Buying cyber insurance used to mean filling out a short form and signing. Today it works much more like a security audit. Insurers ask what protections you have, they may ask for proof, and they can use your answers to decide whether to cover you, what to charge, and whether to pay a claim.
Requirements vary by insurer and policy, so treat this as a map of what is commonly asked, not a guarantee of what your carrier will require.
Why insurers got stricter
Ransomware and email fraud have made claims expensive. Insurers now screen applicants for the controls that most often prevent those losses, and they decline or reprice the ones that don’t have them. Small businesses get no special exception, because attackers don’t give one either.
The controls insurers most commonly ask about
- Multi-factor authentication (MFA). Usually required for email, remote access, and administrator accounts. It is the most common reason applications are declined.
- Endpoint detection and response (EDR). Many insurers now expect more than basic antivirus on every computer and server. See antivirus vs. EDR for the difference.
- Backups you have actually tested. Ideally kept separate from your main network so ransomware can’t encrypt them too. A backup you’ve never restored is a hope, not a plan.
- A written incident response plan. Who to call, in what order, and who makes decisions. See what that looks like in practice in our ransomware first-24-hours guide.
- Security awareness training. Usually annual at minimum, with records showing who completed it.
- Patching and vulnerability management. Evidence that you find and fix known weaknesses on a regular schedule. Regular vulnerability scanning produces exactly that evidence.
- Email security. Spam and phishing filtering, plus settings (SPF, DKIM, DMARC) that make it harder to impersonate your domain.
The part people miss: proof
Checking “yes” on an application is not the same as being able to show the control was running. Insurers can review your answers when you file a claim, and an answer that turns out not to be accurate can give them grounds to reduce or deny coverage. That makes documentation important:
- Screenshots or reports showing MFA is enforced, not just available
- Reports from your endpoint protection showing which devices are covered
- Records of backup tests, including the date you last restored something
- Training completion records
- Scan and patching reports with dates
How to prepare before you apply or renew
- Get the questionnaire early. Ask your broker for the current application and read every question.
- Compare it to what you really have. Be honest about the gaps. It is far better to find them now than during a claim.
- Fix the cheapest, highest-impact gaps first. MFA usually comes first because it is inexpensive and carries the most weight.
- Collect your evidence in one folder, and keep it current.
- Revisit every year. Requirements keep tightening, and your environment keeps changing.
How a managed security provider helps
Most of the controls above are the same things a managed security provider runs for you: endpoint protection, monitoring, vulnerability scanning, and incident response. Just as important, the reports that come with the service double as evidence. You can compare our plans to see which controls each one covers, or request a free security snapshot to see where your business stands today.
This article is general information, not insurance or legal advice. Check with your broker about your specific policy.