CFC cyber insurance requirements mapped to SMB1001 Bronze, Silver and Gold
Cyber insurance proposals have moved well beyond simple questions about antivirus and firewalls.
CFC asks about endpoint protection, EDR, MFA, backup security, restore testing, vulnerability scanning, penetration testing, phishing simulations, privileged access, network monitoring, patching and incident response.
That is why SMB1001 is useful.
How CFC cyber insurance questions line up with SMB1001 Bronze, Silver and Gold.
Cyber insurance questionnaires are no longer light-touch. Providers such as CFC ask detailed questions about EDR, MFA, backups, vulnerability scanning, phishing testing, email security, patching, privileged access, monitoring and incident response.
SMB1001 can help build that foundation. Where insurer requirements go further, the wider Black Swan security stack can help close the gap.
Important caveat: SMB1001 does not guarantee cyber insurance approval and it does not replace CFC’s own underwriting requirements. It can help you evidence practical controls and prepare better answers.
The areas CFC digs into.
These questions go beyond basic box-ticking. They are really checking how well protected, monitored and recoverable your business is.
Endpoint protection and EDR
What you use, whether EDR is deployed properly, and how it is monitored and managed.
MFA and remote access
MFA on remote access, company email and cloud systems holding sensitive data.
Backups and restore testing
How backups are stored, secured, separated and tested for full recovery.
Vulnerability and penetration testing
Whether the perimeter is scanned regularly and whether penetration testing is carried out.
Email and phishing controls
Email filtering, phishing simulations and signs that staff are being prepared for real attacks.
Monitoring and response
Privileged account protection, network monitoring, patching discipline and incident response maturity.
Where Bronze, Silver and Gold fit.
Think of SMB1001 as a staged route. Bronze gets the foundations in place. Silver strengthens the controls that matter day to day. Gold gives a stronger insurer story, especially when paired with managed security tools.
Bronze
Foundational cyber hygiene
- Firewall, antivirus and patching fundamentals.
- Backup and recovery basics.
- Password hygiene and staff awareness.
- Best for businesses starting to tighten core controls.
Silver
Stronger day-to-day controls
- MFA on email and stronger account control.
- Password manager, anti-spoofing and server patching.
- Better fraud controls and stronger cyber discipline.
- A more credible starting point for insurer conversations.
Gold
Strongest SMB1001 tier we provide
- EDR, stronger MFA coverage and tighter remote access control.
- Cybersecurity policy and incident response planning.
- A stronger cyber insurance position.
- Can be supported by the wider stack where insurers expect more.
CFC-style requirements mapped to SMB1001 and the wider stack.
| CFC-style area | Where SMB1001 helps | Where the wider stack may be needed |
|---|---|---|
| Endpoint protection / EDR | Bronze covers baseline protection. Gold strengthens this with EDR requirements. | Huntress EDR or Heimdal NGAV for stronger endpoint protection. |
| MFA on email, cloud and remote access | Silver introduces stronger MFA and account control expectations. | Huntress ITDR, Microsoft 365 hardening and conditional access guidance. |
| Backups and restore testing | Bronze includes backup and recovery basics. | ConnectWise Cloud Backup and Axcient for stronger recovery evidence. |
| Email security and phishing | Silver supports anti-spoofing and stronger email controls. | Avanan email security, Sendmarc DMARC and security awareness training. |
| Patching and vulnerability reduction | Bronze and Silver support patching discipline and safer configuration. | Heimdal Patch & Asset Management and vulnerability scanning where required. |
| Incident response planning | Gold includes incident response planning and stronger cyber discipline. | Managed monitoring, response support and documented playbooks for insurer evidence. |
Bronze
A useful starting point for foundational controls such as antivirus, patching, backup, passwords and awareness.
Silver
A stronger fit for MFA, email authentication, access control and fraud-related controls.
Gold
A stronger route for businesses needing EDR, incident response planning and better insurance evidence.
It can help you prepare better answers.
- Give structure to common cyber insurance controls.
