Independent UK care editorial Evidence · leadership · action

AboutMethodologyContact
CARE CIRCLENETWORK

See the change. Examine the evidence.
Understand what it means for care.

Editorial intelligenceCare outlook 2026/27
Menu

Sponsored programme with Acrisure

November continuation / 07 / Cyber insurance & evidence

Care cyber insurance: follow the dependency before the declaration

A care organisation can describe its own devices accurately and still depend on services it does not control. The insurance discussion needs to follow those dependencies, the responsibilities behind them and the evidence supporting the answers.

Nominated Care & Commercial Insurance PartnerExplore Acrisure’s expertise
Care Circle Network Editorial DeskPublished 7 November 2026 · Reviewed 7 November 20266 min read · November 2026 coverage
Provider outcomeThe cyber dependency and declaration evidence record
Practical supportReview and downloadable working record
Evidence and geographyUK provider discussion. England care guidance and each professional source retain their stated scope.
In this feature

The story so farPHP and supplier accountability

Ask who keeps a digital care record available and the answer may involve several organisations. The platform, hosting, connectivity, devices and identity service can sit under different arrangements. The registered manager experiences them as one essential function: the right colleague being able to reach reliable information when care requires it.

Our PHP reporting opened the supplier-assurance question in October. The 4 November features followed it into access, care recovery and new support offers. NCSC’s annual review, published on 3 November, provides the wider incident and dependency context. [1] This continuation brings that operating reality into the insurance conversation.

The priority is an honest, intelligible account of the service. A confident declaration is useful when the people signing it understand its scope, the evidence behind it and the exceptions that still need attention.

Map one essential function through the organisations behind it

Choose a care function, such as authorised access to current visit information. Record the applications, connections, devices, people and support organisations on which it depends. Identify the contracting legal entity and the relevant service agreement, including who can act outside ordinary hours.

DHSC’s September supplier guidance distinguishes support scope, service hours and response commitments. [2] Use those questions against the actual contract. Acknowledging a ticket and restoring a usable service may be different commitments. Ask who coordinates if the platform and local IT team each need another party to act. In a group, identify shared dependencies that could affect several locations together, while keeping local circumstances and authority visible.

Take supplier failure to the broker as a defined scenario

Describe separately an attack on the provider, an outage at its platform and a precautionary interruption while facts are investigated. Ask the adviser which policy provisions, if any, would be relevant, how the dependent service is defined and what limitations or conditions need examination.

Acrisure’s October 2025 cyber underinsurance article raises vendor and supply-chain exposures as review considerations. [3] That is a useful published starting point. The care application is to give the broker an intelligible dependency map and an operational scenario. Avoid assuming that the supplier’s own insurance or a contract promise establishes how the provider’s losses would be treated. Contractual responsibilities, technical restoration and insurance response need their own explanations.

Make the security answer traceable to evidence

Acrisure’s current cyber information says insurer requirements commonly examine areas including authentication, updates, backups and access controls, with the actual requirements varying. [4] Ask the people who operate those controls to verify the provider’s answers and explain their scope.

Take authentication as a practical example. Which users and systems does the statement cover? What happens to an agency colleague, external administrator or account used for an out-of-hours task? Where does a supplier manage the control, and what assurance is available? Record who checked the position and when. An exception should remain visible for technical management and the insurance discussion rather than disappearing inside an organisation-wide answer whose meaning nobody has agreed.

Follow safer access through the care shift

NCSC’s 3 November passkeys review brings a more resilient form of authentication into the public discussion. [5] Our independent access feature asks how appropriate protection works with actual staff equipment, permissions and help when access fails. This insurance continuation asks how the resulting position is described accurately to the adviser.

Digital Care Hub’s toolkit guidance discusses remote-account MFA and senior-approved exceptions within the relevant assessment. [6] A toolkit answer and an insurer’s question may use different scopes or wording. Ask the competent technical lead to explain the implementation and the broker to clarify what the insurer requires. Do not infer that the adoption of one method automatically satisfies every insurance condition. The valuable record explains the service, control and remaining uncertainty together.

Separate a backup statement from a demonstrated restoration

For the insurance review, ask the responsible team what the backup statement actually establishes. Which information and services are included? Who controls the copies? What was restored in a test and what remained outside it? Keep detailed security information within the appropriate protected records.

The provider also needs to understand the care consequence. A test that restores a file does not necessarily demonstrate the whole pathway into usable information during a shift. Coordinate that question with the recovery exercise and the supplier responsibilities. NCSC’s standing insurance guidance recommends bringing the relevant expertise together and understanding the potential impact of an incident. [7] Use the evidence to support a discussion of the actual arrangements, rather than making an unsupported promise about recovery capability.

