Cyber Insurance Requirements Checklist for Small Businesses

A few years ago, buying cyber insurance for a small office meant answering a handful of questions and writing a check. Today the application can run several pages, and the questions are specific: Do you require multi-factor authentication for remote access? For email? For administrator accounts? Do you have endpoint detection and response on every device? Are your backups offline or immutable, and when did you last test a restore?

Those questions exist because insurers paid out heavily during the ransomware surge of the early 2020s and learned which controls separate a bad week from a catastrophic claim. They're also the same controls that actually protect your business. That's the good news: getting ready for a cyber insurance application is mostly the same work as getting secure.

The bad news is that the application is a legal document. If you check "yes" to a control you don't fully have, you may not find out until you file a claim, which is the worst possible time. This guide walks through the controls insurers commonly require, the questions you'll see, why claims get denied, and a practical checklist to prepare before you apply or renew. When you're done, try our free cyber insurance readiness tool to see where you stand.

What is cyber insurance, and what does it cover?

Cyber insurance is a policy that pays for the costs of a cyberattack or data breach: investigation, recovery, legal advice, notifications, lost income and lawsuits. (Our glossary has a short definition of cyber insurance.) General liability and property policies often exclude or barely cover these losses, which is why a separate policy has become standard.

Coverage is usually split into two halves:

Most small-business policies bundle both, but with different limits and sublimits (smaller caps on specific types of loss). Two sublimits deserve special attention:

• Ransomware or extortion: some policies cap ransom-related costs below the main limit or add coinsurance (you pay a percentage). GAO noted in its 2022 cyber insurance report that insurers "have begun adding sub-limits and coinsurance related to ransomware claims."
• Social engineering / funds transfer fraud: the coverage for business email compromise losses, where someone on your team is tricked into sending money. It's often a fraction of the main limit and may require that you followed a verification procedure.

Policies also commonly exclude acts of war, failures of widespread infrastructure (like a national power or internet outage), and losses from incidents you knew about before the policy started. GAO's 2022 report describes insurers "excluding coverage for losses from cyber warfare and infrastructure outages."

What's happening in the cyber insurance market?

The market has stabilized after several hard years, but underwriting is still detailed and control-driven. The most recent data from the National Association of Insurance Commissioners (NAIC), in its 2025 report covering 2024:

• U.S. cyber insurance direct written premium was about $9.14 billion in 2024, a 7% decrease from $9.84 billion in 2023, the first decline the NAIC has recorded.
• There were about 4.37 million cyber policies in force, roughly flat from the year before.
• The number of claims rose almost 40%, to nearly 50,000.
• Citing industry data, the NAIC noted that U.S. cyber rates declined an average of 5% in the fourth quarter of 2024 after years of increases, and that investment in security controls "is looked upon favorably by underwriters."

In plain English: coverage is more available and somewhat cheaper than at the peak, but claims keep rising, and insurers are pricing and selecting risks based on your controls. A small office with MFA, EDR and solid backups is a very different risk from one without them, and will be treated that way.

The threats driving claims haven't gone away. The FBI's IC3 reported $3.05 billion in business email compromise losses and 3,611 ransomware complaints in 2025. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of the breaches it analyzed. IBM's 2026 Cost of a Data Breach Report put the global average breach cost at a record $4.99 million.

What security controls do cyber insurers commonly require?

There's no single industry standard. GAO found "there is no standard cybersecurity risk assessment across providers," and smaller businesses may face shorter questionnaires than large ones. But across applications, the same core controls appear again and again. They also map closely to CISA's Cross-Sector Cybersecurity Performance Goals and HHS's healthcare cybersecurity performance goals.

Here's what each control is, why insurers care, and what "yes" really means.

1. Multi-factor authentication (MFA)

What it is: a second proof of identity beyond a password, like an authenticator app approval or a security key.

Why insurers care: stolen passwords are the easiest way into email and remote access. MFA blocks most of those attacks; Microsoft says it can block over 99.2% of identity-based attacks.

