Cyber insurance in the UAE has changed. After years of ransomware losses, insurers and reinsurers now underwrite on evidence: a detailed proposal form, sometimes an external scan of your attack surface, and warranties that specific controls are in place. Organisations that cannot show multi-factor authentication, endpoint detection and response, tested backups and privileged access control are quoted higher premiums, offered narrower cover or declined. This guide lists the controls UAE cyber insurers typically require, explains how they affect premiums and claims, and shows how to prepare before you apply or renew.
Key Takeaways
- Insurers now require a documented baseline of controls, led by MFA on email, remote access and privileged accounts, EDR on all endpoints and offline or immutable backups.
- Proposal forms are warranties: an inaccurate answer can void cover or lead to a declined claim after an incident.
- Expect questions on patching cadence, email security, privileged access management, security awareness, incident response planning and vendor risk.
- Stronger controls lower premiums and deductibles and widen cover for ransomware, business interruption and regulatory costs.
- Cyber insurance complements, and never replaces, a security programme; policies exclude unpatched known vulnerabilities, war and nation-state attacks in many wordings and failures to maintain warranted controls.
Why Insurers Tightened Requirements
Ransomware, business email compromise and supply-chain incidents produced heavy claims across the region, and reinsurers responded by demanding better risk selection. UAE businesses have been prominent targets for invoice fraud and extortion, which our analysis of business email compromise in the UAE describes. The result is underwriting that looks more like a security audit: longer questionnaires, external scans, calls with your IT lead and conditions attached to the policy.
The Controls Most UAE Cyber Insurers Require
Multi-factor authentication. MFA on all email accounts, all remote access including VPN and remote desktop, all administrative and privileged accounts and, increasingly, all cloud and SaaS applications. This is the single most common reason for declined applications. Our IAM best practices guide covers how to roll it out without disruption.
Endpoint detection and response. EDR or XDR deployed on every workstation and server, with 24/7 monitoring either in-house or through an MDR provider. Traditional antivirus alone is no longer accepted by most carriers.
Backups. Regular backups that are encrypted, stored offline or in immutable storage, separated from production credentials and tested for restoration at least quarterly. Insurers ask for the restore test evidence.
Privileged access management. No standing domain administrators for daily work, separate admin accounts, vaulted credentials and session monitoring for privileged users. See our guide to privileged access management.
Patch and vulnerability management. Critical patches applied within defined windows, typically 14 to 30 days, with no unsupported operating systems on the network and regular vulnerability scanning.
Email security. Advanced phishing protection, attachment sandboxing, link protection and DMARC enforcement to stop spoofing of your own domain.
Security awareness and phishing simulation. Annual training for all staff and periodic simulated phishing, with results recorded. Our guide to running a phishing simulation explains the programme insurers like to see.
Incident response plan. A documented, tested plan with named roles, a retained incident response provider and the insurer’s notification requirements built in. Our incident response planning guide shows what a defensible plan contains.
Network security and segmentation. Managed firewalls, segmentation of critical systems, no exposed remote desktop and secured remote access.
Logging and monitoring. Centralised logging with retention, and monitoring through a SOC or MDR service for larger risks.
Vendor and payment controls. Dual authorisation and call-back verification for payment changes, and due diligence on suppliers with system access. Our third-party risk management guide covers the supplier side.
How Controls Affect Premiums, Deductibles and Cover
Underwriters price on three things: the likelihood of a claim, its probable size and the quality of your evidence. Each control above reduces one or more of those. In practice, organisations that can evidence the full baseline typically secure materially lower premiums and deductibles than those with gaps, and are offered broader cover including ransomware extortion, business interruption, data restoration, regulatory investigation and third-party liability. Organisations with gaps may be offered cover with ransomware sub-limits, co-insurance clauses or exclusions until controls are fixed.
Proposal Forms Are Warranties: Answer Accurately
The questionnaire you sign forms part of the contract. If you state that MFA is enforced on all remote access and an incident later shows an unprotected VPN account, the insurer may reduce or deny the claim. Before submitting, validate each answer with technical evidence: an MFA enforcement report, an EDR deployment coverage report, backup restore logs and patch compliance dashboards. If a control is partial, say so and attach a remediation date; underwriters respond better to honesty with a plan than to discovery after a loss.
What Cyber Insurance Does Not Cover
Policies vary, but common exclusions include losses arising from failure to maintain warranted controls, known but unpatched vulnerabilities beyond a stated period, war and some state-sponsored attacks, contractual penalties, infrastructure failures, prior known incidents and, in some wordings, regulatory fines where uninsurable by law. Cyber insurance transfers part of the residual financial risk; it does not reduce the likelihood of an attack. Pair it with a programme built on frameworks such as the UAE IA Standards or ISO 27001.
A 60-Day Pre-Application Checklist
- Run a gap assessment against the control list above and your insurer’s proposal form.
- Enforce MFA on email, VPN, remote desktop, admin accounts and critical SaaS.
- Deploy EDR to 100 percent of endpoints and arrange 24/7 monitoring.
- Verify immutable or offline backups and complete a documented restore test.
- Remove standing admin rights and vault privileged credentials.
- Patch all critical vulnerabilities and retire unsupported systems or isolate them.
- Enable DMARC enforcement, phishing protection and payment call-back procedures.
- Update and test the incident response plan, including insurer notification steps.
- Deliver security awareness training and a phishing simulation; keep the records.
- Assemble an evidence pack so every questionnaire answer has a document behind it.
Our ransomware readiness checklist overlaps almost entirely with this list, which is no accident: insurers are pricing the same risks you should already be managing.
Frequently Asked Questions
Is cyber insurance mandatory in the UAE?
No federal law requires cyber insurance, but many enterprise customers, government tenders and financial counterparties require suppliers to hold it, and some regulated sectors are expected to assess insurance as part of risk management. Demand is driven by contracts and risk appetite rather than statute.
What security controls do cyber insurers require?
Most insurers require multi-factor authentication on email, remote access and privileged accounts, endpoint detection and response on all devices, tested offline or immutable backups, privileged access management, timely patching, email security with DMARC, security awareness training, a tested incident response plan and basic vendor controls.
Can an insurer refuse a claim because of a security gap?
Yes. Proposal form answers are warranties. If an incident reveals that a warranted control was not in place, such as MFA on a compromised account, the insurer may reduce or deny the claim. Accurate answers with evidence are essential.
How much does cyber insurance cost in the UAE?
Premiums depend on revenue, sector, data volumes, claims history and the strength of your controls. Organisations with a complete control baseline typically secure significantly better rates and broader cover than those with gaps. Brokers can provide indicative pricing once a proposal form is completed.
Does cyber insurance cover ransomware payments?
Many policies cover extortion costs, negotiation, data restoration and business interruption, often subject to sub-limits and conditions such as the insurer’s consent and sanctions checks. Paying a ransom may also be restricted by law or policy in some circumstances, so involve the insurer and counsel immediately.
What should I prepare before a cyber insurance renewal?
Refresh your evidence pack: MFA and EDR coverage reports, backup restore tests, patch compliance, awareness training records, incident response test results and a summary of any security improvements since the last renewal. Changes in controls should be reported to the broker.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA helps UAE organisations close the gaps insurers look for through managed detection and response, privileged access management, email security and backup and continuity planning, and can prepare the evidence pack for your proposal form. Request a cyber insurance readiness assessment. This article is general information, not insurance or legal advice.