Organizations in the Kingdom that apply for cyber cover often find that the questionnaire is only the start. Within days, the underwriter asks for documents that prove the answers. The NCA ECC cyber insurance evidence requirements are not a separate regime, but the underwriter's requests map closely to the risk-management controls the National Cybersecurity Authority expects under its Essential Cybersecurity Controls. This article describes six artifacts that are commonly requested early and three risk-register formats that make the risk picture priceable.
The "72 hours" in the title is a planning assumption, not a rule: treat the first days after submission as the window in which you should be able to produce evidence without a search. Underwriter practice varies by market and broker.
Why generic risk registers slow quotes
A register built on likelihood and impact scores, such as "high" or "3 x 4", tells an underwriter that risks were discussed. It does not tell them what a loss would cost, which controls reduce it, or who owns the decision. The underwriter must then make their own assumptions, and those assumptions tend to be cautious. The result is follow-up questions, delayed quotes, higher retentions or exclusions.
Six artifacts to have ready
The NCA ECC risk-management domain expects a documented methodology, a maintained register, and treatment that is tracked. Underwriters look for proof that this works in practice. Prepare the following.
- Approved risk-management methodology. A current, signed-off document that defines how risks are identified, assessed, treated and reviewed, with its approval date and owner.
- Current risk register with ownership. Each risk should have a named owner, a treatment decision and a review date. Stale entries are an immediate signal of a paper exercise.
- Risk treatment plan with status. Actions, deadlines and progress, showing that accepted and mitigated risks are tracked, not just listed.
- Evidence of management or board review. Minutes or reports showing that senior management reviewed cyber risk and the risk appetite. Underwriters read this as a measure of governance.
- Third-party and supply-chain risk assessments. Results for critical providers, including the contractual security requirements applied to them.
- Risk assessment triggered by change. Records showing that significant projects, new systems or major changes were assessed for cyber risk before go-live.
Each artifact should be dated, versioned and retrievable from one place. A missing approval signature is a common reason a good document is not accepted as evidence.
Three risk-register formats that support pricing
The aim is not to replace the register your NCA ECC programme needs. It is to add a view that translates it into financial terms. Three formats work well.
1. Scenario-based loss register
Each entry is a specific event, such as ransomware encrypting a core operational system, rather than a generic risk label. For each scenario record the affected asset, the likely cause, the controls in place, and a loss range split into cost categories: response, business interruption, data restoration, legal and regulatory, and third-party liability. Use ranges with stated assumptions, not single points.
2. Control-linked register
Each scenario is linked to the specific controls that reduce its likelihood or severity, with a pointer to the evidence for each control. This lets an underwriter see why a scenario's loss range is credible, and it connects your NCA ECC control set directly to the loss estimate.
3. Retention and limit view
A summary that sets the most likely and most severe scenarios against your proposed retention and limit. It shows the board and the underwriter which losses you would absorb and which you intend to transfer. It also exposes where a limit looks too low or too high for the scenarios you have described.
Whichever format you use, keep the original likelihood and impact scoring alongside it so that the two views reconcile. Do not claim a premium reduction from format alone; the benefit is that the underwriter has less to assume.
Where quantification comes from
Loss ranges should rest on your own data where possible: incident history, downtime costs, revenue per hour of critical services, recovery times from tests, and contractual penalties. Where internal data is thin, state the external assumptions and who approved them. The CFO should be involved, since financial figures that finance has not reviewed are hard to defend.
How the firm supports this
Our Cyber Insurance Readiness Assessment assesses your controls the way underwriters do, closes the gaps that drive premiums and exclusions, and prepares the evidence before you go to market. The work follows four steps: profile your business, systems and current or planned cover; assess, with underwriting controls tested, not just asked; close, with quick wins and prioritized fixes; and prepare an evidence pack and answers for the market.
The assessment takes 3–4 weeks and produces a readiness report and score, an evidence pack, and a remediation plan ranked by underwriting impact. It draws on NCA ECC, SAMA CSF and ISO 27001. Where you need loss figures behind limits and retentions, our Cyber Risk Quantification for Insurance estimates the financial impact of your most likely and most severe cyber scenarios, so limits, retentions and budgets rest on numbers the board can trust.
We are not an insurer or a broker. We work alongside your broker to improve your position.
Next step
Start ideally three to four months before renewal or before approaching the market for the first time. That leaves time to fix gaps, not just document them. If you are preparing an application, a Cyber Insurance Readiness Assessment is the practical way to find out which of these six artifacts would hold up and which would not.
