Hiscox don’t publish a neat checklist of cyber insurance requirements.
There’s no single page that says:
“You must have MFA, EDR, backups and patching or you won’t get cover.”
But if you look at their guidance, reports and proposal approach, a clear pattern emerges.
They’re not avoiding the question.
They’re just expecting businesses to already understand it.
Why Hiscox don’t publish a simple checklist
Unlike some insurers, Hiscox focus heavily on:
- cyber readiness
- risk management
- incident response
- ongoing maturity
Their own Cyber Readiness model assesses businesses across people, process and technology rather than a simple pass/fail checklist.
That tells you something important:
They’re not just asking “do you have security tools?”
They’re asking “how mature is your business overall?”
What Hiscox actually expects (based on their guidance)
When you pull together Hiscox blogs, FAQs and readiness content, the same core controls appear again and again.
Let’s break them down.
1. Identity & access (MFA is baseline)
Hiscox consistently recommends:
- Multi-factor authentication (MFA) on accounts
- Strong password practices and password managers
They explicitly highlight MFA as a key defence against account compromise.
What this means in practice:
- MFA on email (critical)
- MFA on remote access
- MFA on cloud systems
If this isn’t in place, insurers will see it as avoidable risk.
2. Endpoint & network protection
Hiscox guidance points to:
- Security software (AV, firewall, protection tools)
- Network protection and threat detection
They recommend using reputable security software across devices to detect and block threats.
Translation:
- Endpoint protection is expected
- Increasingly, this means EDR rather than basic antivirus
3. Patch management (quiet but critical)
Hiscox repeatedly stress:
- Keeping systems and software up to date
- Applying updates quickly to reduce vulnerabilities
Why this matters:
Outdated systems are one of the easiest ways attackers get in.
Insurers see poor patching as:
- preventable
- avoidable
- high risk
4. Backups & recovery (and testing)
Hiscox guidance is clear:
- Back up data regularly
- Store backups securely (cloud or offline)
- Be able to recover after an incident
They also highlight backups as key to avoiding ransomware impact.
What this means:
- Backups must exist
- They must be protected
- They must actually work
5. Email security & phishing risk
Hiscox highlight phishing as a major attack vector:
- Employees clicking malicious links
- Data being exposed through human error
They also recommend:
- training
- awareness
- prevention techniques
Translation:
- Email security matters
- Staff behaviour matters just as much
6. Incident response (this is big for insurers)
Hiscox explicitly advise:
- Having an incident response plan
- Defining roles and responsibilities
- Preparing for breaches in advance
They also suggest:
- documenting systems
- mapping networks
Why insurers care:
If something goes wrong:
- how fast can you respond?
- how much damage can you limit?
7. Visibility & control of your environment
Hiscox recommend:
- understanding your network
- mapping systems and access points
Translation:
- asset visibility
- network awareness
- ability to investigate incidents
8. Cyber maturity (not just tools)
The biggest difference with Hiscox is this:
They assess maturity, not just controls.
Their model looks at:
- people (training, behaviour)
- process (policies, response)
- technology (tools and controls)
What this means in the real world
Even though Hiscox don’t publish a strict checklist, their expectations align closely with what most insurers now require:
- MFA
- Endpoint protection
- Patch management
- Backups
- Awareness training
- Incident response
Across the wider insurance market, these are now considered minimum baseline controls.
Where businesses usually fall short
From experience, most organisations don’t fail because they have nothing.
They fail because:
- MFA isn’t enforced everywhere
- Not all devices are protected
- Backups exist but aren’t tested
- Patch processes are unclear
- No incident response plan exists
- Staff are still vulnerable to phishing
That’s the gap insurers are quietly assessing.
The key difference vs CFC
If you compare:
- CFC → asks detailed, explicit questions
- Hiscox → assesses overall maturity and readiness
Both lead to the same place:
Insurers want to see that your business:
- reduces risk
- manages incidents
- can recover quickly
Hiscox may not hand you a checklist.
But their guidance makes one thing clear:
You’re expected to have a baseline level of cyber security, supported by processes, people and evidence.
Not just tools.
If you’re applying for cyber insurance, the real question isn’t:
“Do we have antivirus and backups?”
It’s:
“Could we confidently demonstrate that our business is well-managed from a cyber risk perspective?”
That’s what insurers like Hiscox are really looking for.
