The short answer
Yes, Cyber Essentials includes insurance for eligible organisations. If your whole organisation is certified, you are domiciled in the UK or Crown Dependencies, your annual turnover is under £20m and you opt in, you receive cyber liability cover with a £25,000 total limit. IASME arranges it, AIG underwrites it, and it costs nothing extra.
On this page
- What is Cyber Essentials insurance?
- Who is eligible for Cyber Essentials insurance?
- How much cover does Cyber Essentials give?
- What does the Cyber Essentials insurance cover?
- What does Cyber Essentials insurance not cover?
- How do you opt in at assessment?
- When does the cover start and end?
- Is it worth getting cyber insurance on top of the Cyber Essentials cover?
- How do you make a claim?
- Does Cyber Essentials Plus come with extra insurance?
- What is our role?
- Why certify with Sovereign Secure?
- Ready to certify?
Yes. Cyber Essentials insurance is included with certification for eligible organisations. If you certify your whole organisation to Cyber Essentials, are domiciled in the UK or Crown Dependencies, have annual turnover under £20m and opt in during your assessment, you receive cyber liability insurance with a £25,000 total limit of indemnity. It costs nothing extra and runs for 12 months from certification.
The cover is part of the scheme itself. It is arranged by IASME, the NCSC’s Cyber Essentials delivery partner, underwritten by American International Group UK Limited (AIG) and administered by Sutcliffe & Co Insurance Brokers. Your certification body does not arrange or sell it, so the terms are the same whichever IASME-licensed certification body assesses you.
Source and date: this page summarises IASME’s Cyber Liability Insurance page, last checked on 13 October 2026 (IASME last updated the page on 28 February 2026). The policy wording governs any claim, and terms can change, so check IASME’s page and your own Evidence of Insurance for the current position.
What is Cyber Essentials insurance?
It is a cyber liability policy that eligible organisations can opt in to when they certify. The key terms, as IASME publishes them:
| Feature | IASME’s published terms |
|---|---|
| Type of cover | Cyber liability insurance |
| Arranged by | IASME, as part of the Cyber Essentials scheme |
| Insurer | American International Group UK Limited (AIG) |
| Administered by | Sutcliffe & Co Insurance Brokers |
| Limit | £25,000 total limit of indemnity |
| Excess | £1,000, rising to £5,000 for claims arising from activities in the USA or Canada |
| Network interruption | A six-hour retention applies |
| Incident support | 24-hour helpline for crisis management and incident response, within the £25,000 limit |
| Extra cost | None: the certification price is the same whether or not you opt in |
| Duration | 12 months from certification, with exact dates on your Evidence of Insurance |
The NCSC’s Cyber Essentials overview describes the same arrangement: free cyber insurance arranged by IASME for eligible UK organisations that certify their whole organisation.
Who is eligible for Cyber Essentials insurance?
IASME sets four conditions, and you must meet all of them.
| Condition | What it means | What rules you out |
|---|---|---|
| The entire organisation is certified | Your certificate scope covers the whole organisation | Certifying only part of it, such as one site or a separate network segment |
| Domiciled in the UK or Crown Dependencies | The Crown Dependencies are Jersey, Guernsey and the Isle of Man | Being domiciled elsewhere, even if you trade in the UK |
| Annual turnover under £20m | Applies to the certified organisation | Turnover above £20m |
| You opt in | You choose the cover in your assessment | Declining it in the question set |
The scope condition is the one most worth checking early. Cyber Essentials allows you to certify part of an organisation, but the included insurance only applies when the whole organisation is in scope. If you are deciding on scope, our Cyber Essentials scoping questionnaire helps you work out what has to be included.
Organisations with turnover above £20m are not eligible for the included cover. IASME directs them to their own broker or to Sutcliffe & Co.
How much cover does Cyber Essentials give?
£25,000 in total, across everything the policy pays, including incident response services. IASME itself says this might be sufficient for a small breach or incident but would be inadequate for a serious problem or more than one incident, and that higher limits may be available on request.
Whether £25,000 is enough for your organisation is not something a certification body can answer. Speak to a regulated insurance broker.
What does the Cyber Essentials insurance cover?
Cyber insurance generally pays the costs of responding to and recovering from a cyber incident, and claims made against you because of one. The Cyber Essentials policy follows that pattern on a small scale. IASME’s summary lists these sections, all within the £25,000 total limit:
| Section | What IASME says it covers |
|---|---|
| Liability | Claims made against you arising out of digital media activities and security and privacy liability |
| Event management | Reasonable and necessary fees, costs and expenses for legal, IT, data recovery, reputation protection, notification, credit and ID monitoring, and first response |
| Extortion threat | Listed as covered; the policy wording sets out the detail |
| Regulatory investigations | Defence costs, and regulatory or data protection fines where insurable by law |
| Business interruption | Loss of profit and/or operational expenses caused by a network compromise |
| Network interruption | Reasonable and necessary costs to minimise network loss or reduce the impact of a material interruption, where the loss avoided is greater than the cost |
The regulatory section matters most when personal data is involved. Insurance does not change your duties under UK GDPR, and Cyber Essentials does not make you compliant on its own; our guide to Cyber Essentials and GDPR explains how the two fit together.
