Cybersecurity sketches frame the article title

Cyber Insurance Requirements: What Insurers Want to See

October 27, 2026

Cyber insurance is no longer a form you fill out and forget. Insurers now ask whether your controls are actually running, and they can use your answers against you at claim time. The requirements you will meet most often are multi-factor authentication (MFA), endpoint detection and response (EDR), tested backups, security awareness training, least-privilege access, timely patching and a written incident response plan.

If you run a small or midsize business, here is the uncomfortable truth: a policy you qualified for on paper can still fail you if the controls you claimed were never really in place. This guide covers what carriers typically ask for, how to prove each control, and how to get ready before renewal.

tekrescue

Strengthen Your Cybersecurity Posture

tekRESCUE helps small and midsize businesses address cybersecurity and compliance needs, including HIPAA standards, to better protect sensitive data.

Explore cybersecurity services

Table of Contents

TL;DR

Carriers most often look for MFA, EDR or endpoint protection, backups you have tested, employee training, least-privilege access, patching and an incident response plan.
Requirements differ by insurer, industry and company size, so the application in front of you is the real checklist.
Cyber insurance is generally not a legal mandate for ordinary businesses, but customer contracts and lenders often demand it.
Answer every application question truthfully. A common exclusion applies when you fail to maintain the security measures you promised.
Start a self-assessment 90 to 120 days before renewal and collect evidence, not just answers.

Why insurers ask for controls now
Is cyber insurance required by law?
The controls insurers ask for most
Cyber insurance checklist
Do requirements differ by insurer, industry and size?
What the policy covers and where it stops
How to meet the requirements before renewal
Our perspective
Get help getting application-ready
FAQ
Sources

Why insurers ask for controls now

Carriers learned the hard way that ransomware and business email compromise are expensive. The National Association of Insurance Commissioners (NAIC) reports that insurers have refined underwriting and hold insureds more accountable for cyber hygiene. In practice, that means the questionnaire is a gate. Fail enough items and you get a higher premium, narrower coverage or a decline.

The stakes are real for small firms. A 2024 NAIC report found that 72% of small and medium-sized enterprises without cyber insurance believe a major cyberattack could destroy their business. Wanting a policy is the easy part. Qualifying for one, and keeping the coverage valid, is where the work sits.

Is cyber insurance required by law?

For most businesses, no. We are not aware of a general rule that makes an ordinary company buy a cyber policy. State breach notification laws require you to disclose a breach, but they do not require you to be insured.

The pressure comes from other places:

Customer and vendor contracts. Larger clients often write minimum cyber liability limits into their agreements. One university risk office, for example, requires IT consultants and vendors to carry cyber and technology liability coverage with limits of not less than $5,000,000.
Lenders and landlords. Some ask for proof of coverage as a condition of financing.
Regulated sectors. Federal banking regulators say cyber insurance is not required of financial institutions and does not replace sound controls. If you handle patient data or customer financial data, the law may require safeguards even where it does not require insurance.

So the requirement you will actually feel is the insurer’s own. Read on.

The controls insurers ask for most

No single national standard exists. Still, the same items appear on application after application. Coalition lists MFA, cybersecurity training, backups and least-privilege access as the core four, with antivirus or EDR, firewalls, incident response plans and security risk assessments close behind.

Four core controls insurers commonly request

Multi-factor authentication

MFA is the control carriers care about most. Expect questions on email, remote access, VPN, cloud admin accounts and privileged users. Partial MFA is a frequent failure: the owner is covered, but a shared mailbox or a legacy protocol is not. If you use Microsoft 365, blocking legacy authentication matters as much as turning MFA on. Our guide to MFA for small businesses covers priorities, passkeys and recovery, and our Microsoft 365 security walkthrough covers the legacy-auth gap.

Endpoint protection and EDR

Applications ask whether you use endpoint protection and whether you use endpoint detection and response. One carrier’s short application, for example, asks both questions separately. Traditional antivirus alone increasingly falls short of what underwriters want to see. EDR watches behavior on each device and lets someone isolate a machine fast. Our page on endpoint detection and response for SMBs explains why detection speed matters.

Backups you have actually tested

The same short application asks whether you keep offline backups or use a cloud service, whether backups are encrypted, and whether business-critical data is backed up at least weekly. A backup nobody has restored is a hope, not a control. Run a restore test and keep the result.

Patch management

That application also asks whether critical patches are installed no later than 30 days after release. Some brokers describe carriers wanting a formal program, with critical patches applied within 14 to 30 days. If your updates depend on whoever remembers, that is a gap.

Least privilege and admin account control

Underwriters look for privileged access management for admin accounts and least privilege, which limits the blast radius when credentials are stolen. Practically: nobody works day to day in an admin account, former employees lose access the day they leave, and you can list who holds admin rights.

Training and an incident response plan

Carriers want to see employees trained to spot phishing, and a written plan for what happens in the first hours of an incident: who calls whom, who isolates systems, who contacts the insurer. A plan nobody has rehearsed counts for less. A short tabletop exercise, documented, is better than a binder on a shelf.

Firewalls, email security and risk assessment

Expect questions on network firewalls, email filtering and whether you perform periodic risk assessments. Email authentication such as DMARC shows up more often as spoofing losses rise; see our DMARC setup guide. A cybersecurity risk assessment checklist gives you a repeatable way to document the rest.

Cyber insurance checklist

Use this as a pre-application worksheet. The right column is what you should be able to hand over.