What "yes" should mean: MFA is enforced (not just available) for:

• Email and cloud apps for every user
• All remote access: VPN, remote desktop gateways, remote-support tools
• All administrator and privileged accounts, including your IT provider's
• Backup consoles and cloud backup accounts

Applications often ask about each of these separately. Answering "yes" to "MFA for remote access" when one old remote-desktop server doesn't have it is exactly the kind of gap that causes problems later. Our MFA guide covers how to close every gap.

2. Endpoint detection and response (EDR)

What it is: EDR is security software on every computer and server that watches behavior (like mass file encryption or credential theft), stops threats and lets responders investigate. It's more than traditional antivirus.

Why insurers care: EDR catches attackers in the days between getting in and launching ransomware, and its records help forensics determine what happened.

What "yes" should mean: EDR on 100% of endpoints and servers, tamper protection on, and alerts monitored. Many applications ask whether alerts are monitored 24/7 and by whom (in-house, your MSP, or a managed detection and response service). Microsoft Defender for Business, included in Microsoft 365 Business Premium, provides EDR for businesses up to 300 users.

3. Backups that survive an attack

What it is: regular copies of your data with at least one copy that ransomware can't reach: offline, air-gapped, or immutable (can't be altered or deleted for a set period).

Why insurers care: good backups are the difference between restoring in days and paying a ransom or closing for weeks. CISA warns that "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups."

What "yes" should mean:

• Backups cover servers, critical PCs and cloud data (including Microsoft 365)
• At least one copy is offline or immutable
• Backups use separate credentials with MFA
• Restores are tested on a schedule, and you can show results

Expect questions like "How often are backups tested?" and "How long would it take to restore critical systems?" See our backup and disaster recovery guide.

4. Patching and vulnerability management

What it is: patch management keeps operating systems, applications and network devices updated; vulnerability management finds what's missing.

Why insurers care: Verizon's 2026 DBIR found exploited vulnerabilities (31% of breaches) have overtaken stolen credentials as the most common way attackers get in.

What "yes" should mean: automatic updates on all PCs, a defined window for critical patches (commonly within days to a few weeks; check what your application asks), firewall and VPN firmware current, and no unsupported operating systems or software, or documented isolation if one must stay. Questions about end-of-life systems are common; see our Windows 10 end of support guide.

5. Email security

What it is: filtering that blocks malicious attachments and links, plus domain authentication (SPF, DKIM and DMARC) that makes your domain hard to spoof.

Why insurers care: email is the starting point for most phishing, BEC and many ransomware attacks.

What "yes" should mean: advanced filtering such as Defender for Office 365 with Safe Links and Safe Attachments, external sender tagging, and SPF/DKIM/DMARC configured. Check your domain with our email security checker.

6. Security awareness training and phishing simulations

What it is: regular training on recognizing phishing and fraud, plus simulated phishing emails to practice.

Why insurers care: people are targeted directly, and trained people report attacks faster.

What "yes" should mean: all staff trained at least annually (more often is better), with phishing simulations, and records of completion. Our phishing quiz is a quick starting point.

7. Privileged access management (PAM)

What it is: controlling and monitoring powerful accounts: domain admins, Global Administrators, service accounts, and your IT provider's access.

Why insurers care: attackers need admin rights to disable security and deploy ransomware across a network.

What "yes" should mean: for a small business, usually:

• Staff don't have local admin rights on their computers
• Admins use separate admin accounts only for admin work
• Admin accounts use MFA (ideally phishing-resistant)
• The number of admin accounts is minimal and reviewed
• Service accounts have strong, unique passwords and limited rights
• Local administrator passwords are unique per machine (Windows LAPS can do this)

Some applications ask about dedicated PAM software. For a 10–30 person office, the practices above are usually what matters; ask your broker how the insurer interprets the question.

8. Incident response plan

What it is: a written incident response plan that says who does what in an attack: who to call, how to isolate systems, how to communicate, and where the insurance hotline number is.

Why insurers care: a fast, organized response reduces the size of every claim, and many policies require prompt notice to the insurer and use of their approved vendors.

