What a cyber insurer asks an Irish small business, and how to answer it truthfully

In 2022, 37.49% of Irish enterprises with 10 to 49 persons employed had insurance against IT and communications (ICT) security incidents, according to Eurostat's survey of enterprises. Across the EU the figure was 22.63%. For enterprises with 50 to 249 persons employed, it was 63.86% in Ireland and 34.64% across the EU. The survey covers manufacturing, energy, water and waste, construction, wholesale and retail, transport, accommodation and food, information and communication, property, professional and administrative services, and computer repair. It leaves out the financial sector, agriculture, forestry, fishing, mining and quarrying, public administration, education, health and social work, arts and recreation, and personal services such as hairdressing. It publishes no figure for firms with fewer than ten people. The latest year it reports for this question is 2022.

The second figure is from SME Cyber Resilience: Ireland's State of the Sector 2025, published by Munster Technological University with the National Cyber Security Centre: "18% of SMEs are covered by cyber insurance". It is drawn from 894 organisations that completed a self-assessment tool in 2024 and 2025. The answers were self-reported and anonymous, with no independent auditing, 88% of the respondents were micro businesses, and MTU collected the data, not the NCSC.

The two figures count different groups in different ways, so neither corrects the other. In both the 10 to 49 band and the MTU sample, fewer than half the firms counted hold a policy. The rest of this guide is about the questions asked before cover is offered, and what the law says about answering them.

Three sources published in Ireland show what gets asked. The first is Chubb's Irish site, which links three proposal forms for its Cyber Enterprise Risk Management policy, all dated 09/22: a short form (ROI0268-MD), a standard form (ROI0270-MD) and an extensive form (ROI0269-MD). The short form says that completing it binds neither side and that further information, including a full proposal form, may be required. The table below uses the short form.

The standard form goes further. It asks whether you have a formal plan for responding to cyber incidents, tested at least once a year; a formal process for installing security updates (patch management), with target fix times by severity; a list of your hardware and software; and any systems their maker no longer supports (end-of-life systems). It also asks about losses over five years, not three. The extensive form asks about all of those too.

The second source is an article by OBF Insurance Group, a broker regulated by the Central Bank of Ireland, setting out the security measures (controls) it says underwriters expect Irish businesses to have. Underwriters are the people who decide whether an insurer will offer cover. The third is Campion Insurance's Cyber Prepare, which pairs a questionnaire with what Campion calls a non-invasive scan of a business's online presence. Campion's brochure for it describes it as a low-cost tool and says the questionnaire's controls are grouped under ransomware, phishing, social engineering, business email compromise and third-party vendor compromise. The questions themselves are not on Campion's page or in either of its cyber brochures.

Chubb's short form also asks for annual turnover, a named person responsible for data and network security, the share of turnover earned in the United States and Canada, whether you trade with sanctioned territories, whether to the best of your knowledge the business complies with all relevant privacy laws, and, if you take card payments, whether you meet the card industry's security standard (PCI DSS) at the level that applies to you. Its glossary is worth reading before you tick the two-step sign-in box: it says a shared secret key, an IP or MAC address, a VPN, a monthly re-authentication procedure or VOIP authentication does not count as a second factor.

Email security is on Chubb's forms and on OBF's list. If your domain has no record telling other mail systems what to do with fake email sent in your name (a DMARC record), or has one that only monitors (p=none), the DMARC guide explains what that means and what changing it involves.

The table sets the questions on Chubb's short form beside the controls OBF's article names, item by item, and says where either is silent.

None of Chubb's three Irish forms asks how the business checks a change to a supplier's bank details, and OBF's list does not name it. Campion's questionnaire groups some of its controls under business email compromise (criminals using email to trick a business into paying them) and social engineering (tricking staff). Campion's page says many cyber insurers offer cover for financial loss from attacks such as phishing scams as an option. If the policy is meant to cover a payment sent to a fraudster, check that the policy schedule names that cover.

The control itself is set out by the NCSC in its guidance on business email compromise and payment fraud: "a strict call-back verification process for any change in bank details", and two people approving financial transactions over a set amount (dual approval). More on that control is in the guide to invoice redirection fraud.

