Most insurers now expect a specific set of controls before they will quote or renew a cyber policy: multi-factor authentication, endpoint detection and response (EDR) or managed detection and response (MDR), immutable or offline encrypted backups, a documented incident response plan, disciplined patching, security awareness training, and a vendor risk program. Underwriters increasingly want proof, not promises, and that evidence bar gets higher at every renewal.
TL;DR:
- MFA must cover remote access, email, and administrator accounts; many applications require critical vulnerabilities to be patched within 30 days and regular scans.
- Backups should be offline or immutable, encrypted, and tested through regular restores; quarterly testing is common for small and midsize businesses, with dated results retained.
- Underwriters may verify controls through external scans, penetration test summaries for larger accounts, monitoring attestations, and backup restore logs, then adjust premiums or decline coverage.
- Renewals increasingly require current evidence rather than last year’s files; annotate each record with its producer, date, and the control it demonstrates.
- Policy terms may require insurer approval before ransom payments and notification within hours or days; align the incident plan with each policy’s deadlines.
Table of Contents
- What controls do insurers require for cyber coverage?
- What documentation do insurers request during underwriting or renewal?
- How do insurers verify the controls you claim to have?
- A practical checklist to prepare for your application or renewal
- Documented incident response and backup testing cadence
- Security awareness training and phishing testing
- Ransom payment policies and notification timeframe requirements
- What happens when you file a cyber insurance claim
- Regulatory compliance and cyber insurance eligibility
- Author perspective: lessons from helping Wisconsin businesses meet insurer controls
- How we help you meet cyber insurance requirements
- FAQ
- Sources
What controls do insurers require for cyber coverage?
Carrier applications ask the same core questions in different words, and insurers are raising the baseline for what counts as acceptable. According to CBIZ, insurers are shifting from self-attestation toward data-driven validation of the controls below.
Multi-factor authentication (MFA) needs to cover remote access, email, and administrator accounts, not just a VPN login. Underwriting questionnaires from carriers like Beazley specifically ask whether MFA is enforced for remote and email access and whether it extends to privileged accounts. A single sign-on prompt on one system rarely satisfies this.
Endpoint protection has moved past traditional antivirus. Insurers want EDR that can detect and isolate suspicious activity, and many now expect MDR, meaning a 24/7 team actively watching alerts rather than software sitting idle on a server.
Backups need to be offline or immutable, encrypted, and tested on a schedule, not just scheduled to run. Fusion's underwriting application asks pointed questions about backup immutability, MFA on backup consoles, separately stored credentials, and recovery time objective testing.
Patching and vulnerability management carry real deadlines in many applications, often 30 days for critical vulnerabilities, paired with regular vulnerability scans.
Email protections matter because phishing remains the most common entry point. A secure email gateway (SEG) combined with DMARC, SPF, and DKIM authentication, plus regular phishing simulations, is standard on most questionnaires.
Access controls round out the list: least-privilege permissions, separate privileged account management, and a vendor risk process that checks the security posture of software and service providers before they touch your network.
- MFA on remote access, email, and admin accounts
- EDR or MDR across all endpoints
- Immutable, encrypted, and tested backups
- Patch management with defined timelines
- Email authentication (DMARC, SPF, DKIM) and phishing simulations
- Least-privilege access and vendor risk screening
Pro Tip: Treat every control as something you need to prove, not just install. A tool with no logs or test records is hard to defend during underwriting.
What documentation do insurers request during underwriting or renewal?
Applications and renewals are built around a fairly consistent set of questions, and carrier application templates from The Hartford show the pattern clearly: counts of systems and endpoints, MFA scope, backup medium and test dates, and EDR or MDR coverage details.
Beyond the questionnaire itself, underwriters want operational artifacts:
- Recent vulnerability scan results and, for larger accounts, a penetration test summary.
- Backup restore test logs showing when the last test ran and whether it succeeded.
- SOC or MSSP attestations confirming active monitoring rather than passive tooling.
- Written policies: an incident response plan (IRP), a business continuity and disaster recovery plan (BCP/DR), a patching policy, and a data retention policy.
