What Do Cyber Insurers in Ireland Require Before They Will Cover You?

Irish cyber insurers now expect a baseline of controls before they quote: multi-factor authentication on email, remote access and admin accounts, offline or immutable backups that are tested, endpoint detection and response on every device, prompt patching and email security. Gaps can mean higher premiums, exclusions or a refusal. ERS IT Solutions has supported Irish businesses from Blanchardstown, Dublin 15 since 1983, and our managed security services put these controls in place and produce the evidence insurers ask for.

What are the cyber insurance requirements for Irish businesses?

There is no legal requirement to hold cyber insurance in Ireland, and each insurer sets its own underwriting rules. But the questions on proposal forms have converged. An Irish broker, OBF Insurance, lists what underwriters now expect Irish businesses to have:

• Multi-factor authentication across email, remote access and admin accounts. OBF notes that not using MFA where it is available for cloud services "could trigger an automatic failure".
• Backups that are encrypted, kept in multiple copies on different media with one offline, and restored on a test schedule.
• Patching, with critical updates deployed regularly and visibility of any exceptions.
• Endpoint detection and response (EDR), managed and monitored on every laptop and desktop, including remote workers. OBF says basic antivirus "is no longer sufficient".
• Email security, including advanced filtering and domain controls such as DMARC.

Global broker Marsh says adopting certain controls "has now become a minimum requirement of insurers". Its list of key controls adds privileged access management, awareness training and phishing testing, remote desktop protocol (RDP) hardening, replacing or protecting end-of-life systems, and digital supply chain risk management.

Cyber insurance checklist: the controls to have before you apply

Use this before you fill in a proposal form. Each line is a question insurers commonly ask.

1. MFA on every email account, including shared and admin mailboxes.
2. MFA on all remote access: VPN, remote desktop and cloud admin portals.
3. Separate admin accounts, with no everyday email or browsing on them.
4. EDR on every endpoint and server, monitored around the clock.
5. Backups with at least one offline or immutable copy, and a restore test in the last few months.
6. Critical patches applied within a defined time, such as 14 days.
7. No unsupported operating systems, or the ones left isolated from the internet.
8. Email filtering for malicious links and attachments, plus SPF, DKIM and DMARC on your domain.
9. RDP closed to the internet.
10. Staff awareness training and phishing simulations, with records.
11. A written incident response plan with your insurer's hotline in it.
12. A call-back rule for any change to supplier bank details.

Item 12 matters because invoice fraud is often excluded or limited. Read our guide to invoice fraud and business email compromise.

How do I prove these controls to an insurer?

Insurers are moving from tick boxes to evidence. OBF advises collecting "screenshots, reports, and evidence of configuration" to support your application. Useful evidence includes:

• An MFA registration report from Microsoft 365 showing every user enrolled.
• Your Conditional Access policy list.
• An EDR console report showing every device protected.
• A backup report and a dated restore test.
• A patch compliance report.
• Training completion and phishing simulation results.
• A current Cyber Essentials certificate, which covers several of the same controls.

ERS clients get monthly security reports through our managed cyber security services, which makes renewal forms faster to answer accurately. Answer every question honestly. A wrong answer on a proposal form can give an insurer grounds to refuse a claim.

How much does cyber insurance cost in Ireland?

No Irish regulator or industry body publishes an average cyber insurance premium for SMEs, so be wary of any single "average cost" figure. There are no standard cyber insurance rates: pricing is quoted per business by insurers and brokers. What changes the price:

• Turnover and sector. Higher revenue and sectors holding sensitive data, such as health, legal and finance, cost more.
• Records held. The amount of personal and payment data you store.
• Limit and excess. A €1 million limit costs more than €250,000. A higher excess lowers the premium.
• Controls. MFA, EDR, tested backups and training are what underwriters price on. Missing controls raise the premium or remove cover.
• Claims history. Previous incidents push the price up.
• Cover options. Adding business interruption, cyber crime or social engineering fraud cover adds cost.

For a published reference point, the UK Cyber Essentials scheme lists add-on premiums for small UK businesses certified to Cyber Essentials. IASME shows £305.76 a year for a £100,000 limit and £546.56 for £250,000, for organisations with revenue up to £10 million. That cover is only for UK-domiciled organisations and comes with certification, so it is not an Irish market price, but it shows how limits drive premiums and how controls lower risk for underwriters.

How much cyber insurance do I need?

Work it out from what an incident would actually cost you, not from a calculator. Online "cyber insurance cost calculators" give a guess at the premium, not at the cover you need. Add up:

1. Lost income. Your daily gross profit multiplied by the days you could be offline. If your backups take three days to restore, use at least three.
2. Incident response. Forensic investigators, IT recovery work and legal advice.
3. Notification costs. Contacting affected individuals if personal data is involved.
4. Liability. Claims from customers or partners whose data was affected.
5. Regulatory costs. Defence costs for a regulatory investigation, where the policy covers them.
6. Fraud loss, if you want cyber crime or social engineering cover.

Ask your broker to model these figures. Then ask your IT provider how quickly you could actually recover, because a faster restore reduces the business interruption you need to insure.

What does a cyber insurance policy cover?

Policies vary, but OBF describes three main elements: cover for your own costs in responding to an attack, cover for claims brought against you after a breach, and access to crisis management specialists and forensic investigators. Check each of these in the wording, and in the coverage checklist below.

Cyber insurance coverage checklist

When comparing quotes, check:

1. Incident response hotline. Is it 24/7, and who answers?
2. First-party costs. Forensics, data restoration, system repair.
3. Business interruption. How many hours is the waiting period before cover starts?
4. Third-party liability. Claims from customers and partners.
5. Regulatory defence. Investigations by the Data Protection Commission.
6. Ransomware. Is it covered, and are there sub-limits?
7. Social engineering and invoice fraud. Often excluded or tightly limited. The IASME policy wording, for example, does not cover money stolen electronically or through cyber fraud.
8. Conditions. Controls you must keep in place for cover to stay valid, such as applying updates.
9. Approved suppliers. Whether you must use the insurer's panel or can use your own IT provider.
10. Notification deadlines. How quickly you must tell the insurer about an incident.

What should I do with my insurer during an incident?

Call the insurer's hotline early, before you spend money on recovery, as many policies require their approval or panel. Tell them what your IT provider has done so far. Report crimes such as ransomware and fraud to An Garda Síochána. If personal data is involved, the clock for reporting to the Data Protection Commission is 72 hours from becoming aware. Our ransomware guide covers the first hours step by step.

How ERS helps you meet insurer requirements

ERS does not sell insurance or act as a broker. We put in place and run the controls insurers ask about, and give you the reports to prove them:

• 24/7 managed detection and response, which covers the EDR and monitoring questions.
• MFA, admin account separation and Conditional Access, watched by Microsoft 365 monitoring.
• Tested backup and disaster recovery.
• User awareness training with phishing simulation records.
• Dark web monitoring for staff credentials.

ERS quotes per business after a short call. Contact us or call 01 885 9500.