Does a small business in South Africa need cyber insurance?

It is not a legal requirement, but it is worth considering if you hold customer or patient information, rely on computers to trade, or move money by EFT. A single ransomware attack or fake-invoice fraud can cost more than a small business can absorb. Insurance does not replace security, and many policies expect you to have certain controls in place, so treat it as the last layer, not the first. Talk to a registered insurance broker about what suits your business.

What do cyber insurers usually require before they will cover a small business?

Requirements differ between insurers, but the questions are broadly similar: multi-factor authentication on email and remote access, backups kept off-site and tested, managed endpoint protection, regular patching with no unsupported systems, email filtering, staff security training, an incident response plan and controlled access to systems. Missing multi-factor authentication or off-site backups are the gaps that most often lead to a declined application or higher terms.

Can an insurer refuse a claim?

Yes. Common reasons include a policy exclusion, a control you said you had that was not actually in place when the incident happened, a late notification, or an application that was not answered accurately. That is why accuracy on the application matters as much as the controls themselves. Keep evidence that each control was running, and read your policy's exclusions and notification duties before you need them.

What does cyber insurance typically cover?

Policies vary, but they commonly cover some of the costs of responding to an incident (forensic investigation, restoring systems, notifying affected people, legal and public-relations help), business interruption, and in some cases cyber extortion and funds lost to certain frauds. They may also cover claims by third parties and some regulatory costs. Limits, excesses and exclusions differ a lot, and some losses, such as fraud by deception, may be capped or excluded, so ask your broker to explain them in plain terms.

How much does cyber insurance cost in South Africa?

There is no standard price. Premiums depend on your industry, turnover, the data you hold, the cover limit and excess you choose, and above all how well your security controls answer the insurer's questions. Strong controls generally make cover easier to get and cheaper to keep. Get quotes from a broker rather than relying on a figure from an article.

Is cyber insurance a substitute for POPIA compliance?

No. POPIA requires reasonable security for personal information and notification of the Information Regulator and affected people when a compromise happens, and insurance does not remove either duty. A policy may help pay for the response, but you still need the controls, the incident plan and the notification process. Our POPIA checklist covers the technical measures.

How long does it take to get ready for a cyber insurance application?

Switching on multi-factor authentication and writing a short incident plan can be done in days. Setting up off-site backups and proving a restore, rolling out managed endpoint protection and tidying patching and access can take a few weeks. Most small businesses can close the main gaps in 30 to 90 days if they start with the critical controls. Plan to do it before you apply, not after.

Cyber Insurance Requirements for SA Small Businesses

Cyber insurance sounds like a simple answer to a frightening problem: if criminals lock your computers or steal money, someone else pays. In practice, cover depends heavily on what you have in place before anything goes wrong. Insurers ask detailed questions about your security, price the answers, and can decline a claim that does not match what you told them. This guide explains what cyber insurance generally is, what South African insurers commonly ask small businesses to have in place, how claims get declined, how to prepare in 30 to 90 days, and a readiness check that shows where you stand. It is general information, not insurance, financial or legal advice, and IT-Support-SA is an IT company, not an insurance broker. For cover decisions, speak to a registered broker. IT-Support-SA provides IT support from Pietermaritzburg to businesses across KwaZulu-Natal and the rest of South Africa.

The Short Answer

Cyber insurers want proof that you have taken the basic precautions. The controls they ask about most are multi-factor authentication on email and remote access, backups kept off-site and tested, managed endpoint protection, regular patching with nothing unsupported, email filtering, staff training, a written incident plan and controlled access. Missing the first three can mean a declined application. Whatever you tell the insurer must be true when you apply and still true on the day of an incident, because a claim can be refused if it was not.

What Cyber Insurance Is (and Is Not)

Cyber insurance is a policy that helps with the financial fallout of a digital incident. Policies differ, but they commonly include some combination of:

Incident response costs: forensic investigation, restoring systems and data, notifying affected people, and legal and communications help.
Business interruption: income lost while systems are down.
Cyber extortion: costs linked to a ransomware demand, subject to the policy and the law.
Liability: claims from customers or others affected by a breach, and some regulatory costs.
Certain frauds: some policies cover funds lost to fake-invoice and impersonation fraud, often with lower limits or conditions.