Understand who can respond and who can authorise the work

Before an incident, reconcile the provider’s existing support contracts with the applicable insurance response arrangements. Identify the notification route, authority to appoint responders, any approvals required and the information that can be shared through an authorised secure channel.

Ask how the local IT team, platform and any appointed specialist will exchange findings and coordinate work. Include the person who can authorise operating decisions and expenditure while care continues. A general helpdesk address is useful only if the provider understands what it can initiate. Our business-interruption feature examines the recovery cost and timeline; this feature establishes the people, scope and evidence needed to make the response workable.

Give a new support offer a defined purpose

The government’s 3 November Cyber Essentials funding package creates support opportunities subject to its eligibility and application conditions. [8] Our existing feature examines those routes. The insurance question is how the proposed work improves the organisation’s evidence and controls, and which questions still require separate review.

Acrisure’s September ESET announcement describes a connection between technical protection and insurance expertise. [9] A care provider considering support should define the services covered, responsibility to act, costs, reporting and evidence expected at completion. Certification, technical monitoring and insurance each have their own scope. A clear brief allows leaders to decide which capability the service needs and how the work will be judged, while the relevant adviser explains any insurance implications.

Keep the account current when the service changes

A new platform, acquisition, change in access arrangements or unresolved technical exception can alter the picture that an earlier declaration described. Establish who maintains the evidence and asks the adviser what information must be communicated and when. Give material changes an owner within the provider’s own management process.

Take a short summary to the accountable director: the essential functions examined, the evidence checked, important supplier boundaries and decisions still requiring authority. The result should help the organisation improve its service and obtain more precise professional advice. Cyber insurance becomes a more useful leadership conversation when the people involved can follow the same dependency, understand the same evidence and explain what they still need to resolve.

Put the review into practice

Give each question an owner.

Care and operational leads
Identify an essential function and explain the consequence of losing it.
IT, security and suppliers
Verify control scope, exceptions, restoration evidence and response responsibilities.
Finance and insurance lead
Give the adviser accurate declarations, dependency scenarios and the relevant unresolved questions.
Accountable director
Authorise improvement work and retain a current view of material changes and assumptions.

Your working record / 11

The cyber dependency and declaration evidence record

Map one essential service and verify the evidence for the insurance discussion. Keep technical details, credentials and confidential documents in your approved systems.

  1. Select an essential care function and map its dependencies.
  2. Ask responsible colleagues to verify the scope of material answers.
  3. Bring the scenarios and uncertainties to the appropriate adviser.
  4. Record the improvement decision and maintain the evidence after change.
Open the full review Download the CSV worksheet

Take into the next leadership meeting

Questions that deserve a clear answer.

  1. Which organisations and services sit behind the care function?
  2. Who verified the scope of each material security answer?
  3. What restoration and response capability has actually been demonstrated?
  4. Which supplier scenarios, conditions and changes need individual insurance advice?

Acrisure / Further reading and specialist support

Take the discussion further.

Explore the relevant expertise on Acrisure’s own site, then use the questions and working record from this feature to prepare an individual discussion.

Ready to discuss your organisation’s position?

Speak to Acrisure’s care team

Sources, method & responsibilities

Follow the evidence.

  • Written and reviewed by the Care Circle Network Editorial Desk on 7 November 2026 for the sponsored programme with Acrisure. Published resources and previously published expert views are attributed; no new interview, technical approval or individual recommendation by Acrisure is implied.
  • Care Circle’s scenarios, review sequence and working records are original practical analysis. They are illustrative and do not describe an identified provider, establish a coverage gap or determine a claim outcome.
  • Source publication dates and geographical limits remain separate from this feature’s publication date. Insurance response depends on the operative wording and circumstances. Professional assessment and advice belong with the appropriately qualified adviser.
  • Complete working records within your organisation. Keep resident, staff, confidential policy and security information in your approved systems; the programme does not collect completed worksheets.
01

Annual Review 2026: Incident management

National Cyber Security Centre · 3 November 2026; observation period September 2025 to August 2026

Cross-sector context; no care-provider incident rate or individual exposure is inferred.
04

Cyber insurance

Acrisure · Standing guidance; reviewed 7 November 2026

Read within the source’s stated scope. Provider-specific decisions require the relevant professional.
07

Cyber insurance guidance

National Cyber Security Centre · 6 August 2020; reviewed 7 November

Read within the source’s stated scope. Provider-specific decisions require the relevant professional.
08

Cyber Essentials funding package

UK Government · 3 November 2026; reviewed 7 November

Scheme eligibility and conditions apply. No individual provider entitlement is determined here.

Acrisure’s partner profile uses supplied corporate material. Care Circle authors the reporting and practical analysis. Published expert views and partner resources retain their original attribution and dates. Read the programme method.

Send a documented correction or editorial question

Continue the November collection

Follow the next
connected decision.

Return to the programme