Control	What the insurer asks	Evidence to keep
MFA	Enforced on email, remote access, admin and cloud accounts?	MFA enrollment report, exceptions list
EDR / endpoint protection	Deployed on every workstation and server?	Agent health report showing coverage
Backups	Offline or cloud, encrypted, at least weekly, tested?	Restore test results with date
Patching	Critical patches within the stated window?	Patch compliance report
Access control	Least privilege, admin accounts separate?	Admin account list, offboarding log
Training	Staff trained on phishing?	Completion records, simulation results
Incident response	Written plan, rehearsed?	Plan document, tabletop notes
Vendors	Third parties vetted?	Vendor security attestations

The evidence column comes from a broker’s guidance that recommends preparing MFA enrollment reports, EDR agent health reports, documented tabletop exercises, backup restoration test results and vendor security attestations. That is not a universal rule, but it is the proof an underwriter or claims adjuster can understand quickly.

Do requirements differ by insurer, industry and size?

Yes. Insurers differ in size, resources, geography, market share and the industries they cover, and risk assessments account for the insured’s industry and size. New York’s financial regulator says as much in its cyber insurance circular letter.

What that means for you:

A five-person office may face a short application with a handful of yes/no questions.
A healthcare practice will likely face more questions about encryption, access logging and HIPAA safeguards, because the data is more sensitive.
A firm with larger limits can expect deeper scrutiny, sometimes a security scan of your public systems or a call with an underwriter.
Accounting, legal and finance firms hold client financial data and tend to be asked about email security and data handling.

So treat the list above as the common baseline. Your actual application is the checklist that counts.

What the policy covers and where it stops

The Federal Trade Commission says a cyber policy may cover breach-response and forensic costs, notification, lost income, extortion and fraud, and third-party claims, and that coverage depends on the policy. Read the specifics, not the brochure.

Three exclusions deserve your attention:

Failure to maintain security. The NAIC notes that failure to maintain security measures is a common exclusion, and policy terms may require controls such as two-factor authentication and timely patching. If you said MFA was everywhere and it was not, expect a fight.
Retroactive date. A policy will not cover a claim from before the retroactive date. If you switch carriers, check that date carefully.
War. Losses from acts of war are typically excluded, though many insurers make exceptions for cyber terrorism, and separate coverage may be available.

We cover the claims side in more detail in common reasons cyber insurance claims are denied.

How to meet the requirements before renewal

Most organizations do not pass cleanly. One 2026 broker analysis says most organizations fail between 25% and 40% of the controls on a typical underwriting checklist. Treat that as a rough indicator, not a guarantee about your business, but it matches what we see: the gaps are usually partial rollouts, not missing tools.

A workable sequence:

Start early. The same guidance suggests a self-assessment 90 to 120 days before renewal. Remediation takes longer than people expect.
Get the real application. Ask your broker for the current questionnaire, not last year’s.
Score yourself honestly. Mark each item yes, partial or no. Partial is the answer people avoid, and it is the one that causes trouble.
Fix the partials first. Finish MFA on every account. Put EDR on every device. Restore a backup and record the result.
Collect evidence. Export reports and keep screenshots with dates.
Answer precisely. If a control covers 90% of devices, say so. Do not round up.
Assign an owner. Someone should be responsible for keeping each control true all year, not only at renewal.

Our five cybersecurity controls every small business needs is a good starting scope if you have little in place.

Our perspective

We see the same pattern with small businesses around Austin, San Marcos, Kyle and New Braunfels. The owner answers the application in ten minutes, assuming the IT person has things covered. The IT person assumes the answers were reviewed. Nobody checks. Then a claim arrives and the application becomes evidence.

Our perspective — overview diagram

We treat insurance requirements as a floor, not a goal. The controls underwriters ask for are the ones that make attackers’ lives harder: MFA, endpoint monitoring, tested backups, limited admin rights. If you build them because they protect your business, the insurance questionnaire becomes a formality. If you build them only to pass the form, you tend to stop maintaining them the week after you sign.

Our advice is blunt. Do not buy a policy to replace security. Do not claim a control you have not verified. And do not wait for a breach to learn what your policy excludes.

— Randy Bryan

Get help getting application-ready

If you would rather not do the gap analysis alone, our cybersecurity services include risk assessments that map your current controls so you know where you stand before the carrier asks. For day-to-day patching, endpoint monitoring and backups, our managed IT services keep those controls running and documented. And if something goes wrong, our incident response team can help you act quickly and keep the records your insurer will want.

FAQ

What do cyber insurance underwriters look for?

They look for evidence that common attacks will be hard to pull off against you: MFA, EDR or endpoint protection, tested backups, patching, least-privilege access, training and an incident response plan. Industry and size shape how deep the questions go. Your application is the definitive list.

Can I be denied coverage or claims for missing controls?

Yes, on both counts. Carriers can decline or price up applicants with weak controls. After a loss, the NAIC notes that failure to maintain security measures is a common exclusion, so a control you claimed but did not run can weaken a claim.

Do small businesses need the same controls as large ones?

The core controls are similar, but the depth of questions usually grows with company size, coverage limits and data sensitivity. A small firm can often meet the baseline with a short list of well-run tools and records.

How far ahead should I prepare for renewal?

Broker guidance suggests starting a self-assessment 90 to 120 days before renewal. That gives you time to finish partial MFA rollouts, deploy endpoint tools and run a backup restore test before the carrier reviews you.

Is cyber insurance a substitute for security?

No. Regulators say it does not replace sound controls, and the policy itself may depend on those controls being in place. Think of it as financial protection for the damage that gets through anyway.