Cyber Insurance for Singapore SMEs: What It Pays, What It Refuses, and What Underwriters Now Require

Cyber insurance for Singapore SMEs pays for the response to an incident, not for the incident itself. A typical policy funds the forensic investigation, the lawyer who tells you whether the breach is notifiable, the cost of notifying customers, lost income while systems are down, ransom payments where lawful, and any third party claim brought against you. What it refuses is almost always predictable: losses from controls you said you had but did not, money transferred out by a staff member who was tricked, and anything you already knew about when you signed the proposal form. Since 2024 the harder part is no longer the premium. It is qualifying at all, because underwriters now ask for proof of specific security controls before they will quote.

What does a cyber policy actually pay for?

Split it into two halves. The first half is your own costs, usually called first party cover. This is the part an SME actually claims on: an incident response firm to work out what happened, data restoration, business interruption while you are offline, and the cost of telling affected individuals. Under Singapore's PDPA you have to notify the PDPC no later than three calendar days after you assess a breach as notifiable, and notify affected individuals too. Three days is not long enough to shop for a forensics firm, which is the real value of a policy: the insurer's panel is on the phone the same day.

The second half is liability. If customer or supplier data leaks and someone sues, or the PDPC opens an investigation, the policy pays defence costs and, where insurable, the resulting settlement. For a small services firm holding client records, this is the tail risk that justifies the premium. For a trading or production business with little personal data, the business interruption cover usually matters more than the liability cover, and the policy should be priced accordingly.

What will the insurer refuse to pay?

Four refusals come up again and again, and three of them are avoidable.

Controls you declared but do not have. The proposal form asks whether you enforce multi factor authentication on email and remote access, whether backups are offline or immutable, and whether you patch within a set window. Answer yes, suffer a breach through a route that answer covered, and the insurer can decline. This is not an insurer behaving badly. It is the single largest cause of declined SME claims.

Social engineering and funds transfer fraud. If a staff member pays a fake supplier invoice, that is not a hacking loss. Most policies cover it only by a specific extension with a low sub limit, often a fraction of the main limit, and usually with a condition that you verify payment detail changes by phone. For many Singapore SMEs this is the loss most likely to happen, so check this clause before anything else.

Prior knowledge. Anything you were aware of before inception is excluded. If your IT provider has already flagged a compromised mailbox, disclose it.

Betterment and ordinary upgrades. The policy restores you to where you were. It does not fund the modern system you wish you had bought in 2024.

What do underwriters now require before they will quote?

Expect a short, specific list. Multi factor authentication on email, VPN, remote desktop and any administrator account. Backups that an attacker who owns your network cannot delete, which in practice means offline or immutable copies and a restore you have actually tested. Endpoint detection on every laptop and server, not just the free antivirus that came with Windows. A patching commitment, commonly critical fixes inside 14 to 30 days. Separate accounts for administrators, so nobody browses the web logged in as domain admin. Some insurers now ask about email filtering and staff phishing training as well.

Two things help a Singapore SME here. CSA's Cyber Essentials mark covers most of the same ground, so working through it gives you evidence an underwriter recognises. And if your team is on Microsoft 365 Business Premium or Google Workspace Business, you are probably already paying for the controls the insurer wants; they are simply switched off. Turning them on costs configuration time, not licence money.

What does it cost a 10 to 20 person company?

For a non regulated SME with modest revenue, a one million dollar limit commonly lands somewhere between about two and six thousand dollars a year, with a deductible of five to ten thousand. Firms holding large volumes of personal data, handling payments, or working in healthcare and finance pay more and face more questions. The useful comparison is not premium against zero. It is premium against the cost of three days offline, which for most SMEs is already larger than the annual premium.

Be honest about the limit. A one million dollar limit shared across forensics, interruption, notification and legal defence is thinner than it sounds. Ask the broker to model a realistic ransomware scenario against the limit and the sub limits, not just quote the headline figure.

What should you do in October, before renewal?

Three steps, in order. First, answer the proposal form truthfully, with your IT provider in the room, and fix anything you cannot honestly tick before you sign. Second, test a restore from backup and keep the dated evidence, because that one test is what turns a denied claim into a paid one. Third, write down who you call in the first hour: the insurer's hotline, your IT provider, and the person authorised to decide about notifying the PDPC. Put it on paper, because the incident that triggers the call may be the one that locks you out of your own systems.

Done in this order, cyber insurance stops being a document in a drawer and becomes what you are actually buying: a competent response team on a three day clock.

Frequently asked questions

Does cyber insurance cover a PDPC fine?

It generally covers the cost of defending a PDPC investigation and your legal and notification expenses. Whether the financial penalty itself is covered depends on the wording and on whether such a penalty is insurable in law, so treat the fine as your exposure and the defence cost as the insurer's.

We outsource IT. Are we covered by their insurance?

No. Your IT provider's policy protects the provider. If your customer data leaks, the obligation to notify and the claim from your customer both sit with you as the organisation that collected the data.

Is it worth buying if we only use cloud email and accounting?

Often yes, because cloud use concentrates risk in one set of logins. A single compromised mailbox can trigger both a notifiable breach and an invoice fraud. The relevant cover is the response and notification cost, which does not shrink just because you own no servers.