New ransomware reporting rules put SME cyber cover under scrutiny

The rule is designed to give government agencies a clearer picture of cyber extortion activity across the economy. For businesses, however, the immediate question is operational: who decides whether an incident is reportable, who gathers the required information, and how does that process fit with insurer notification, legal advice, IT containment and customer communication?

This matters because ransomware events often unfold quickly. A business may be locked out of systems, unable to invoice, unable to access booking platforms, or facing pressure from attackers claiming to hold sensitive data. In that moment, delays and confusion can affect recovery, compliance and the strength of an insurance claim. Cyber policies commonly include conditions around prompt notification, approved incident response providers and consent before certain costs are incurred. Those conditions should be understood before an attack happens.

The reforms are also a reminder that cyber security and cyber insurance should work together. Insurance can help fund specialist response costs, forensic investigation, legal support, data restoration, crisis communications and business interruption losses, depending on the policy. It is not a substitute for controls such as multi-factor authentication, offline backups, patching, staff training and clear payment authorisation procedures.

Business owners should consider three immediate actions. First, check whether the reporting threshold may apply now or in the near future as revenue grows. Secondly, review cyber cover for ransomware, extortion, business interruption, incident response panel requirements, sub-limits and exclusions. Thirdly, update the incident response plan so finance, IT, management and external advisers know their roles.

An insurance broker may be able to help identify whether current cover reflects the way the business operates, including cloud systems, outsourced providers, remote workers and stored customer information. The key message is simple: ransomware is no longer only an IT problem. It is a governance, cash flow, compliance and insurance issue that should be planned for before a breach occurs.