What it is not: a replacement for security, a way to get your data back, or a guarantee. Cover has limits, an excess and exclusions, and many incidents fall partly or wholly outside it. Treat insurance as the last layer, behind the controls below, and ask your broker to walk you through exactly what is and is not covered.

Why Insurers Ask So Many Questions

Insurers have learned which basic controls make a successful attack much less likely and much cheaper to recover from. So the application is effectively a security review in the form of questions: do you use multi-factor authentication, where are your backups, who manages your computers, what happens when you are hit. Your answers decide whether you are offered cover, on what terms, and at what price. They also become the basis for any later claim.

That is why the best preparation is not clever wording. It is making the answers true.

The Controls Insurers Commonly Ask About

Multi-factor authentication

The question insurers ask first. Email and cloud sign-ins should need more than a password, for everyone, and so should administrator accounts and any remote access such as a VPN or remote desktop. Stolen passwords are behind much of the business email compromise and fraud that insurers pay for, so a missing multi-factor authentication answer is the quickest way to a decline. Our guide to invoice fraud and fake banking details emails shows how an unprotected mailbox leads to lost money.

Backups that survive an attack

Insurers want to know that if ransomware hits, you can recover without paying. That means at least one copy kept off-site and out of reach of an attacker, so that malware on your network cannot also encrypt or delete it, and a restore that has actually been tested. A backup on the same network as the server is not enough. Our guide to cloud backup explains the 3-2-1 rule, and our ransomware protection guide explains why backups are the layer that decides whether an attack is a bad week or the end of the business.

Managed endpoint protection

Free antivirus is rarely what insurers have in mind. They ask whether every computer and server runs protection that is centrally managed and monitored, with alerts going to someone who will act. Check that no machine is missing from the console.

Patching and nothing unsupported

Unpatched and unsupported systems are a known weakness, and some policies exclude losses that flow from them. Updates should be applied on a schedule, and no machine should run software its maker no longer supports. If you still have computers on Windows 10, see our guide to Windows 10 end of support.

Email filtering and domain protection

Most attacks begin with an email. Spam and phishing filtering, plus SPF, DKIM and DMARC for your domain, reduce the fake emails that reach staff and make it harder to send fake mail in your name. If you run Microsoft 365, the licence you choose decides which protections you get: see our comparison of Business Premium and Standard.

Staff training

A short, regular course on phishing and fake payment requests, with a record of who took it. It is the cheapest control on this list and the one people skip.

An incident response plan

A written plan for who to call, what to disconnect first and how to notify your insurer or broker, your customers or patients, and the Information Regulator. Insurers ask because a business with a plan recovers faster and wastes less of what the policy pays for. Keep a printed copy: your systems may be the thing that is down.

Controlled access

Individual logins, access matched to each role, and leavers removed on their last day. Our IT offboarding checklist covers the leaver side.

Check Where You Stand

Answer ten questions about your business. Your result updates as you go, with the critical controls flagged.

INTERACTIVE CHECK

Are you ready for a cyber insurance application?

Ten controls insurers commonly ask about. Answer honestly: this is a guide for you, not a form you submit.

The start-up answers describe a typical small business that has some protections but has not pulled them together: multi-factor authentication on some accounts but not administrators, backups that exist but have never been restored, and no written plan. The three controls marked critical decide the verdict on their own: a “no” on any of them keeps you at “not ready yet” however well you score elsewhere, because those are the gaps that most often end an application or a claim. Use the copy button to hand the gap list to your IT provider.

