Business
The plan that was never tested, the policy nobody read, the claim that was denied.
Insurers now ask about MFA, backups, awareness training and incident plans before quoting, and check them again when you claim. A BCP that has not been rehearsed fails on the day. Policies written for an auditor are ignored by staff. We produce short, usable versions of each, test the recovery, and make sure what you told the insurer is true.
- A policy set of a dozen pages that covers what matters and that staff can follow
- BCP and DR plans with recovery priorities, owners and contact trees, tested in a tabletop and a restore test
- Insurance readiness review against your proposal form and policy conditions
- Evidence file so the renewal questionnaire and any claim are answered from fact
Fixed price per component or as a package; the DR test and insurance readiness review are priced separately so you can start with what is urgent.
Typical engagement
- Review
- Write
- Test
- Maintain
Who this is for
- Companies buying or renewing cyber insurance and unsure whether they meet the conditions
- Organisations with backups that have never been restored under pressure
- Businesses whose policies are copied templates nobody has read
- Hospitals, manufacturers and institutions where downtime stops operations
- Companies that have had a claim questioned or denied
- Boards that want to know how long recovery would really take
What is included
Policy set
Information security, acceptable use, access control, data handling, incident response, backup, vendor and remote-work policies written short, in plain language, and mapped to ISO 27001, DPDP and insurer expectations.
Business impact analysis
Which systems and processes matter most, how long each can be down, and what the recovery order should be, agreed with the people who run them.
BCP and DR plans
Recovery procedures, roles, contact trees, communication templates and the decisions to be made in the first hours, for ransomware, data-centre or cloud outage, and loss of a key vendor.
Testing
A tabletop exercise with leadership and a technical restore test of critical systems from backup, with findings and fixes.
Insurance readiness review
Your proposal form and policy wording reviewed against your actual controls; gaps that could affect a claim identified and closed; guidance on notification duties and panel requirements.
Evidence file
Organised evidence of MFA, backups, training, patching, incident plan and testing, ready for renewal questionnaires, auditors and claims.
How we work
Review
Current policies, backup arrangements, insurance documents and recovery expectations gathered and compared with reality.
Write
Policies and plans drafted with the people who will use them, reviewed and approved.
Test
Tabletop and restore tests run, findings fixed, plans updated.
Maintain
Annual review and test, aligned with the insurance renewal.
What you walk away with
- Policies staff have read and can follow
- A recovery plan that has been rehearsed, with known recovery times
- Confidence that the insurance proposal reflects your real controls
- Evidence ready for renewal, audit and the day of a claim
What we do not do
We would rather lose an enquiry than mislead you.
- We do not sell or broker insurance and do not advise on which policy to buy; we make sure you can meet the one you have
- We do not run your backups; we verify that they can be restored
- A tested plan reduces downtime; it does not guarantee a particular recovery time in every scenario
Frequently asked questions
Why do cyber insurance claims get denied?
Commonly because a control stated on the proposal form, such as MFA on all remote access or offline backups, was not in place at the time of the incident, or because notification and panel conditions were not followed. The readiness review compares the form with reality and the policy with your incident process, so neither becomes a surprise.
We have backups. Is a DR plan still needed?
Backups are one input. A DR plan says what is restored first, by whom, onto what, with which credentials, and how long it takes. Companies with backups often discover during ransomware that the backup server was encrypted too, or that a full restore takes a week. The restore test finds this out on a quiet day.
How long should our policies be?
Short enough to be read. For most organisations under 500 staff, a core policy set of ten to fifteen pages in total covers what auditors, insurers and the DPDP Act require. Detail goes into procedures for the people who need them. Long policies are a sign nobody intends to follow them.
Can this be combined with ISO 27001 or DPDP work?
Yes, and it should be. The policies, business impact analysis and incident plan are required by ISO 27001, support the breach-notification duties under the DPDP Act and are exactly what insurers ask about on the proposal form. We write each document once, mapped to every framework you are working to, so you are not maintaining three versions that drift apart.
Tell us what you have and when renewal is
Existing policies and plans, backup arrangements, insurer and renewal date, and whether downtime has a known cost. We reply with a scope and fixed price within two working days.