Cyber Insurance Renewal for Singapore SMEs: What Insurers Now Make You Prove

The short answer: insurers no longer take your word for it. A cyber insurance renewal in Singapore now turns on documented evidence - multi-factor authentication on email and remote access, backups that have actually been restored and tested, endpoint protection that reports to a central console, a patch record with no end-of-support servers on it, a written incident response plan, and a payment verification process that two people follow. If you cannot produce that evidence, the renewal still happens, but on worse terms: a higher premium, a lower limit, a bigger deductible, or a social engineering exclusion that strips out the cover most SMEs actually claim on.

What has actually changed in SME cyber insurance?

Five years ago, a small company could get cover off a one-page proposal form and a modest premium. That market is gone. Underwriters have paid out on two claim types often enough to change how they price: ransomware that halts operations, and business email compromise, where a staff member pays a genuine-looking invoice into a criminal's bank account.

So the proposal form grew. Expect four to eight pages of control questions, and expect at least some of your answers to be treated as warranties rather than opinions. This is the part owners miss. If you tick yes to multi-factor authentication because your own login has it, and a claim later shows the compromised mailbox did not, the insurer can reduce or decline the payout. The premium is not the real exposure. A policy you paid for and cannot claim on is.

Which controls do insurers ask you to prove?

The list varies by insurer, but the same items recur, and all of them are now evidence-based rather than self-declared:

• MFA everywhere it matters - staff email, remote access, administrator accounts, and the admin consoles of Microsoft 365, Google Workspace or whatever runs your business. Partial coverage counts as no coverage.
• Backups with a tested restore - at least one copy offline or immutable, and a dated note of the last time someone restored from it successfully. An untested backup is a plan, not a control.
• Endpoint detection on every device, including servers, reporting to one console you can screenshot.
• Supported software only - Windows Server 2016 reaches end of support on 12 January 2027, and Windows 10 is already past its date. An unsupported system on your asset list invites a premium loading or an outright exclusion for anything that touches it.
• Email authentication and filtering - SPF, DKIM and a DMARC policy, plus filtering that catches lookalike domains. This is the control that blocks the fake-invoice email before a human has to judge it.
• Privileged access discipline - nobody does daily work from an administrator account, and departed staff lose access within days, not months.
• Payment verification - a written rule that any change of supplier bank details is confirmed by phone to a known number, and that transfers above a set amount need two approvers.

A documented incident response plan and a record of staff awareness training usually round out the form. Neither needs to be elaborate. Both need to exist on paper.

Why is a December or January renewal the worst possible timing?

Most SME policies renew at year end or in the first quarter, which puts the paperwork squarely inside the festive peak. Your team is at its busiest, your broker and the underwriter are taking leave, and by February the Chinese New Year shutdown removes another two weeks of working time.

The problem is that remediation is not instant. Rolling MFA across a 20-person company takes two to three weeks of scheduling, exception handling and a few frustrated phone calls, because somebody always has an old phone. Proving a restore takes a planned test. Replacing an end-of-support server is a procurement decision with a lead time. If you first read the questionnaire ten days before renewal, your only lever is price.

Start six to eight weeks before your renewal date. For a 1 January renewal, that means now.

What does a restricted renewal actually cost?

Typical SME policy limits sit somewhere between SGD 250,000 and SGD 1 million. The detail that decides whether that number means anything is the social engineering sublimit. If your cover for a fraudulently induced transfer drops from the full limit to SGD 50,000, and a staff member pays a SGD 180,000 invoice to the wrong account, you carry the difference. Recovery from the receiving bank is slow and usually partial.

Worth being clear on one point, because it is widely misunderstood: the shared responsibility framework that splits losses between banks, telcos and victims applies to individual phishing scams, not to company accounts. A wrong transfer out of your corporate account is your loss to chase.

There is a regulatory tail too. Under the PDPA, a notifiable data breach must be reported to the PDPC within three calendar days of you assessing it as notifiable, and affected individuals must be told. Financial penalties can reach up to 10 percent of annual turnover in Singapore for larger organisations, or up to SGD 1 million. Insurers ask about data retention for exactly this reason: the fewer old customer records you hold, the smaller the breach you can have.

How do you build the renewal pack without an IT department?

Treat it as one folder with seven items, owned by one named person. For most small companies this is about four hours of work, not a project:

1. An asset list - every server, laptop and cloud service, with its operating system and support status.
2. A screenshot showing MFA enforced for all users, not just enabled.
3. A dated restore test note: what was restored, by whom, how long it took.
4. A screenshot of your endpoint protection console showing device count and coverage.
5. Current patch status for servers and workstations.
6. Your DMARC record and filtering settings.
7. Two one-page documents: the payment verification rule, and who to call in the first hour of an incident.

That folder does three jobs. It gets you accurate answers on the form, it gives the underwriter something to price against instead of assuming the worst, and it is the first thing a loss adjuster asks for if you ever claim.

What should you do in the next three weeks?

Week one: pull your current policy and read the exclusions and sublimits, then ask your broker for this year's questionnaire in advance. Week two: answer it honestly and mark every gap in red. Week three: close the cheap gaps immediately - MFA, dormant accounts, the written payment rule - and get a quotation and a decision date for anything that needs money, such as a server refresh. Then go to renewal with the gaps closed and the evidence attached.

The companies getting sensible renewal terms this year are not the ones spending the most on security. They are the ones who can prove what they already have.

Frequently asked questions

Do we really need cyber insurance if we only have 12 staff?

Size is not what attracts the attack. A 12-person company with a public email address, a supplier payment run and customer records held in a cloud system has the same exposure profile as a larger one, with less ability to absorb a six-figure loss. The more useful question is whether your limit and your social engineering sublimit match the largest single payment your team makes in a normal month.

Will a CSA Cyber Essentials mark reduce our premium?

Not automatically, and no insurer should promise it will. What it does reliably is produce the evidence the questionnaire asks for, because the certification process forces you to document the same controls. Several insurers in the Singapore market view it favourably at underwriting. Ask your broker directly which of their panel does, before you spend on the certification.

Our renewal is in January and MFA will not be finished in time. What now?

Tell your broker before you submit, not after. A disclosed gap with a dated remediation plan is a negotiation; an undisclosed one is a potential claim denial. In practice you may get cover with a condition attached, giving you 60 or 90 days to complete the rollout. That is a far better position than a clean-looking form that fails under scrutiny.