- A loss history disclosure covering any prior incidents, breaches, or claims.
CBIZ notes that annotating each artifact, who produced it, the date, and what it proves, helps underwriters match evidence to the exact questionnaire item it supports. A vague folder of logs slows things down; a short cover note speeds up the review. For a closer look at how gaps in this evidence can affect a claim later, see why cyber insurance might not pay out.
How do insurers verify the controls you claim to have?
Insurers no longer take a checked box at face value. The shift is toward active verification: scans, telemetry, and third-party attestations that confirm a control is actually working.
- External vulnerability scans run against your public-facing systems
- Penetration test summaries for larger or higher-risk accounts
- SOC reports or MSSP attestations documenting monitoring activity
- Backup recovery test results with dates and outcomes
Applications from carriers like AXIS include specific thresholds, patching within 30 days, defined backup frequency, and MFA on admin accounts, and use the answers to set premiums or decline coverage outright.
An MDR contract or SOC report often carries more weight with underwriters than a list of installed tools, since it demonstrates human monitoring and response capability rather than software that may or may not be configured correctly.
Renewals are where this verification tightens further. Insurers increasingly ask for fresh evidence each cycle rather than accepting last year's documents, and premiums or terms can shift based on what that new evidence shows.
A practical checklist to prepare for your application or renewal
Preparing for underwriting goes faster with a clear sequence rather than tackling controls at random.
- Run a security assessment to identify gaps against common insurer requirements.
- Remediate the highest-risk items first, typically missing MFA, outdated endpoint protection, and backups that have never been tested.
- Document your policies: incident response, patching, backup, and retention.
- Validate what you have built with a vulnerability scan and, where relevant, a backup restore test.
- Package the evidence (scans, logs, test results, policies) for your broker before the application goes out.
Quick wins worth prioritizing first: enforcing MFA everywhere, deploying EDR across endpoints, confirming backups are offline or immutable, and running a phishing simulation to establish a training baseline.
Most small and mid-sized businesses can close the obvious gaps, MFA and basic backup hygiene, relatively quickly. Policy documentation and a first round of testing typically take longer, often a month or two, depending on how many systems and vendors are involved. IT staff, a managed services partner, and whoever owns compliance or risk at your company should all be in the room when you start.
Pro Tip: Start remediation before you start the application. Insurers respond better to a business that already shows test results than one promising to get there.
Our IT & Security Assessment is built around exactly this sequence for businesses across Southeastern Wisconsin, identifying gaps and producing the documentation underwriters ask for.
Documented incident response and backup testing cadence
A written incident response plan matters less than whether it has actually been exercised. Insurers increasingly want to see tabletop exercises, where a team walks through a simulated breach and documents how it responded, alongside the plan itself. Insureon's guidance for small businesses notes that many SMBs have a control in place but still fail the proof stage because they never tested it.
Backup testing cadence works the same way. A backup schedule that runs nightly means little if nobody has confirmed the data restores cleanly. Underwriters generally want to see restore tests on a regular cadence, with quarterly testing common for SMBs, supported by dated logs showing success or failure and any corrective actions taken. Pairing a documented IRP with a record of at least one tabletop exercise, plus recent restore test results, tends to satisfy both the questionnaire and any follow-up request for evidence.
Security awareness training and phishing testing
Phishing remains the most common way attackers get in, which is why nearly every carrier questionnaire asks about security awareness training. Insurers want to know training happens on a recurring basis, not as a one-time onboarding video, and that it is paired with simulated phishing tests that measure whether employees actually recognize suspicious messages.
Insureon lists security training among the standard requirements insurers check for small business coverage. The evidence that matters here is simple: training completion records and phishing simulation results showing click rates over time. A declining click rate across a few simulation cycles is one of the more persuasive artifacts you can hand an underwriter, since it shows the training is working rather than just happening.
Ransom payment policies and notification timeframe requirements
Beyond baseline controls, some policy language addresses what happens during an actual incident. Many cyber policies include specific provisions around ransom payment decisions, often requiring insurer approval or consultation with a designated response team before any payment is made. Policies also typically specify notification timeframes: how quickly you must inform the insurer after discovering an incident, which can affect whether a claim is honored.
