Refund Guarantee: Terms and Conditions

Last updated: 30 October 2026

1. The guarantee in plain English

Cyber Essential Check is built to help reduce your chances of a serious cyber attack. If you use it properly and a serious attack still happens, we haven't done our job, and you can have your fees back for that financial year.

This is a guarantee about our service. It is a refund of our fees, not compensation for your losses, and it does not replace cyber insurance. You should still hold your own cover.

2. Definitions

Cyber Attack: a deliberate, unauthorised and malicious act against your business systems or accounts that were connected to, or covered by, Cyber Essential Check at the time. Examples: ransomware, malware, business email compromise, account takeover, and data theft. It does not include accidents, system failures, or acts by your own staff or contractors unless they were acting on instructions from an outside attacker.

Cyber Victim: a customer who meets all three tests in section 4.

Discovery Date: the date you first became aware, or reasonably should have become aware, of the Cyber Attack.

Financial Year: the 12-month period starting on your subscription start or renewal date.

Fees Paid: the subscription fees you actually paid us in the Financial Year in which the Discovery Date falls. Excludes VAT.

Monthly Revenue: your total business revenue for the 12 completed months before the Discovery Date, divided by 12, as shown in your filed accounts, VAT returns or management accounts.

Qualifying Loss: the costs described in section 5.

3. Who can claim: "effective use"

You can claim only if, on the Discovery Date and throughout the 60 days before it, you were using Cyber Essential Check effectively. That means all of the following:

• Your subscription was active and fully paid, with no fees overdue.
• You had been a customer for at least 60 days before the Discovery Date.
• You had connected the accounts and systems the platform asks for during onboarding, and kept them connected.
• You ran a scan or review at least monthly.
• You fixed every issue the platform rated critical or high within 14 days of it being reported. (This matches the 14-day timescale for critical and high-risk security updates in the Cyber Essentials requirements.)
• Multi-factor authentication was switched on for administrator accounts and for email and cloud services where the platform reported it as available.
• Your staff completed the security awareness training provided.

We can check these from the platform's own records. If our records show you did not meet them, you are not eligible, even if the attack was serious.

4. What makes you a Cyber Victim

All three must be true:

1. A Cyber Attack happened. It is confirmed by a written report from an independent forensic or IT security firm, your cyber insurer, or an NCSC or Action Fraud case reference plus supporting evidence.
2. It hit systems we covered, during the guarantee period. The Discovery Date falls while you are an eligible customer under section 3, and the attack affected systems or accounts that were connected to Cyber Essential Check.
3. The Qualifying Loss is more than your Monthly Revenue. The total cost of the attack to your business must be greater than one month of your Monthly Revenue.

5. What counts as Qualifying Loss

Counted:

• Lost revenue from being unable to trade, for up to 30 days after the Discovery Date.
• Costs of investigating and recovering from the attack, such as forensic and IT recovery fees.
• Money lost directly to the attacker through fraud, if you can show it was not recovered.
• Legal and data-breach notification costs.
• Replacement of data or equipment destroyed or made unusable by the attack.

Not counted:

• Ransom payments.
• Fines or penalties imposed by regulators.
• Loss of future contracts or reputational harm.
• Your own staff time.
• Anything already recovered from insurance, a bank or any other source. Costs that are paid back to you do not count.

6. What we refund

• We refund the Fees Paid for the Financial Year in which the Discovery Date falls. Nothing more.
• We do not refund fees from earlier or later financial years, even if you were a customer then.
• If you joined partway through the Financial Year, we refund only what you paid within it.
• One refund per customer per Financial Year.
• The refund is paid to the payment method or bank account you used, within 30 days of us accepting your claim.

7. Exclusions

No refund is payable if:

• The attack began or was discovered before the guarantee started, or before you had been a customer for the minimum period in section 3.
• The attack used a weakness we reported to you that you had not fixed within the timescale in section 3.
• The attack affected systems, devices or accounts that were never connected to or covered by the platform.
• The loss came from physical theft, hardware failure, natural events, or a failure of your suppliers unrelated to a Cyber Attack.
• The loss came from a payment you authorised yourself after a fraudulent request, unless an attacker had first taken control of an account or system.
• You or anyone acting for you took part in, or knew about, the attack, or any information you gave us in your claim is false or misleading.
• You did not follow the claim process in section 8.

8. How to claim

1. Tell us at admin@cyberessentialcheck.co.uk within 14 days of the Discovery Date. Tell us even if you do not yet know the full cost.
2. Within 60 days of the Discovery Date, send us:
   • the incident or forensic report;
   • proof of the costs, such as invoices, accounts and bank records;
   • evidence of your Monthly Revenue;
   • confirmation you reported the incident where required, for example to the ICO if personal data was affected, and to Action Fraud or the NCSC.
3. Keep logs and evidence, and let us review them. We keep your information confidential and use it only to assess the claim.

9. How we decide

• We will give you our decision in writing within 30 days of receiving everything we asked for, with reasons.
• If you disagree, you can ask for a review by a senior person who was not involved in the first decision. If you still disagree, either of us can ask an independent IT security expert agreed by both sides to review the evidence. The costs are shared.
• Nothing here stops you from using the courts.

10. Important limits

• This is a service guarantee, not insurance. We refund our fees if our service has not done its job, as set out above. We do not cover your losses, and the guarantee does not replace cyber insurance. We recommend you hold your own policy.
• Our liability under this guarantee is limited to the refund described in section 6.
• Cyber Essential Check is a tool to help you find and fix weaknesses. It does not guarantee you will not be attacked, and it does not by itself give you Cyber Essentials certification.
• We may change or end this guarantee on 30 days' written notice. Changes do not affect any attack you discovered before the notice.
• This guarantee is personal to you and cannot be transferred.
• These terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
• Nothing in these terms limits liability that cannot lawfully be limited.