What does Cyber Essentials insurance not cover?
IASME’s published terms set out these limits and exclusions:
- Money stolen by electronic means or cyber fraud is not covered.
- An excess applies: £1,000, or £5,000 for claims arising from activities in the USA or Canada.
- A six-hour retention applies to network interruption.
- Anything above £25,000 in total falls outside the cover.
- Organisations that do not meet the four eligibility conditions are not covered at all.
There is also a condition to keep in mind. IASME says you must install and maintain the automatically provided updates from your software providers for critical business software for the insurance to remain valid. If you passed Cyber Essentials, that process should already be in place; the point is to keep it running all year, not just at assessment time. Full details of what is and is not covered are in the policy wording.
How do you opt in at assessment?
You opt in through the Cyber Essentials self-assessment. Eligible organisations are asked whether they want the cover, and only receive it if they say yes.
- Check eligibility before you start: whole-organisation scope, domicile and turnover.
- Answer the insurance questions in the self-assessment and opt in if you want the cover.
- Pass the assessment. Your certification body reviews your answers and issues your certificate.
- Check your Evidence of Insurance, issued with your certificate. The insured name should match the organisation that was certified, and it shows the policy dates.
- Keep a paper copy. IASME advises this because you may not be able to reach an electronic copy during an incident.
When does the cover start and end?
The policy starts from your certification and lasts 12 months. It is connected to your certificate and cannot be renewed on its own: to keep cover, you renew your Cyber Essentials certification or take out a separate standalone policy. If your certificate lapses, so does the insurance, which is one more reason to plan your Cyber Essentials renewal before the expiry date.
Is it worth getting cyber insurance on top of the Cyber Essentials cover?
It depends on what an incident would cost your organisation, and a regulated insurance broker is the right person to advise. IASME’s own guidance is the best starting point: it says the £25,000 limit might be enough for a small breach or incident but would be inadequate for a serious problem or more than one incident, and that higher limits may be available on request.
| Your situation | What IASME’s terms mean for you |
|---|---|
| No other cyber policy | The included cover is a free baseline. Ask a broker whether £25,000 matches your likely costs |
| An existing cyber policy | You cannot claim on two policies. If your existing policy gives the cover you need, you can opt out of the included insurance |
| Both policies in force when you claim | You must notify both insurers |
| Turnover above £20m | The included cover does not apply, so arrange your own policy through a broker or Sutcliffe & Co |
Your broker can also advise on how a standalone policy and the included cover interact.
How do you make a claim?
If you suffer a breach of confidential information or a security failure, IASME says to contact AIG’s First Response Service immediately, quoting your Cyber Essentials certificate number as shown on your Evidence of Insurance. The contact number is on IASME’s page and your Evidence of Insurance. AIG then appoints specialist consultants to advise you and your IT team. Your certification body is not part of the claims process.
Does Cyber Essentials Plus come with extra insurance?
Not according to IASME’s published terms, which describe cover attached to self-assessed Cyber Essentials certification and do not set out a separate or larger policy for Plus. Every Plus applicant holds the basic certificate first, and that is where the opt-in sits. The benefit of Cyber Essentials Plus is independent technical testing, not more insurance.
What is our role?
Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We assess applications and issue certificates, and eligible organisations we certify can opt in to the cover described above. We are not an insurer or an insurance intermediary, and we do not give advice on insurance products, limits or premiums. Questions about the policy itself go to Sutcliffe & Co, which administers it; questions about your wider insurance needs go to a regulated insurance broker.
Why certify with Sovereign Secure?
The insurance is the same whichever certification body you use. What differs is the service around your assessment:
- We are the certification body, so the team that supports you also assesses your submission and issues your certificate.
- Published prices: from £320 + VAT, with Gold submissions assessed within one working day. See the full Cyber Essentials price list.
- Help before you submit: every package includes a pre-assessment check and a support call of up to an hour.
- An established company: Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.
Insurance is one of several benefits of Cyber Essentials, alongside contract access and customer trust.
Ready to certify?
Start your Cyber Essentials certification with us, or send an enquiry through the form below and select “First time Cyber Essentials”. Tell us if you want the included insurance and we will help you confirm that your scope covers the whole organisation. You can also call +44 161 523 5276.
Your next step
- Readiness checkAnswer 20 questions for a readiness score and a fix list before you apply.Start the free check
- Cyber Essentials pricesPackages for every company size, from £320 + VAT.See CE prices
- Get a CE+ quoteTell us about your devices and cloud services for a Cyber Essentials Plus quote.Get a CE+ quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
