What Cyber Insurers Now Require of Small Businesses
Insurers have tightened their applications. Here is what they typically ask for and why wrong answers are costly.
A few years ago, a cyber insurance application was a short form. Today, many insurers want evidence of specific security controls before they will quote, renew, or pay a claim at a reasonable price. Requirements vary by carrier, but the same themes appear again and again.
Multi-Factor Authentication
MFA on email, remote access, and administrator accounts is the most common requirement. Many carriers will decline or surcharge without it, because stolen passwords are behind a large share of small-business incidents.
Endpoint Detection and Response
Traditional antivirus is often no longer enough. Insurers increasingly ask for managed endpoint detection and response on every workstation and server, with someone actually watching the alerts.
Backups That You Have Tested
Expect questions about frequency, encryption, offsite or immutable copies that ransomware cannot alter, and whether you have tested a restore. “We have backups” is a weaker answer than “we restored last quarter and here is the record.”
Patching and Supported Software
Unpatched systems and end-of-life software are a common way in. Carriers ask how quickly you apply critical updates and whether anything unsupported is still in use.
Email Security and Staff Training
Filtering for phishing and spoofing, email authentication (SPF, DKIM, DMARC), and regular security awareness training with phishing simulations show up on most applications.
Limited Administrator Access
Day-to-day work should not happen from an account with administrator rights. Insurers want to see least-privilege access and separate admin accounts.
An Incident Response Plan
A short written plan covering who to call, how to contain a problem, and when to notify your insurer, often a condition of coverage, can save days when something happens.
If you want help closing gaps ahead of a renewal, see our small business services or get in touch. This guide is general information and does not replace advice from your broker or attorney.
Talk Through Your Compliance and IT Needs
Tell us about your practice. We will reply with an honest read on where you stand and what to fix first. Support hours are 7 a.m. to 7 p.m. MST, Monday through Friday, and we are available 24/7 for emergencies.