The Consumer Insurance Contracts Act 2019 changed what you owe an insurer when you answer its questions, but only where your business is a consumer in the Act's sense. The Act takes that meaning from another law, the Financial Services and Pensions Ombudsman Act 2017 (section 1 of the 2019 Act, pointing to paragraph (a) of the definition in section 2(1) of the 2017 Act). It covers more businesses than the word "consumer" suggests. Sections 8 and 9, the ones that govern a proposal form, have applied since 1 September 2021.

Under that definition, a consumer is any of these:

For a business inside that definition, section 8 replaced the old principle of utmost good faith when you apply for cover (the proposal stage). Your only duty is to answer the insurer's questions. You do not have to volunteer anything beyond them. The insurer has to ask specific questions, on paper or another durable medium, and may not use general ones. Its questions have to be in plain and intelligible language, and where a question is ambiguous the reading most favourable to you prevails. Before the contract is made, and before each renewal, the insurer has to explain the general nature and effect of your duty of disclosure, on paper or another durable medium.

In return, you have to answer every question honestly and with reasonable care, judged against the average consumer. Unless the contrary is shown, you are presumed to know that anything the insurer asks a specific question about matters (is material) to the risk it takes on or to the premium. Whether you took reasonable care depends on, among other things, how clear and specific the questions were and whether an agent such as a broker acted for you. If the insurer does not follow up an answer that is missing or obviously incomplete, it is treated as having given up (waived) any further duty of disclosure. That does not apply if the gap came from fraudulent, intentional or reckless concealment. And the insurer can use the Act's remedies only if it shows that what was not disclosed was an effective cause of it entering the contract on the terms it did.

Each of Chubb's forms carries a declaration that you have made a fair presentation of the risk by disclosing all material matters you know or ought to know. The standard and extensive forms add an undertaking to tell the insurer promptly in writing of any material change to those facts before the contract is completed. For a business inside the Act, section 8(2) confines the duty to answering the insurer's questions and section 8(3) bars general questions. If the declaration's wording concerns you, ask the broker in writing how it applies to your contract.

Section 9 sets out what the insurer can do when an answer turns out to be wrong. Where a claim is made, the remedy depends on how the answer came to be wrong, as the table shows. Where the answer was careless (negligent) and no claim is outstanding, the insurer has two other options. It can give notice that it will use those remedies if a claim is made. Or, for non-life cover such as cyber, it can end the contract on reasonable notice.

For a business inside the Act, section 19 applies to the security answers as it does to any other. Anything you say about how things stand counts only as a statement (a representation). A term that tries to turn it into a strict promise the cover depends on (a warranty) is invalid. That includes a clause making your answers the basis of the contract.

Some policy terms require something to stay in place during the policy. The Act calls this a continuing restrictive condition. If you breach one, the insurer's liability is suspended only while the breach lasts. If it has been put right by the time of the loss, the claim is paid, unless the insurer has another defence. And a breach that did not increase the risk of the loss that happened suspends nothing.

Section 15 limits clauses about a change in the risk. An "alteration of risk" clause applies only where the thing insured (the subject matter of the insurance) has itself changed. It is void where only the risk has changed. A clause about a "material change" is read as meaning a change that takes the risk outside what both sides reasonably had in mind when the contract was made.

If a claim is refused, a business inside the €3 million test can complain about the insurer or the broker to the Financial Services and Pensions Ombudsman, once the insurer or broker has had the chance to sort it out.

A business above €3 million in turnover, or a company inside a group above it, is outside the definition, and the Act's duties and remedies do not reach it: they apply to contracts of insurance made between an insurer and a consumer.

Section 8 names what it replaced, for consumers only: the principle of utmost good faith, and any duty of disclosure, including a duty to volunteer information. The Law Reform Commission's summary of its 2015 Report on Consumer Insurance Contracts (LRC 113-2015) calls that duty, as the law then stood, onerous. Under it, the person insured had to disclose any information a hypothetical prudent insurer might rely on, and the insurer could refuse to pay anything where the duty was not met.

Section 19, which makes answers representations and invalidates basis of contract clauses, also applies only to consumers. The same summary describes the rule it replaced: where a statement is made a warranty or the basis of the contract, an insurer could refuse a claim even where the breach had nothing to do with the loss. Outside the Act, read the declaration and the policy for the words "warranty" and "basis of the contract" before you sign.

