In this guide · 8 sections
- 01What cyber insurance covers
- 02What cyber insurance usually excludes or limits
- 03How much cyber insurance costs in Singapore
- 04The security questions insurers ask
- 05Get your controls ready before you apply
- 06Is cyber insurance worth it for a small business?
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A small Singapore business can expect quotes starting around S$1,000 a year for S$250,000 of cover (broker figure reported in September 2026). Insurers typically require MFA on remote and admin access, offline or isolated backups and regular patching before they will offer good terms.
What cyber insurance covers
Every policy is different, so read the wording you are offered. As an example of a Singapore insurer's description, MSIG's cyber insurance page lists these main parts:
| Cover | What it pays for | Example |
|---|---|---|
| Incident response and cyber expenses | IT forensics, privacy response, data restoration | Specialists to find how attackers got in and clean systems |
| Remediation costs | Forensic fees, credit monitoring, PR, cyber extortion costs | Notifying affected customers and handling a ransom demand |
| Business interruption | Lost income while systems are down | A week without your booking or order system |
| Third-party liability | Claims, defence costs, fines and penalties for data protection breaches | Customers or partners claiming after a data leak |
| Regulatory penalties | Penalties to the extent insurable by law | A PDPA financial penalty, if insurable |
Many policies also give 24/7 access to an incident response panel: lawyers, forensic firms and negotiators the insurer has pre-approved. For a small business with no IT team, that access is often the most valuable part.
What cyber insurance usually excludes or limits
In an interview published by MSIG, its senior vice president for technical services set out common exclusions and limits in the Singapore market:
- Physical damage and bodily injury are not covered; other insurance lines handle those.
- War and state-sponsored attacks are excluded by most policies.
- Deductibles are high across the market, reflecting the cost of incident response.
- Ransom payments face regulatory limits such as anti-money laundering and sanctions rules, so reimbursement is not guaranteed.
- Social engineering (impersonation scams, business email compromise) may have lower limits or narrower terms.
- Weak security can mean more restrictive terms or no cover at all.
How much cyber insurance costs in Singapore
Insurers price each business individually. The Straits Times reported on 14 September 2026 that premiums have eased since their 2021 to 2022 highs, and quoted these broker and customer figures:
- Small business, revenue under S$2 millionFor S$250,000 of cover, per AWG Insurance Brokers (down from about S$2,000 in 2022)From about S$1,000/year
- Mid-market, revenue S$10m to S$50mFor S$2 million of cover, per the same brokerFrom about S$6,000/year
- One logistics SME (named in the article)For S$300,000 of coverS$980/year
Reported figures, not quotes. Your premium depends on your business and the insurer.
The same article lists what drives the price: company size, sector, where you operate, claims record, cyber defences, risk exposure, and the amount and breadth of cover. Healthcare and businesses handling payment data or large volumes of personal data usually pay more.
The security questions insurers ask
The application form is a security audit in disguise. MSIG's SME cyber proposal form is typical. It asks, among other things:
Typical cyber insurance questionnaire items
The Straits Times article adds that minimum requirements typically include MFA for all remote access, a backup strategy with offline or disconnected copies, and a formal patch-management process. Answer honestly: the Insurance Act requires you to disclose facts fully, and a wrong answer can void the policy when you claim.
Get your controls ready before you apply
Fixing the basics first can lower your premium and makes a claim less likely to be disputed. Most of these are quick for a small business on Microsoft 365 or Google Workspace.
Turn on MFA everywhere
Email, admin accounts, VPN or remote access, accounting and banking. Our MFA set-up guide walks through it.
Set up a backup that ransomware cannot reach
A separate backup of Microsoft 365 or Google Workspace and file servers, with its own login, tested by restoring a file. See whether you need to back up Microsoft 365 or Google Workspace.
Patch within 30 days
Turn on automatic updates for Windows, macOS, browsers and your website platform, and check monthly.
Reduce admin rights
Only the people who need admin access should have it, each with their own account and MFA.
Write a short incident response plan
Who to call, how to isolate a device, and the PDPA breach steps. Insurers ask whether you have one.
Train staff on scams
A short lesson on fake invoices, payment changes and phishing, repeated through the year.
These overlap heavily with CSA's Cyber Essentials mark; our Cyber Essentials checklist can double as your insurance preparation list.
Is cyber insurance worth it for a small business?
Worth considering if
- You hold customer personal data, payment details or health records
- A week offline would seriously hurt revenue
- Clients or tenders ask for proof of cyber cover
- You have no in-house IT person to lead an incident
Lower priority if
- You have not yet set up MFA and backups (do that first)
- Your systems are all low-risk SaaS with little personal data
- You cannot meet the questionnaire's basic controls yet
Check what you already have before buying. Some professional indemnity or business packages include limited cyber cover. A licensed broker can compare policies; the General Insurance Association of Singapore lists member insurers. If an incident happens, report it to SingCERT and follow our ransomware response guide.
Do it yourself or get help?
You can complete the proposal form yourself if you know your settings. Many owners do not, and guessing is risky.
A Security Health Check (S$290) reviews your email, website and Microsoft 365 or Google Workspace settings and gives you a written fix list you can use for the questionnaire. Backup & Ransomware Recovery (S$290) sets up a separate backup with a tested restore. The Incident & Ransomware Response Plan (S$390) includes a contact sheet with your insurer, SingCERT and police. IT Sorted does not sell insurance or earn commissions from insurers.
Frequently asked questions
It depends on revenue, sector, data held and security controls. In September 2026, The Straits Times quoted AWG Insurance Brokers saying businesses with revenue under S$2 million could get S$250,000 of cover from about S$1,000 a year. Get quotes through a broker or insurer for your actual premium.
Some policies include cyber extortion cover, but reimbursement is restricted by anti-money laundering and sanctions rules, and insurers may refuse if funds could reach a sanctioned group. Singapore authorities generally advise against paying. Tested offline backups remain the most reliable way to recover from ransomware.
Some policies cover regulatory penalties, including data protection penalties, only to the extent they are insurable by law. Whether a particular PDPA financial penalty can be insured is a legal question, so check the policy wording and ask the insurer. Defence costs and breach response costs are more commonly covered.
You may be. Insurer proposal forms ask whether MFA is mandatory for remote access and administrator accounts, and reporting in 2026 describes MFA as a minimum requirement. Without it you may face higher premiums, exclusions or a declined application. MFA is free to switch on in Microsoft 365 and Google Workspace.
Sometimes, under a separate social engineering or funds transfer fraud section, often with a lower limit than the main policy. Insurers are narrowing these terms because the losses are hard to verify. Ask specifically whether paying a fake invoice is covered and what checks, such as call-backs, are conditions of cover.