What does it cost to meet cyber insurance requirements in Ireland?

Switching the controls on costs little: two-step sign-in comes with Microsoft 365 and Google Workspace, and a DMARC record is one line of DNS. The cost is the work of setting them up without locking anybody out, and the dated proof an insurer asks to see. Published Irish prices for that work run from €1,197 + VAT for the email and website settings alone to €17,000 a year for a consultancy subscription. Ours is €2,950 for up to 10 staff, once.

By Oscar CobbeCurrent as at 22 October 20266 minute read8 sources

What insurers ask for

OBF Insurance Group, an Irish broker, lists the controls underwriters expect Irish businesses to have: multi-factor authentication on email, remote access and admin accounts; encrypted backups, with more than one copy and one kept offline, and a schedule for testing a restore; regular security updates (patching); managed endpoint detection and response (EDR) on every laptop and desktop; and email filtering with domain controls such as DMARC. It adds staff training and a documented incident response plan, and says underwriters expect proof: screenshots, reports and evidence of configuration.

What each proposal form asks, and how to answer it truthfully, is in our guide to what a cyber insurer asks an Irish small business.

What the controls cost to switch on

Two of them cost nothing beyond the subscription you already pay. The rest cost money because somebody has to run them every month. The email part is priced on its own in what DMARC set-up costs.

Control	What it costs to switch on	Where the cost is
Two-step sign-in, Microsoft 365	Nothing extra: Microsoft says security defaults give every organisation a basic level of security at no extra cost	Turning it on without locking out a shared mailbox, a printer that sends email, or an admin
Two-step sign-in, Google Workspace	A setting Workspace administrators turn on	Enforcing it for every user, and the admin accounts first
Email protection (DMARC)	Nothing: it is a record published in your domain's DNS	Finding every service that sends as you before the policy is set to reject or quarantine
Backups, with a tested restore	A backup service, priced by the data kept	Testing a restore, and keeping the dated result
Patching and EDR on every device	Priced per device or per user, usually inside a managed IT contract	Every month, for as long as you have the devices
Incident plan and training	Nothing to buy	Writing the plan, and practising it with the people it names

What the work costs, side by side

The prices below are as each business published them on 22 October 2026. They do not cover the same things, so the third column matters more than the second. Which job belongs to an IT provider and which to us is set out in Secured and proven or a managed IT provider.

Who does it	Published price	What it covers	What it leaves out
You	No fee	Whatever you set up, with OBF's advice to keep screenshots and reports as proof	The hours, and nobody checks the result
Pragmatic Security, Domain Fix	€1,197 + VAT once; Domain Watch €119 a month after	SPF, DKIM and DMARC for your email provider, HTTPS and security headers, a before-and-after report	Two-step sign-in, backups, patching, EDR, an incident plan
A managed IT provider (iPing's figure for Dublin)	€350 to €900 a month for 10 to 20 staff	Remote and on-site support, monitoring, patching, cyber security tools and antivirus	The published list names no email protection, no evidence pack and no score
A managed IT provider (Panoptic's calculator)	€1,080 to €1,560 a month for 10 people and 15 devices	Managed IT, all its security, Microsoft 365 licences and a help desk, in one fee	An estimate: the exact figure follows a discovery call, and a minimum monthly fee applies
BH Haven, Foundation plan	€17,000 a year (1 to 10 employees)	Two consulting days, core policies, a maturity assessment, backup, access and incident-response foundations, GDPR governance	Running patching and EDR: the plan reviews endpoints once a year
FourWinds, Secured and proven	€2,950 up to 10 staff, €4,950 for 11 to 25, €7,500 for 26 to 50, once	Two-step sign-in on every account, backups with a dated test restore, an incident plan practised once, SPF and DMARC set to enforce, cookie consent, a privacy notice, a second scan, a CyFun Basic score and an evidence pack	Patching, EDR and a help desk: those stay with your IT provider

The gap in our column

Underwriters expect managed EDR and regular patching on every device. Secured and proven does not run either. If nobody looks after your devices today, you need an IT provider for that part.

The proof is part of the price

OBF says many underwriters will expect to see proof that the controls are in place, and that failing to show it can mean higher premiums, exclusions or declined cover. A control switched on and never recorded is a yes on the form with nothing behind it.

That is why Secured and proven ends on paper: a second scan of your website and email from outside, dated documents for what a scan cannot see (the sign-in settings, the restore, the plan), and an evidence pack you can send to the broker. The free compliance check is the same outside scan, and you can run it first.

Sources

Free, and no account needed

See what an insurer would see from outside, free

The free compliance check reads your website and your domain's email records from outside, as the programme's first scan does, and asks a few questions about the business. Two-step sign-in, backups and devices are inside your accounts, where no outside look reaches. Kept, with a free account, the result becomes a dated compliance record.

Run the free check

The insurer basics, done and proven

Secured and proven sets up two-step sign-in, a tested backup restore, a practised incident plan and email protection, then proves them with a second scan, a CyFun Basic score and an evidence pack for your broker. From €2,950 up to 10 staff, fixed before we start.

Secured and proven

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and updated when the law changes.

More about how we work →