What "yes" should mean: a written plan, printed and accessible offline, that includes your insurer's breach hotline, reviewed annually, ideally tested with a short tabletop exercise.

9. Other controls you may be asked about

• Remote desktop (RDP): is it exposed to the internet? (The right answer is no.)
• Encryption of laptops and sensitive data (BitLocker on Windows)
• Network segmentation, especially for medical devices or point-of-sale systems
• Vendor management: how you vet and control third parties with access to your systems or data
• Payment verification: whether you verify bank detail changes by phone (often tied to social engineering coverage)
• Logging and monitoring: whether sign-in and security logs are kept and reviewed
• Asset inventory: whether you know every device and system you have

Insurer controls at a glance

What questions are on a cyber insurance application?

Applications vary, but most ask about your business, your data, your controls and your history. Knowing the categories in advance lets you gather accurate answers instead of guessing at the broker's office.

About your business:

• Annual revenue and number of employees
• Industry and services (healthcare and financial services usually get extra questions)
• Number of locations and whether you have international operations
• Use of a managed IT provider, and who is responsible for security

About your data:

• How many records of personal information you hold: patient records (PHI), Social Security numbers, payment card data, financial account numbers
• Whether sensitive data is encrypted at rest and in transit
• Whether you accept card payments and your PCI compliance status

About your controls (the sections above):

• MFA by system type, EDR, backups, patching, email security, training, admin accounts, incident response plan, remote access, segmentation, vendor management

About your history:

• Prior incidents, breaches, ransomware attacks or claims
• Any known circumstances that could lead to a claim
• Regulatory investigations or lawsuits

About funds transfer procedures (if you want social engineering coverage):

• Whether you verify vendor bank changes by calling a known number
• Whether payments above a threshold need two approvals

Many applications also include a signature attestation that the answers are true and complete, and a statement that the application becomes part of the policy. Some ask the person responsible for IT to sign as well. Take that seriously.

Why do cyber insurance claims get denied?

The most avoidable reason is an inaccurate application. Others include late notice, using your own vendors without the insurer's consent, paying a ransom without approval, and losses that fall under exclusions or low sublimits.

Misrepresentation on the application

Insurers rely on your answers to decide whether to insure you and at what price. If an answer turns out to be materially wrong, the insurer may seek to rescind the policy (treat it as if it never existed) or deny the claim, depending on the policy language and state law.

The case most often cited is Travelers v. International Control Services (federal court in Illinois, 2022). According to published summaries, the company's application, signed by its CEO and the person responsible for its network security, attested that it used multifactor authentication for administrative or privileged access. After a ransomware attack, the insurer's investigation found MFA was used only to protect the firewall and not on other systems, including a server. The insurer asked the court to rescind the policy, and the case ended in August 2022 with a judgment rescinding it, by agreement of the parties.

The lesson isn't that insurers are looking for excuses. It's that "we have MFA" and "we have MFA on everything the question asks about" are different statements, and the application asks about the second.

Other common reasons

A note on ransom payments

Some policies reimburse ransom payments, but payment is never automatic. Beyond insurer consent, there's sanctions law: the Treasury Department's Office of Foreign Assets Control (OFAC) warned in its September 2021 advisory that companies facilitating ransomware payments, explicitly including "cyber insurance firms," "may risk violating OFAC regulations," and that the U.S. government "strongly discourages" paying. OFAC treats strong preventive security and prompt reporting to law enforcement as significant mitigating factors. Our ransomware protection guide covers the payment question in detail.

How do you prepare for a cyber insurance application or renewal?

Start 60–90 days before your renewal date. That gives you time to find gaps, fix the quick ones, and document the rest, instead of discovering a problem the week the application is due.

Step 1: Get the application early

Ask your broker for the actual application form (or last year's) at least two to three months before renewal. Questions change year to year, and you want to answer the real questions, not guess.

