According to a Deloitte survey published in August 2026, there are around 72,000 cyber insurance policies in Switzerland. Among SMEs, only about one company in nine is insured. At the same time, insurers have raised their requirements considerably. Anyone taking out or renewing a policy today has to complete a questionnaire that looks more like an IT audit.
This article explains what cyber insurance covers, what insurers ask and what to watch out for when filling in the questionnaire.
What cyber insurance covers
Most policies have two parts. First party cover pays for costs in your own business: restoring systems and data, forensic investigation, business interruption and, depending on the contract, crisis communication. Third party cover handles claims from customers or partners, for example when their data has been leaked.
Many insurers also provide an emergency hotline with specialist firms who help within hours. For smaller businesses, this service is often worth more than the payout itself.
The measures insurers check
Questionnaires differ in detail, but the core points are always the same:
- Multi factor authentication for email, remote access and administrator accounts. Without MFA, many insurers reject the application. Our article on multi factor authentication shows how to introduce it.
- Backups that are separated from the network or immutable and tested regularly. The basics are covered by the 3-2-1 rule.
- Updates for operating systems, servers and firewall within defined timeframes. Systems without vendor support, such as Windows Server 2016 from January 2027, are judged harshly.
- Endpoint protection with a current solution that detects and reports suspicious behaviour.
- Separate administrator accounts that are not used for email or browsing.
- Staff training, especially on recognising phishing.
- An emergency plan that sets out who does what during an incident.
Be careful with the questionnaire
Your answers become part of the contract. If it turns out after an incident that a statement was wrong, the insurer can reduce or refuse payment. Typical pitfalls:
- MFA is active for most accounts, but not for an old service account or the software vendor’s access.
- A backup exists, but a restore has never been tested.
- One server still runs without updates because the software is not yet approved.
So do not fill in the questionnaire alone at your desk. Go through it point by point with whoever looks after your IT and write down what each answer is based on.
What insurance does not replace
A policy pays after the damage. It does not prevent the outage. No insurance can bring back customer data that has leaked, and customer trust cannot be bought. Technical measures therefore remain the foundation. Insurance covers the residual risk that cannot be reduced further with reasonable effort.
How we help
We review your IT against the usual insurance questions, close the gaps and give you a written summary you can use for the application. More under IT security.
Frequently asked questions
How much does cyber insurance cost for an SME?
The premium depends on turnover, industry, sum insured and the state of your IT security. For smaller businesses, premiums start at a few hundred francs per year. Good security measures have a direct effect on the price.
Does the insurance also pay a ransom?
This varies by contract and is restricted in many policies. More important is that working backups spare you from having to make that decision at all.
Is our general liability insurance not enough?
Usually not. Standard liability and property policies mostly exclude cyber damage or cover it only to a very limited extent. Ask your broker directly.
Do we have to meet every requirement before signing?
Some points, such as MFA and backups, are a precondition for many insurers. Others affect the premium. An honest questionnaire with a plan for open points is better than polished answers.
