Tools and providers
Part of Choosing insurance tools for 2027 after classifying the harm and mapping shared responsibility
Using public information in business insurance planning
The search phrase “business insurance best tools” can mislead: public sources support planning, firm checks, workplace, cyber and data protection.
This guide explains how public information can support business insurance planning, using resources that contribute distinct inputs to insurance planning. None selects a policy, gives personalised insurance advice or guarantees compliance. The focus is how each resource can support an evidence file, not a ranking of insurance products.
Free access is qualified: Companies House Follow alerts need a free account and sign-in. The other four tools can be opened without an account, but check before saving or submitting anything.
What to take away
- Five free official tools support distinct inputs to insurance planning.
- None of the tools selects a policy, gives personalised insurance advice or guarantees compliance.
- Each tool helps build an evidence file by verifying parties, corporate identity, workplace controls, cyber actions or data protection.
1. FCA Register for firm and permission checks
Use the FCA Register to search the exact legal entity behind an insurer or intermediary and inspect its current record. Save the firm reference, status, relevant permissions, trading names and check date. A Register result needs interpretation and does not prove service quality, policy fit or approval of every website claim.
FCA Register check record
- Firm reference number
- Current status
- Relevant permissions
- Trading names
- Check date
Best use: verifying the parties before quotation, referral or editorial inclusion.
2. Companies House Find and update service
Companies House explains that its company-information service provides free public data including registered details, officers, filings, charges and insolvency information. It also offers Follow email alerts after sign-in. The register itself is the GOV.UK service named Find and update company information, where you search by company name or company number: https://find-and-update.company-information.service.gov.uk/.
Use it to reconcile a supplier's legal name, number and filing history. Public filings may be delayed, incomplete for the purpose or require professional interpretation. The register does not replace FCA checks or commercial due diligence.
Best use: establishing corporate identity and monitoring filed changes.
3. HSE risk assessment template and examples
The Health and Safety Executive's risk assessment resources include steps, a template and examples for workplace risk control. They can help document hazards, who may be harmed, controls, findings and reviews.
The tool serves health and safety work. Referenced findings may inform an insurance discussion, but completing the template neither creates cover nor satisfies every disclosure question.
Best use: producing an owned workplace-control record before insurance review.
4. NCSC Cyber Action Toolkit
The Cyber Action Toolkit is a free UK government and NCSC service for small businesses and sole traders. It organises cyber actions into foundation, improver and enhanced layers, with progress tracking and setup questions.
Use it to improve controls and retain evidence of actions. It does not assess a cyber-insurance wording, confirm eligibility or replace incident-response planning tailored to the firm.
Best use: turning broad cyber concerns into sequenced control tasks.
5. ICO data protection self-assessment
The ICO's self-assessment toolkit provides checklists for controllers, processors, security, direct marketing, records and data sharing, with a separate route signposted for smaller firms. The checklists assess compliance with data protection law, the UK GDPR and the Data Protection Act 2018, and the ICO currently flags the page as under review because of changes made by the Data (Use and Access) Act.
Use the appropriate assessment for the organisation and record its date, answers and actions. A generated report is not certification or legal advice.
Best use: identifying personal-information controls around quotations, employees and claims.
Combine the resources in one evidence file
Link outputs to owners and dates: provider identity, corporate record, workplace controls, cyber actions and data-protection actions. Avoid copying sensitive material into a central file unless access and retention are justified. For employers’ liability or public liability discussions, workplace records can help explain hazards and controls; for cyber-insurance discussions, the toolkit and ICO assessment can help explain security measures and personal data handling. These records support insurer conversations but do not establish cover.
Reopen every service before relying on it, since features, status and guidance can change. The practical test is whether the output answers a defined planning question and can be checked later, not how many dashboards the business has completed.
Record the tool version or access date, result, action owner and next review in one index. Where an online service changes or closes, retain a lawful export or screenshot of the relevant evidence without collecting unnecessary personal information. Never paste claim details or security secrets into a public checker.
Each of the five is published by the body that runs it, so reach it from that body's own site rather than through a search advert: the FCA Register from the Financial Conduct Authority (register.fca.org.uk), Find and update company information from Companies House on GOV.UK, the risk assessment pages from the Health and Safety Executive (hse.gov.uk), the Cyber Action Toolkit from the National Cyber Security Centre (ncsc.gov.uk) and the data protection self-assessment from the Information Commissioner's Office (ico.org.uk). The table gives the direct address of each.
| Tool | Direct URL | Account or sign-in | Insurance disclosure question supported |
|---|---|---|---|
| FCA Register | https://register.fca.org.uk/s/ | No account needed to search | Which regulated firm stands behind the policy or intermediary? |
| Companies House Find and update service | https://find-and-update.company-information.service.gov.uk/ | Follow email alerts need a free account and sign-in | What is the supplier or buyer's legal identity, number and filed status? |
| HSE risk assessment resources | https://www.hse.gov.uk/simple-health-safety/risk/ | No account needed | What workplace hazards, controls and reviews are documented? |
| NCSC Cyber Action Toolkit | https://cybertoolkit.service.ncsc.gov.uk/about | No account needed to view actions; check before saving progress | What cyber controls are in place and when were they actioned? |
| ICO data protection self-assessment | https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment-medium-businesses/ | No account needed | How are personal data, records and sharing controlled? |
Before you act
- Verify the exact legal entity behind an insurer or intermediary.
- Reconcile a supplier's legal name, number and filing history.
- Document hazards, who may be harmed, controls, findings and reviews.
- Turn broad cyber concerns into sequenced control tasks.
- Identify personal-information controls around quotations, employees and claims.
Common questions
What can the FCA Register be used for?
It checks the regulated status of an insurer or intermediary. Save the firm reference and permissions, but read the result alongside other due diligence.
How does the NCSC Cyber Action Toolkit help small businesses?
It offers a free UK government and NCSC route for small firms and sole traders. Use it to sequence cyber actions. It does not confirm cyber-insurance eligibility.
What should be included in a combined evidence file?
Keep provider, corporate, workplace, cyber and data-protection outputs with owners and dates. Add a lawful export or screenshot when a service changes or closes. Do not put claim details or security secrets into a public checker.