Step 2: Inventory your environment

You can't answer accurately without knowing what you have:

• Every computer, server and laptop, with operating system version
• Every way in from outside: VPN, remote desktop, remote-support tools, cloud portals
• Every admin account, including your IT provider's
• Every system holding sensitive data: EHR, practice management, tax software, file shares, email
• Every backup: what's covered, where copies live, which are immutable

Step 3: Go through the application with your IT provider

Sit down (or get on a call) with whoever manages your IT and go question by question. For each one, answer three things:

1. Is the honest answer yes, no or partially?
2. What evidence shows it? (A screenshot, report or policy document.)
3. If it's not a clean yes, can we fix it before the application is due?

Step 4: Close the quick gaps

Some gaps take days, not months:

• Turn on MFA for remaining users and remote access
• Deploy EDR to the last few machines
• Remove local admin rights
• Configure DMARC
• Write (or update) the incident response plan
• Run a backup restore test and record the result

Others take longer: replacing unsupported systems, setting up immutable backups, segmenting the network. For those, document the plan and timeline.

Step 5: Answer accurately, and explain partial answers

If a control is partially in place, say so. Many applications have space for explanation, and brokers can attach supplemental information. "MFA is enforced for all email and VPN access; one legacy imaging workstation is isolated on its own network segment and scheduled for replacement in Q1" is a far better answer than an unqualified "yes" that turns out to be false.

Step 6: Keep an evidence folder

Save, with dates:

• MFA policy and registration reports
• EDR coverage report
• Backup reports and restore test logs
• Patch compliance reports
• Training completion records and phishing simulation results
• The incident response plan and tabletop notes
• The completed application itself

If you ever file a claim, this folder shows you were doing what you said. It also makes next year's renewal much faster.

Step 7: Read the policy, not just the quote

Check the limits, sublimits (especially ransomware and social engineering), retention (deductible), waiting period for business interruption, exclusions, consent requirements, panel vendor requirements, and notice requirements. Put the breach hotline number and policy number into your incident response plan.

How do you answer the tricky application questions?

Most application questions look simple and hide a detail that matters. Here are the ones we see cause the most confusion, what they're really asking, and how to answer honestly.

When an honest answer is "mostly," say so and explain. Underwriters see partial answers constantly; what causes trouble is an unqualified "yes" that a forensic investigator later disproves.

What happens when you file a cyber insurance claim?

Knowing the process in advance helps you avoid the mistakes that reduce payouts. A typical small-business claim runs like this:

1. You notice something wrong: a ransom note, a suspicious payment, an alert from your IT provider.
2. You call the insurer's breach hotline first, before hiring outside firms. Many policies require prompt notice and use of panel vendors; the hotline is usually staffed around the clock.
3. The insurer assigns a breach coach, a lawyer who coordinates the response. Working through counsel can help protect the confidentiality of the investigation.
4. A forensic firm is engaged (usually from the insurer's panel) to determine how the attacker got in, what they accessed and whether data was taken. Your IT provider works alongside them.
5. Recovery begins: restoring from backups, rebuilding systems, removing the attacker's access.
6. Notification decisions are made with counsel, based on the forensic findings and the laws that apply (HIPAA, state law, FTC).
7. You document losses: extra expenses, lost revenue, overtime. Business interruption claims need records, so your accountant will be involved.
8. The adjuster reviews coverage, including whether your application answers matched what forensics found.

That last step is where an inaccurate application surfaces. Forensic reports routinely describe how the attacker got in ("compromised credentials used on a VPN without MFA"), and that report is part of the claim file.

How can you lower your cyber insurance premium?

Premiums depend on factors you can't change (industry, revenue, record count) and factors you can: your controls and your history. The levers within your control:

• Close the big gaps before you apply. MFA everywhere, EDR on everything, and immutable tested backups are the controls most often tied to eligibility and pricing.
• Provide evidence proactively. A short summary of your controls with screenshots or reports, sent through your broker, can help an underwriter.
• Reduce the data you hold. Old patient or client records you no longer need are liability with no benefit. Follow your retention policy and securely dispose of the rest.
• Choose your retention (deductible) thoughtfully. A higher retention lowers premium, but make sure you could actually pay it after an incident.
• Avoid claims through prevention. Your claims history follows you into every renewal.
• Shop with a broker who specializes in cyber. Coverage terms vary more than prices do.