How Claims Get Declined

Most refused claims fall into a few patterns. Knowing them tells you what to protect:

A control that was not actually in place. You said you had multi-factor authentication or off-site backups, and the investigation after an incident shows they were missing, switched off or covered only some accounts.
An application that was not accurate. Rounding “mostly” up to “yes” on a form can come back later as a reason to refuse a claim.
Exclusions. Common examples include unsupported systems, certain categories of fraud, and losses that fall outside the policy wording. Read them before you buy.
Late notification. Policies usually require you to tell the insurer quickly and to involve their approved responders. Acting alone first can jeopardise cover.
Controls that lapsed. The backup job failed three months ago and nobody noticed.

The answer to all five is the same: make the controls real, keep evidence, and monitor that they keep running.

Getting Ready in 30 to 90 Days

A realistic order for a small business:

Week 1 to 2: the critical controls

Switch on multi-factor authentication for all email and cloud accounts, then for administrator and remote access.
Check your backups: where is each copy, can an attacker on your network reach it, and when did you last restore?

Week 2 to 4: prove it 3. Make sure at least one backup copy is off-site and protected, and run a restore test. Write down the date and the result. 4. Put managed endpoint protection on every computer and server. 5. Write a one-to-two page incident plan and print it.

Week 4 to 8: tidy up 6. Patch everything, and replace or isolate anything unsupported. 7. Set up email filtering and DMARC in stages. 8. Run a short training session and keep the attendance record. 9. Move to individual logins and remove old accounts.

Week 8 to 12: apply 10. Collect proof of each control: screenshots of settings, the restore test record and the plan. 11. Speak to a registered broker, answer the application accurately and keep a copy of your answers.

What About POPIA?

Insurance and POPIA are separate. POPIA requires reasonable security for the personal information you hold and requires you to notify the Information Regulator and affected people as soon as reasonably possible when it may have been accessed by an unauthorised person (Section 22). A policy may help pay for the response, but it does not remove the duty or the need for the controls. Our POPIA IT compliance checklist covers the technical measures, and if you run a clinic, see our guide to IT support for medical practices.

Questions to Ask a Broker

What exactly does this policy cover, and what are the main exclusions?
Which of my controls does the policy depend on, and what happens if one lapses?
What are the limits, the excess and any sub-limits for fraud and extortion?
How and how quickly must I notify you, and do I have to use your responders?
Is business interruption covered, and for how long?
Is cover for funds lost to fake-invoice fraud included, and on what conditions?
What evidence will you want if I claim?

How IT-Support-SA Can Help

We are not insurance brokers and cannot advise on policies, but we can get the technical side ready: switching on multi-factor authentication, setting up and testing off-site backups, rolling out managed endpoint protection and patching, configuring email protection, running staff training and helping you write an incident plan. We can review where you stand against the checklist above and give you a plain list of gaps in order of importance, with evidence you can show your broker. See our IT support services or get in touch. We support businesses across Pietermaritzburg, the KZN Midlands, Durban, Ladysmith, Johannesburg, Cape Town and all 9 provinces of South Africa. For what support costs, see our guide to IT support pricing in South Africa.

Mistakes That Cost Businesses Their Cover

Buying a policy first and fixing security later.
Answering “yes” when the honest answer is “partly”.
Multi-factor authentication on email only, with administrators and remote access still on passwords.
Backups that have never been restored.
Running unsupported software and assuming it will not matter.
No written plan, so the first call after an attack is a guess.
Not reading the exclusions.
Waiting to notify the insurer while trying to fix it quietly.
Assuming insurance replaces POPIA duties.

Conclusion

Cyber insurance is worth considering, but it rewards the businesses that have done the basics: multi-factor authentication, backups that survive an attack and have been tested, managed endpoint protection, patching, email protection, trained staff, a written plan and controlled access. Make those answers true before you apply, keep evidence that they stay true, read what the policy excludes and speak to a registered broker. Do that and insurance is a safety net under a business that was already hard to attack, not a hopeful promise on top of one that was not.

If you would like help closing the gaps before you apply, contact IT-Support-SA or WhatsApp us.

Cyber Insurance in South Africa: What Insurers Ask Small Businesses to Have in Place