These terms vary by carrier and policy, so they are worth reading closely rather than assuming standard coverage applies. The practical takeaway is that your incident response plan should reflect your actual policy language, including who needs to be notified and when, so that your internal process does not conflict with what your coverage requires during a real event.
What happens when you file a cyber insurance claim
A claim typically starts with notifying your insurer within the timeframe your policy specifies, often within hours or days of discovering an incident. From there, the insurer generally wants access to the same kind of evidence that was part of underwriting: logs showing the timeline of the incident, confirmation of which controls were active, and documentation of your response.
This is where the controls you documented during underwriting matter again. If your application stated MFA was enforced or backups were tested quarterly, claims adjusters may verify whether that was actually true at the time of the incident. Gaps between what was claimed and what was in place can complicate or delay a payout, which is one more reason the evidence-gathering habit described earlier in this article pays off well beyond the application stage.
Regulatory compliance and cyber insurance eligibility
Data privacy and breach notification laws intersect with cyber insurance in a couple of ways. Many policies expect you to already be compliant with the regulations that apply to your industry and data types, whether that means state breach notification laws, HIPAA for healthcare-adjacent data, or sector-specific rules for financial services. Underwriters sometimes ask directly whether you have assessed your regulatory obligations as part of the application.
Compliance gaps can affect eligibility or pricing, since a business that is already behind on required data protections represents a higher risk profile. It also affects claims: if a breach triggers notification obligations under state law, your insurer will expect you to meet those deadlines as part of the response, and failure to do so can complicate both your legal exposure and your claim. Keeping compliance documentation current is worth treating as part of your insurance readiness, not a separate task.
Author perspective: lessons from helping Wisconsin businesses meet insurer controls
The gaps we see most often aren't exotic. Backups that have never been restored. MFA that covers the VPN but not email. A patching policy that exists on paper but nobody follows. These close faster than most owners expect, often within a few weeks once someone prioritizes them.
What surprises people more is how many insurers now want proof over promises. A business that can hand over test logs and scan results moves through underwriting faster than one relying on good intentions.
, Dustin Collett
How we help you meet cyber insurance requirements
We build our Managed IT Services around the same controls insurers are checking for, so meeting their requirements becomes a byproduct of how we already run your infrastructure, not a separate project.
- Deploy and manage EDR across every endpoint with continuous monitoring
- Harden backups with offline, encrypted, and regularly tested recovery
- Maintain documented incident response, patching, and retention policies
- Produce the evidence pack, logs, scan results, test records, your broker needs
Our pricing means this coverage work is part of the standard stack, not an upsell added after the fact. If you want a clear picture of where your business stands before your next application or renewal, book our IT & Security Assessment and we will show you exactly what to fix and what to document.
FAQ
What are the typical requirements for cyber insurance?
Insurers typically require multi-factor authentication, endpoint detection and response (often paired with managed monitoring), immutable or offline encrypted backups, a documented incident response plan, regular patching, security awareness training, and a vendor risk program. Carriers increasingly ask for evidence of these controls, not just a checklist answer, according to CBIZ.
Is cyber insurance mandatory?
Cyber insurance is not legally required for most businesses in the United States, though some contracts, client agreements, or industry regulations may require it. Even without a mandate, Forbes Advisor notes that small businesses are frequent targets, which is why many carry coverage voluntarily.
Is cyber liability insurance mandatory?
Cyber liability insurance is generally not mandated by federal law, though it can be required by specific contracts, lenders, or clients depending on your industry. Businesses that handle sensitive data often choose coverage voluntarily because of the financial exposure a breach can create.
Do small businesses need cyber insurance?
Small businesses are common targets for ransomware and phishing attacks, and a single incident can create costs well beyond what many companies can absorb without coverage. Insureon outlines the baseline controls, MFA, backups, training, and EDR, that small businesses typically need in place to qualify for a policy in the first place.