Can I stack the free policy with a commercial one?

Not usefully – a commercial policy normally supersedes the free cover for the same loss. The benefit of being certified is reduced premiums on the commercial policy, not double cover.

Does the free policy cover ransomware payments?

Cover for extortion and ransomware response is included up to the £25,000 limit. Larger ransom demands typically need a dedicated commercial cyber extortion policy.

How much does a £1m standalone cyber policy cost a UK SME?

Typically £500–£2,000 per year for a small business with Cyber Essentials in place. Without CE, premiums are higher and some insurers will decline.

Does the free policy include directors' and officers' liability?

No. D&O cover is separate and not included in the bundled IASME policy.

Cyber Essentials Insurance vs Standalone Cyber Insurance

Quick comparison

	Free CE policy	Standalone commercial
Cover limit	£25,000	£250k – £10m+
Premium	£0 (bundled)	£500 – £10,000+ per year
Eligibility	UK org under £20m turnover	Any organisation
Incident response helpline	Yes (24/7)	Yes (usually)
Business interruption	Included to limit	Higher sub-limits available
Regulatory fines	Limited	Often broader
Third-party liability	Limited	Tailored

When the free policy is enough

Sole traders and freelancers with no client data at scale
Service businesses with no payment processing on owned systems
Organisations whose tender or contract requirements do not specify a higher limit

When to buy a standalone policy

You hold or process personal data for thousands of people
You process card payments outside a fully outsourced PCI environment
A client contract requires £1m or more of cyber liability cover
You are FCA-regulated, a law firm, or in another high-risk sector

Cyber Essentials still helps you on a standalone policy

Even when you buy a commercial policy, holding Cyber Essentials typically reduces the premium and unlocks better terms – many UK insurers now treat it as a minimum control. See all the benefits of Cyber Essentials.