few of these, and building a repeatable assessment process around them is worth the investment.
The partner story that comes to mind when I think about this conversation going well is Shinka IT's approach, where running the security platform internally before offering it to clients gave them the direct experience to talk about evidence and controls from a position of genuine knowledge rather than a sales pitch. That credibility matters when you're asking a client to invest in additional controls beyond what they thought was sufficient.
FAQ
What does a cyber insurer want to see beyond Cyber Essentials?
The areas most commonly asked about beyond Cyber Essentials cover 5 things: a documented incident response plan reviewed within the last 12 months, privileged access management controls including separate admin accounts and step-up authentication, active endpoint detection and response with evidence of alert management, documented backup recovery testing with results and dates, and identity controls including MFA coverage across all accounts and email authentication configuration. Each of these needs evidence, not just confirmation that a control exists.
Is Cyber Essentials Plus worth getting if you're preparing for insurance renewal?
In my experience, yes, for two reasons. First, it provides independent validation of the foundational controls rather than a self-assessment, which carries more credibility with insurers. Second, going through the Plus assessment process often surfaces configuration gaps that the organization wasn't aware of. The certification is not sufficient on its own for a detailed insurer questionnaire, but it is a useful and credible starting point that simplifies the conversation about what the remaining gaps are.
How long does it take to close the gap between Cyber Essentials and insurer requirements?
What tends to happen is that the technical controls are easier and faster to put in place than the documentation. MFA enforcement, EDR deployment and email authentication configuration are typically achievable within a few weeks for most SMB environments with an MSP's support. The incident response plan, the backup testing records and the evidence trail for ongoing monitoring take longer to build because they require process change rather than just technical deployment. Allowing 60 to 90 days before a renewal is a sensible target for clients starting from Cyber Essentials and working toward a detailed questionnaire.
Do all cyber insurers ask the same questions?
No, and this is one of the things that catches clients and MSPs off guard. Insurers set their own questionnaires and the level of detail varies significantly. Some are still relatively high-level. Others, particularly for higher-value policies or clients in regulated sectors, have become quite granular. The trend is toward more detail rather than less, and the questions that appear on the more demanding questionnaires today tend to appear on the more straightforward ones within 12 to 18 months. Building toward the more demanding standard now is the approach that ages better.
How can an MSP build a repeatable Cyber Essentials gap analysis?
The most practical approach is to map a typical insurer questionnaire against the Cyber Essentials control areas and identify the consistent gaps. In my experience, the same 5 or 6 areas appear every time: incident response planning, privileged access controls, continuous monitoring evidence, backup testing records, identity controls and email authentication. Building a standard assessment template around those areas and running it for every client who holds Cyber Essentials gives you a repeatable scope of work and a consistent conversation structure.
What role does continuous monitoring play in insurance readiness?
It plays a significant role, and it's one that's grown over the past two years as insurers have become more interested in how quickly organizations detect and respond to incidents. Continuous monitoring that produces a documented record of alerts detected, assessed and resolved gives the client an evidence trail that directly answers the insurer's questions about detection capability. An MSP who provides that monitoring and packages the output as insurance-ready reporting is providing something that's genuinely difficult for the client to produce themselves.