- Help evidence patching, backup, training and access controls.
- Support a staged route from basic controls to stronger defence.
- Highlight gaps before an application or renewal.
- Give smaller businesses a practical route to improvement.
It does not override insurer requirements.
- It does not guarantee CFC approval.
- It does not replace CFC’s own questionnaire.
- It does not remove the need for accurate answers.
- It does not replace broker or insurance advice.
- It does not help if controls are claimed but not actually deployed.
Tools that help close the gap between certification and insurer expectations.
Huntress EDR
Managed endpoint detection and response for stronger monitoring and containment.
IdentityHuntress ITDR
Detect suspicious Microsoft 365 activity and identity-led threats.
PatchingPatch Management
Keep systems updated and reduce avoidable vulnerability risk.
M365 backupMicrosoft 365 Backup
Recover emails, OneDrive files and SharePoint data.
RecoveryServer & Endpoint Backup
Recover critical systems and files after deletion, failure or ransomware.
Email securityAvanan Email Security
Reduce phishing, malicious links and account takeover risk.
DMARCSendmarc
Strengthen DMARC, SPF and DKIM to reduce spoofing.
TrainingSecurity Awareness Training
Help staff recognise phishing, fake links and risky requests.
CFC cyber insurance and SMB1001 support in Chesterfield, Derbyshire and South Yorkshire.
Black Swan Cyber Security Solutions is based near Chesterfield and helps micro and small businesses across Chesterfield, North East Derbyshire, Sheffield and the surrounding areas improve cyber insurance readiness.
We support local accountants, consultants, trades businesses, charities, care providers and professional services firms with practical controls, evidence gathering and certification support.
Chesterfield businesses
Support for businesses in Chesterfield, Hollingwood, Brimington, Staveley, Clay Cross and nearby areas.
North East Derbyshire
Cyber insurance readiness support for Dronfield, Eckington, Wingerworth and surrounding villages.
Sheffield and South Yorkshire
Support for small businesses that need clearer evidence for insurance, tenders and client assurance.
CFC, SMB1001 and cyber insurance questions small businesses often ask.
Does SMB1001 guarantee CFC cyber insurance approval?
No. SMB1001 can help evidence practical controls, but CFC will still assess your business, answers, risk profile and policy requirements.
Which SMB1001 level is best for CFC-style questions?
Bronze helps with core foundations, Silver is a stronger starting point for MFA and email controls, and Gold is better aligned where EDR and incident response planning are expected.
What if CFC asks for controls SMB1001 does not fully cover?
The wider security stack can help close the gap. That may include EDR, identity monitoring, Microsoft 365 backup, endpoint backup, email security, DMARC and patch management.
Can you help us answer insurance questions?
We can help review your technical controls, identify gaps and gather clearer evidence. We cannot answer insurance questions dishonestly or replace broker advice.
Can this help if we have been declined?
Yes. A readiness review can help identify the gaps that caused concern and give you a practical route to improve before reapplying or renewing.
Find the gaps before the insurer does.
We can help you map your current controls against CFC-style questions, identify gaps and decide whether SMB1001 Bronze, Silver or Gold is the right route.
No jargon. No false promises. Just practical help.
Backed by the world's leading cyber defenders
Meet Kevin: Founder & lead security consultant
Kevin has spent over 20 years solving real-world IT and cyber security challenges for organisations like yours. His approach is refreshingly straightforward: listen first, understand your constraints, then build security that actually works within your budget and compliance requirements.
Beyond technical expertise, Kevin brings a deep understanding of how organisations really operate, gained through years serving as a Parish Councillor, school governor, and charity trustee. He knows what it’s like to balance competing priorities, stretch budgets, and maintain public trust.
Whether you’re dealing with a security incident or simply want an honest assessment of your current protection, Kevin provides clear guidance without the sales pitch.
Ready to discuss your security needs?
Contact Kevin directly – no lengthy sales process, just practical advice from someone who genuinely wants to help.
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.