How much cyber insurance does a small business need?

Enough to cover a realistic bad case: a week or two of downtime, a full forensic investigation, legal advice, and notifying everyone whose data you hold, plus any minimum your contracts require. There's no universal number, but you can build an estimate:

1. Downtime: what does a day closed cost in lost revenue and payroll? Our downtime cost calculator helps. Multiply by a realistic recovery time.
2. Incident response: forensics, legal counsel and restoration work.
3. Notification: letters, call center and credit monitoring for every affected person. Count your patient or client records.
4. Liability: potential claims from patients, clients or partners.
5. Contract requirements: health systems, insurers, large clients and landlords sometimes require specific cyber limits from vendors and business associates.

Then talk to a broker who specializes in cyber, and compare quotes on coverage details, not just price.

What does preparation look like in practice?

These are illustrative examples of common situations, not specific clients.

Dental office

Imagine a five-dentist practice whose renewal application asks about MFA for remote access, and the honest answer is "partially": the imaging vendor has always-on remote access with a shared password. Before renewal, the practice moves vendor access to on-request sessions with MFA, deploys EDR on every operatory PC, and confirms nightly immutable backups of the imaging and practice-management servers with a recorded test restore. Now the application can be answered "yes," with evidence. Our real dental practice case study describes the kind of managed, encrypted, MFA-protected environment that answers these questions cleanly.

Medical office

Picture a 20-person primary care practice that needs higher limits because a hospital affiliation agreement requires them. The underwriter asks detailed questions about EDR monitoring and incident response. The practice documents 24/7 EDR alert monitoring, writes and tabletop-tests an incident response plan, and confirms its HIPAA security risk assessment is current, since healthcare applications frequently ask about it.

CPA firm

Consider a 12-person accounting firm that wants social engineering coverage after a near miss with a fake client refund request. Insurers commonly expect a written callback verification procedure for any change to payment or deposit details. The firm adopts one (see our phishing and BEC guide), trains staff, and keeps a log of verifications. Because the FTC Safeguards Rule already requires MFA and a written information security program, most other answers are already documented. Our real accounting firm case study shows how documented controls make client security questionnaires straightforward.

Small retail shop

A shop with a point-of-sale system and an office PC will often get a short application, but it will still ask about MFA on email and banking, backups, and whether card data is stored. The owner turns on MFA for email, bank, payroll and the POS dashboard; confirms with the POS provider how card data is handled; and sets up a cloud backup of the office PC and accounting files.

What about HIPAA, the FTC Safeguards Rule and other rules?

Regulatory compliance and insurance overlap but aren't the same thing. Insurers frequently ask about them, and a breach triggers duties under them that your policy may help pay for.

• HIPAA: medical and dental practices must perform a security risk analysis and implement reasonable safeguards. After a breach, they must notify patients within 60 days and report to HHS. Insurance can cover the cost of notification and legal advice; it doesn't replace the obligations. See our HIPAA Security Rule checklist.
• FTC Safeguards Rule: tax preparers and many accounting firms must have a written information security program, MFA for anyone accessing customer information, and must notify the FTC of certain breaches.
• State law: Florida and other states have breach notification laws with their own deadlines.
• Contracts: business associate agreements and client contracts may require specific controls and notification timelines that your insurer will also want to know about.

Mistakes we see

• Answering the application from memory instead of checking with IT.
• "Yes" to MFA when it's only on email, not remote access or admin accounts.
• EDR "installed" but alerts unmonitored, or missing from a few machines.
• Backups that have never been restore-tested, or that live on the same network with the same passwords.
• No printed incident response plan, so nobody can find the insurer's hotline during an attack.
• Calling your own IT vendor and lawyer first and only notifying the insurer days later.
• Not reading the social engineering sublimit and assuming BEC losses are fully covered.
• Letting controls lapse mid-policy, for example disabling MFA for a "difficult" user.
• Not telling the broker about significant changes, like a new office or a big new data system.

