What Do Cyber Insurance Companies Require Before Covering You?

A few years ago, getting cyber insurance could mean filling out a short form and paying a premium. Today, many small business owners open the application and find pages of technical questions: Do you enforce MFA on all remote access? Are backups stored offline? Do you use endpoint detection and response? What’s your patching timeline?

If you don’t know the answers, you’re not alone. This guide translates what cyber insurance underwriters commonly ask, explains why they ask it and gives you a checklist to get your answers, and your evidence, ready before you request quotes. Requirements differ by carrier, policy size and industry, so always read the specific application in front of you.

Why insurers ask so many questions

Insurers price risk. Ransomware and email fraud have produced large claims, and carriers learned that a handful of security controls make a big difference in how likely, and how expensive, an incident will be.

Regulators have encouraged that approach. The New York State Department of Financial Services’ Cyber Insurance Risk Framework (Insurance Circular Letter No. 2, issued in February 2021) told property and casualty insurers writing cyber coverage to rigorously measure insured risk. It lists topics insurers should gather information on, including governance and controls, vulnerability management, access controls, encryption, endpoint monitoring, boundary defenses, incident response planning and third-party security policies. It also encourages insurers to price policies based on how effective a client’s security program is. The National Association of Insurance Commissioners (NAIC) tracks cyber insurance market trends, including underwriting practices, through its Cybersecurity Working Group.

The practical result for you: better controls can make coverage easier to get and, with some carriers, better priced. Weak or missing controls can lead to higher premiums, lower limits, exclusions or a declined application.

The controls underwriters commonly ask about

Here are the controls that appear most often on cyber insurance applications and supplemental ransomware questionnaires. Not every carrier asks about every item.

Key takeaway: MFA, EDR, tested backups and fast patching are the 4 controls most likely to make or break an application. If you can only fix a few things before applying, start there.

Control by control: what “yes” really means

Applications often ask yes-or-no questions. Make sure your “yes” is true everywhere, not just in most places.

MFA everywhere it counts

Underwriters commonly ask about MFA on email (including webmail), remote access, cloud apps, backups and privileged admin accounts. A single admin account without MFA can make an honest “yes” inaccurate. Use authenticator apps, security keys or passkeys where possible. Our guide to setting up two-factor authentication covers the major platforms.

EDR on every endpoint

Basic antivirus may not satisfy an EDR question. EDR records activity on each device and can isolate a compromised computer. Insurers may also ask whether alerts are monitored, either by your team or a managed provider, and whether monitoring is 24/7.

Backups that survive ransomware

Insurers want backups attackers can’t easily delete or encrypt: offline, immutable or logically separated from your main network and accounts, protected by MFA. They also want to know you test restores. CISA’s 3-2-1 rule, 3 copies on 2 types of storage with 1 off-site, is a good baseline. See our guide on how to back up business data.

Patching on a schedule

Expect questions about how quickly you apply critical patches and whether you run end-of-life systems. Turn on automatic updates and replace unsupported operating systems, routers and firewalls before you apply.

Training and phishing simulations

Many applications ask whether employees receive security awareness training and phishing simulations, and how often. Keep dated completion records. Our guide to security awareness training includes a 12-month plan.

A written incident response plan

You’ll often be asked whether you have a written plan. Keep it short, list who to call and include your insurer’s breach hotline once you have a policy.

Laws that overlap with insurer requirements

Some businesses face legal requirements that line up closely with insurer questions. For example, the FTC’s Safeguards Rule (16 CFR Part 314) requires covered financial institutions, including many tax preparers, auto dealers and lenders, to implement MFA for anyone accessing information systems (with limited exceptions), encrypt customer information, provide security awareness training and maintain a written incident response plan. Health care organizations face HIPAA Security Rule requirements, and businesses accepting cards face PCI DSS. If you’re subject to these rules, compliance work and insurance preparation reinforce each other. This is not legal advice.

What a cyber policy can cover

Requirements only matter if the policy covers what you need. The FTC’s small business guidance divides cyber coverage into 2 parts:

• First-party coverage protects your own business: legal counsel, data recovery, customer notification, business interruption, crisis management, cyber extortion and forensic investigation.
• Third-party coverage protects you when others make claims against you: payments to affected consumers, settlements, litigation and regulatory inquiries.

The FTC also suggests asking whether the insurer will defend you in a lawsuit or regulatory investigation (look for “duty to defend” language), whether it offers a 24/7 breach hotline, and whether the policy covers attacks on data held by your vendors and attacks anywhere in the world.

Common application mistakes to avoid

• Answering aspirationally. Answer based on what’s true today, not what you plan to do. Inaccurate answers can create problems if you ever file a claim.
• Guessing on technical questions. Ask your IT provider to review the application with you.
• Forgetting shadow accounts. Old admin accounts, shared logins and forgotten cloud apps without MFA are common gaps.
• Ignoring vendors. If your IT provider has remote access to your systems, its security affects your application too.
• Not reading exclusions. Check for exclusions and sublimits on ransomware, social engineering fraud and failure to maintain stated controls.

Where to start: prepare your application in 6 steps

1. Get the application early. Ask your broker for the carrier’s full application and any ransomware supplement at least a month before you need coverage.
2. Map each question to an owner. Assign technical questions to your IT provider and business questions to yourself.
3. Close the big 4 gaps. Make sure MFA, EDR, tested backups and patching are in place everywhere.
4. Gather evidence. Take screenshots of MFA enforcement settings, EDR dashboards, backup restore tests and training completion reports. Keep them in one folder.
5. Write or update your incident response plan. One page is enough to start.
6. Review with your broker. Go over coverage limits, exclusions and the breach hotline before you sign.

If you’re budgeting for upgrades, see how much cybersecurity costs for a small business. For a deeper look at the threat insurers worry about most, read our guide to ransomware protection.

Conclusion

Cyber insurance companies want proof that you’ve done the basics before they share your risk. Expect questions on MFA, endpoint detection and response, backups, patching, email security, training, privileged access and incident response. Answer honestly, close the biggest gaps before you apply and keep evidence on file. The work that gets you insured is the same work that makes an attack less likely to happen in the first place.

Sources

• FTC: Cyber Insurance, Cybersecurity for Small Business — first-party and third-party coverage, questions to ask insurers
• NY DFS: Insurance Circular Letter No. 2 (2021), Cyber Insurance Risk Framework — how insurers should measure insured risk and controls
• NAIC: Cybersecurity insurance topic — regulatory oversight of the cyber insurance market
• 16 CFR 314.4, FTC Safeguards Rule elements (Cornell LII) — MFA, encryption, training and incident response requirements
• CISA: Back Up Business Data — the 3-2-1 backup rule