The declaration on Chubb's forms is written in those wider terms. Outside the Act, treat the questions as the minimum. Make sure anything else an insurer would want to know reaches it in writing, and keep a copy.

The Central Bank's Consumer Protection Regulations 2025 (S.I. No. 81 of 2025), in operation since 24 March 2026, draw a different line. Under them a company is a consumer unless its turnover in the previous financial year was over €5 million or it is a member of a group of companies with combined turnover over €5 million. A company can therefore be outside the 2019 Act and still be a consumer under those Regulations, for example one with turnover between €3 million and €5 million that is not in a larger group. The Regulations require an insurer or broker to set out clearly, in a quotation to a consumer, any warranties that apply to the policy. They also require it to tell a consumer applying for a policy, on paper or another durable medium, the possible consequences of failing to comply with the duty of disclosure, including that the policy may be cancelled and that claims may not be paid.

Answer each question for the business as it stands on the day you sign, from evidence and not from memory. OBF says many underwriters will expect to see proof that the controls are in place, and advises collecting screenshots, reports and evidence of configuration before you apply.

Where an answer needs a qualification, such as two-step sign-in on every account but one, write it on the form. Chubb's forms have commentary boxes for this.

A no has a cost too. OBF says that failing to show underwriters proof of the controls may lead to "higher premiums, exclusions, or declined cover". Chubb's standard and extensive forms include an optional box for cyber improvements planned over the next 12 months or so. A control you are putting in can go there with its date, beside an honest no.

Keep the evidence in one folder, and date every item in it:

For a business inside the Act, section 14 sets the renewal rules. If you answered properly the first time, you do not have to volunteer changes at renewal. The exceptions are where the insurer asks a specific question about a matter, or asks you to update something it describes and gives you a written copy of what you told it before. Where it does ask, the same duty applies: answer honestly and with reasonable care. If you give no new information and keep paying, the earlier answers are presumed unchanged. Renewal does not cure an earlier breach of the duty of disclosure.

The insurer has to tell you of any change to the policy's terms and conditions a reasonable time before renewal, and no later than 20 working days before it.

The folder is most of the work at renewal. Refresh the dated items once a year, with a new export, a new test restore and a new practice run, and the renewal answers come from this year's evidence. A control that has lapsed since last year shows up there before it shows up in a claim.

For a framework that puts controls like these in one place, see CyFun, ISO 27001 and Cyber Essentials. A security questionnaire from a larger customer is a different document with its own rules, and NIS2 supplier questions covers it.

A cyber policy can pay for the response to an incident. The legal duties stay with the business.

Campion says a comprehensive cyber policy provides, among other things, support in complying with data protection legislation and notification obligations after a data breach. The obligations are yours. You must notify the Data Protection Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33 of the GDPR). That does not apply if the breach is unlikely to result in a risk to people's rights and freedoms. Article 34 adds telling the people affected where the breach is likely to result in a high risk to their rights and freedoms. Article 33(5) requires every breach to be documented, whether it was notified or not.

The insurer has its own notice requirement, set by the policy. Under section 16 of the 2019 Act, a consumer must tell the insurer about an insured event within a reasonable time, or as the contract says. If missing a notification deadline does not harm the insurer's position (prejudice it), the insurer cannot refuse the claim for that reason alone. OBF advises alerting the insurer as soon as possible during an attack, and writing into the incident plan when to call it.

That is two notifications on two clocks, and sometimes a third: the Data Protection Commission under Article 33, the insurer under the policy, and, where the risk to them is high, the people affected under Article 34. The first 72 hours of a breach sets out the two GDPR duties, the policy schedule sets out the insurer's, and all of them belong in the plan. The compliance clocks guide puts the statutory ones side by side.

A policy does not meet your security duty under Article 32 either. Article 32 requires appropriate technical and organisational measures to keep security at a level that suits the risk. As appropriate, that includes being able to restore personal data in a timely manner after an incident, and a process for regularly testing the measures. A dated test restore is the record OBF's restoration testing schedule produces, and it is evidence for Article 32 as well.