The Evidence Room: Assembling a Cyber Insurance Renewal File That Stands Up to Scrutiny

Cyber insurance renewals used to be a modest administrative task for many UK SMEs: confirm turnover, headcount and a few security measures, then accept the quote. That approach is becoming harder to sustain. Insurers are asking more granular questions, and they are increasingly willing to request supporting evidence, impose exclusions or decline cover where basic controls cannot be demonstrated.

With 2026 drawing to a close, many owners and managers are turning to renewal preparations. The practical response is not to wait for the broker’s questionnaire. It is to build a renewal file — an evidence pack — during the quieter weeks before the process begins. The aim is not to create a glossy security brochure. It is to produce a dated, verifiable record that answers the questions an underwriter is likely to ask and gives the business a clear view of its own gaps.

Why the renewal conversation has changed

The shift reflects the claims experience of insurers and the wider threat landscape. Ransomware, business email compromise and supplier-driven incidents have shown that a short questionnaire cannot distinguish between a business with genuine controls and one with good intentions. Underwriters are therefore looking for evidence that multi-factor authentication is enforced, backups have been tested, an incident response plan exists and staff have been trained.

This is not only a compliance exercise. The same evidence is useful to the board, to customers completing supplier due diligence and to the business itself if an incident occurs. A renewal file assembled properly becomes a working risk document, not a one-off submission.

The four pillars of a credible file

Most cyber questionnaires for UK SMEs circle back to four areas. The precise wording varies by insurer, but the underlying evidence requirements are consistent.

Multi-factor authentication

Insurers want to know where MFA is enforced, not merely whether it is available. The file should list critical systems — email, remote access, finance platforms, cloud administration, backups — and show the coverage position for each. Where MFA is not enforced, record the exception, the reason, the compensating control and the date by which it will be closed. A short exceptions register is more credible than an unsupported claim of full coverage.

Useful evidence includes dated screenshots of configuration settings, a system inventory with MFA status and a named owner for the control. Avoid relying on a policy document alone. A policy says what should happen; a configuration record shows what does. Certification schemes such as Cyber Essentials can support a bid, but they are not a substitute for dated evidence of the controls in place.

Backup testing

Backup questions are often answered too broadly. Insurers increasingly ask about frequency, separation from the production environment, immutability and, crucially, restoration testing. The renewal file should include the backup schedule, retention periods, the location of copies and the most recent restore test.

A restore test record should state what was restored, when, by whom, how long it took and whether the result met the agreed recovery time and recovery point objectives. If no test has taken place, schedule one before renewal and document the outcome. A failed or partial test is not necessarily fatal, but an untested backup is a weak position to defend.

Incident response planning

An incident response plan does not need to be a lengthy manual. It does need to set out who does what, how the business will contain an incident, how it will communicate and when it will notify the insurer, regulators and affected parties. For UK SMEs, the plan should also reflect the 72-hour reporting threshold under UK GDPR where personal data is involved. The National Cyber Security Centre’s guidance is a useful reference when testing whether the plan is practical.

Evidence can include the plan itself, a contact tree, the date of the last tabletop exercise and actions arising. Insurers are often interested in whether the plan has been tested, not just written. A one-hour exercise with senior managers can produce useful notes and demonstrate that the plan is live.

Staff training records

Training is a common weak point because records are scattered across induction packs, email reminders and ad hoc sessions. The file should show completion rates, the frequency of training, the topics covered and how the business follows up with non-completers. Phishing simulation results can be useful, provided they are presented honestly and with context.

Insurers do not expect every employee to be a security specialist. They do expect the business to show that awareness is maintained and that new joiners, contractors and temporary staff are included.

Build the file before the questionnaire arrives

A practical sequence is to start with a control inventory, then gather evidence, then review gaps. The inventory should list the systems and processes that matter: email, remote access, finance, payroll, customer data, backups, suppliers and incident contacts. For each, assign an owner and record the current control, the evidence available and the next review date.

The evidence itself should be stored in a single, access-controlled folder with clear file names and dates. Version control matters. An underwriter may not examine every document, but a disorganised pack creates doubt. A simple index with sections for MFA, backups, incident response, training and supplier management will make the broker’s job easier and the business’s position clearer.

Close the gaps that trigger questions

Common gaps include MFA exceptions without a closure plan, backup tests that have never been performed, incident response plans that name no deputies and training records that cover only permanent staff. Each gap should be logged with an owner and a target date. Some can be closed quickly; others may need budget or supplier involvement.

Where a gap cannot be closed before renewal, prepare a short remediation note. Insurers often respond better to a candid explanation and a dated plan than to an unsupported assurance. The broker should see the note before the proposal is submitted so that the position can be presented consistently.

Use the broker as a reviewer, not a messenger

The broker can add most value when the renewal file is shared early enough for a conversation. Ask which evidence the insurer is likely to request, whether any exclusions are probable and how the business’s controls compare with similar risks. The objective is not to argue for a lower premium but to avoid surprises.

A well-built renewal file will not guarantee a soft market. It can, however, reduce the risk of a premium shock caused by missing evidence, shorten the time spent answering follow-up questions and give the business a clearer basis for deciding whether the cover on offer is appropriate.

For UK SMEs, the discipline of assembling the file is now part of good management. The questionnaire will arrive soon enough. The evidence should be ready before it does.