Governance and Policy ManagementCyber Insurance in the GCC: What Underwriters Look For
A cyber insurance application can expose weaknesses that never appeared on a compliance dashboard.
The questionnaire asks whether MFA is enforced. The IT team replies that MFA is enabled. The underwriter then asks whether it covers email, remote access and privileged accounts.
That second question changes the answer.
Cyber insurance underwriting increasingly examines whether controls are implemented across the exposure that matters, not whether an organization owns the technology.
This is becoming more relevant across the GCC. The UAE Cybersecurity Council estimated the country’s cyber insurance market at approximately US$70 million in 2026 and expects demand to continue increasing. QBE’s 2026 UAE research found that 65 percent of surveyed businesses with 100 to 2,000 employees had cyber insurance, while 27 percent still lacked an incident response plan.
The underwriting process varies by insurer and policy. There is no universal checklist. Certain controls, however, appear repeatedly because they materially affect the likelihood or severity of a claim.
Insurance Complements Controls
Regulators in the region are clear about the order of priority. Article 7.5 of the CBUAE Operational Risk Management Regulation states that risk transfer tools such as insurance may complement internal operational risk management and controls, but not replace them. A report from the UAE Cybersecurity Council in May 2026, as covered by Conflict Advisory Group, makes the same point and says the Council expects premiums to increase significantly through 2026 and beyond.
Cover helps recover costs. It does not stop an attack, and underwriters price that difference.
The Controls Underwriters Check First
Control | What the underwriter asks | Evidence to export |
Multi-factor authentication | Is it enforced on email, remote access, and admin accounts? | MFA coverage report from the identity provider |
Endpoint detection and response | Is it deployed on every endpoint and server, and who monitors alerts around the clock? | Coverage percentage and the monitoring contract |
Backups | Are they immutable or offline, separated from production credentials, and restore-tested? | A dated restore test result |
Incident response plan | Is it written, with named roles, and exercised in the last 12 months? | Signed plan and tabletop report |
Patch management | Is there a documented schedule for critical fixes? | Patch timeline and compliance report |
Privileged access | Are admin accounts vaulted and separate from daily accounts? | Access review records |
Vendor risk | Are vendor access and assessments controlled? | Supplier register and assessments |
Awareness training | Is there phishing simulation with completion records? | Training logs |
The list follows UnderDefense’s readiness checklist, with the evidence expectations from Basg Corp, Valuealigners, and Compyl. Compyl adds that coverage percentage matters more than product name, which is why a license count is not evidence.
What a UAE Proposal Form Asks
Tameen Insurance, a UAE broker, describes a cyber proposal form of 30 to 80 questions covering EDR or XDR coverage percentage, the incident response plan and when it was last tested, and a five-year incident history. Its pricing assumes baseline hygiene: MFA on admin and email accounts, EDR, tested offline backups, and a documented response plan.
Tameen also lists how gaps change the outcome. No MFA on email, VPN, and admin accounts likely means a declined application. No EDR means a higher rate or a sub-limit. No tested backups means a ransomware sub-limit, often 25 to 50 percent of the policy limit. No documented response plan means cover with a higher retention. These are one broker’s observations, so confirm terms with your own broker.
Why Claims Get Reduced or Denied
The attestation and the reality differ: 3rd Element Consulting reports the most common reason is that controls listed on the application were not fully in place when the incident happened, such as MFA turned on but not enforced consistently, backups never tested, or a response plan mentioned but never written.
Insurers verify: HumaCentric notes insurers increasingly check controls through outside-in scans and third-party audits, and MacroTG reports gaps are increasingly treated as material misrepresentation.
Evidence is the new form: MacroTG says underwriters now want exportable reports proving each control, and the forensic teams hired after an incident look for the same records.
Underwriters Want Evidence, Not Policy Language
This is where insurance readiness begins to resemble compliance readiness.
A policy saying MFA is required does not prove MFA is enforced.
A backup standard does not prove restoration was successful.
An incident response procedure does not prove the team has rehearsed it.
Evidence gives the underwriter confidence that the declared controls exist in practice.
Complyan Audit and Compliance Management can help maintain current evidence against controls throughout the year so renewal does not become a scramble for screenshots and reports.
This also reduces another important risk: inconsistent answers.
The insurance application should describe the environment accurately. Overstating control coverage to obtain better terms can create serious problems when a claim is reviewed.
See What the Underwriter Sees First
Because insurers use outside-in scans, check your own external footprint before they do. This is practical guidance: look for exposed remote access services, missing email authentication, and internet-facing systems nobody remembers owning. UnderDefense lists email authentication with SPF, DKIM, and DMARC set to reject among the eight controls underwriters check first.
Choosing Limits and Retention With Data
This is practical guidance. Estimate the cost of a realistic ransomware event for your most critical system, covering downtime, restoration, legal and notification costs, and customer impact. Compare it with the policy limit, then read the sub-limits, because Tameen’s range suggests a ransomware sub-limit can cut effective cover well below the headline figure. Ask the broker which controls change the retention, and match each to your evidence file.
A 90-Day Plan Before Renewal
This plan is practical guidance, not CBUAE text.
Map Critical Operations and their dependencies: Complyan’s third-party risk management keeps suppliers and intragroup providers attached to what they support, which feeds the Article 3.4 mapping.
Define high-risk criteria and approve them at Board level: Complyan’s governance and policy management tools hold the approved criteria, owners, and review dates.
Build and rehearse the 4, 24, and 72-hour workflow: keep a notification log with timestamps. Complyan’s audit and compliance management platform maps the log, test results, and approvals to controls.
Express cyber risk against disruption tolerance: Complyan’s cyber risk management platform holds scored risks next to the appetite statements the Board approves.
Report to the Board with current data: Complyan’s executive and board reporting gives directors a live view of testing results and open gaps.
Map once across other UAE frameworks: institutions also work with UAE IA and, in Dubai, DESC requirements, and one control record can serve each.
Common Mistakes
Answering from memory: a form completed by one person without checking the records invites a gap between the answer and the facts.
Treating MFA as done once enabled: enforcement and coverage are what the report shows, not the setting.
Skipping the restore test: a backup job that runs nightly says nothing about whether the restore works.
Frequently Asked Questions About Vendor Risk Scoring
Is there one standard cyber insurance checklist?
No. Underwriting requirements vary by carrier and policy. MFA, endpoint detection, backups and incident response are among the controls commonly assessed.
Can missing MFA affect cyber insurance coverage?
Yes. Weak MFA coverage can affect pricing or underwriting appetite because credential compromise remains a major attack path.
Does compliance guarantee cyber insurance approval?
No. Compliance can provide useful evidence, but underwriters assess the organization’s specific exposure and controls.
Why does third-party risk matter to insurers?
A supplier compromise can cause data loss or business interruption even when the insured organization’s own infrastructure was not directly breached.