Cyber insurance readiness checklist

Use this before your next application or renewal. Every unchecked box is either a project or an explanation to give your broker.

Identity and access

• MFA enforced for all users on email and cloud apps
• MFA enforced on all remote access (VPN, RDP gateways, remote-support tools)
• MFA enforced on all admin accounts, including the IT provider's
• Legacy authentication blocked
• No staff with local admin rights; separate admin accounts for IT work
• Unique local admin passwords per device
• Departed users disabled promptly

Endpoints

• EDR on 100% of computers and servers
• EDR alerts monitored 24/7, with a documented response process
• Full-disk encryption on all laptops and desktops
• No unsupported operating systems (or isolated and documented)
• Patches applied within a defined window; compliance reported

Email

• Advanced filtering (attachments and links)
• SPF, DKIM and DMARC configured
• External sender tagging enabled
• Written callback verification for payment and bank changes

Backups

• Backups cover servers, critical PCs and Microsoft 365
• At least one offline or immutable copy
• Backup system uses separate credentials with MFA
• Restore tests performed and recorded

Network

• No RDP exposed to the internet
• Firewall and VPN firmware current
• Guest Wi-Fi, medical devices and POS segmented from business network

People and plans

• Security awareness training for all staff, with records
• Phishing simulations, with results tracked
• Written incident response plan, printed, with insurer hotline
• Tabletop exercise in the last 12 months
• HIPAA risk assessment or WISP current

Application and policy

• Application reviewed question by question with IT
• Evidence folder saved with dates
• Sublimits, exclusions, consent and panel requirements reviewed
• Policy number and breach hotline in the incident response plan

Prefer an interactive version? Our cyber insurance readiness tool scores your answers and shows which gaps to close first.

Does a managed IT provider help with cyber insurance?

It can, in three practical ways, but it doesn't transfer your responsibility. Applications are signed by you, and the insurer's relationship is with your business.

• Accurate answers. Your IT provider can see your actual configuration: which accounts have MFA, which machines have EDR, when backups were last tested. That turns guesses into facts.
• Evidence on demand. A good provider can produce coverage reports, policy screenshots and restore logs quickly, at application time and after an incident.
• Keeping controls in place all year. Controls drift: a new hire's laptop misses EDR, an MFA exception becomes permanent. Ongoing management and monitoring catch that before an underwriter or forensic investigator does.

Many applications ask whether you use a managed service provider and how its own access is secured. Expect questions about MFA on the provider's remote-management tools. That's reasonable, because those tools have admin access to everything. When you're choosing a managed IT provider, ask how they would help you answer an insurance application.

Questions to ask your broker

1. What controls does this insurer require, and how does it define each one (for example, what counts as "MFA for remote access")?
2. What are the sublimits for ransomware, extortion and social engineering fraud, and is there coinsurance?
3. Is there a waiting period before business interruption coverage starts?
4. Which incident response firms and lawyers are on the panel, and can we use our own IT provider for restoration?
5. What are the notice requirements, and what's the breach hotline number?
6. Are there conditions requiring us to maintain specific controls during the policy period?
7. Does the policy cover regulatory defense and fines (for example, HIPAA investigations) where insurable?
8. Is there a retroactive date, and does it cover incidents that began before the policy started but were discovered later?

The bottom line

Insurers now ask about the same handful of controls because those controls decide how big a claim gets: MFA everywhere it's asked about, EDR with someone watching, backups that survive an attack, prompt patching, trained staff, locked-down admin accounts and a written response plan. Put them in place, prove it with evidence, and answer the application exactly as things are. That's how you get better terms and, more importantly, a claim that gets paid.

If you'd like help reviewing an application, closing gaps before renewal, or building the evidence folder, see our managed IT and security services and our work with healthcare practices, or book a free 20-minute call. (We're an IT provider, not an insurance broker. We'll work alongside yours.)