A few renewals ago, a client of mine, a regional accounting firm with about sixty staff, forwarded me their application with a note about the cyber insurance requirements: “Can you just tick whatever boxes get us the best price?” I understood why. For years, cyber insurance felt like a formality. You answered a dozen questions, wrote a check, and filed the policy away.
That world is gone. Today, cyber insurance requirements read less like a questionnaire and more like a security audit. Underwriters want to know exactly how you authenticate users, how fast you patch, where your backups live, and whether anyone has actually tested restoring them. And when a claim comes in, the carrier’s forensic team will check whether your answers held up.
I spend most of my working weeks sitting between business owners and underwriters. I translate what carriers ask into language a managing partner or operations director can act on, and I translate a client’s security reality back into terms an underwriter will accept. This article is the conversation I wish every client had with me six months before renewal, not six days.
Why Cyber Insurance Requirements Got So Strict
Insurers did not wake up one morning and decide to make life difficult. The tightening of cyber insurance requirements came from claims data, and the data was ugly.
During the ransomware wave of the early 2020s, carriers paid out on losses they had badly underpriced. When they studied those claims, a pattern jumped out: a small number of missing controls showed up again and again in the worst losses. No multifactor authentication on remote access. Flat networks where one compromised laptop reached everything. Backups sitting on the same domain as production, encrypted right alongside it. Marsh summed up the industry response well: because attacks and related claims skyrocketed, insurers began requiring specific controls and putting insurability itself at stake.
The threat has not softened since. Coalition’s latest claims analysis, drawn from more than 100,000 policyholders, found that initial ransom demands rose 47% during 2025, and that ransomware remained the most expensive claim type at an average loss of $269,000, according to the Coalition 2026 Cyber Claims Report. The same report showed that business email compromise and funds transfer fraud still made up most incidents, which tells you the boring attacks are as dangerous as the dramatic ones.
There is a hopeful side to that data, and it matters for how you think about cyber insurance requirements. Coalition also reported that 86% of businesses hit by ransomware refused to pay, and that average claims cost actually fell even as attacks increased. Organizations with working controls and good recovery capability simply lose less. That is the entire logic behind modern underwriting.
Cyber Insurance Requirements in Practice: The Controls Underwriters Ask About First
Every carrier words its application differently, but after reviewing hundreds of them, I can tell you the core list of cyber insurance requirements barely changes. Here is what underwriters look at first, roughly in order of how often a gap in that area kills or reprices a deal.
1. Multifactor Authentication, Everywhere It Matters
If I could only fix one thing for a client, it would be this. MFA is the gatekeeper control. Without it on email, remote access, and privileged accounts, many carriers will not quote at all.
The standard has also moved. A few years ago, a text message code was enough to satisfy the question. Now, underwriters increasingly ask what kind of MFA you use. The CISA fact sheet on implementing phishing-resistant MFA calls phishing-resistant MFA the gold standard and identifies FIDO/WebAuthn and PKI-based methods as the forms that hold up against modern phishing. For organizations stuck with push notifications in the short term, CISA recommends number matching as an interim step to blunt MFA fatigue attacks.
What I tell clients is simple: the question is not “do you have MFA?” It is “where don’t you have MFA?” Service accounts, legacy VPNs, the old admin portal nobody remembers, the vendor’s remote support tool. Those forgotten corners are where attackers live, and they are exactly what a forensic investigator will find after an incident.
2. Endpoint Detection and Response
Traditional antivirus is no longer enough for most carriers. They want endpoint detection and response (EDR) deployed across workstations and servers, ideally with someone watching the alerts around the clock. For a smaller firm without a security team, that usually means a managed detection and response (MDR) provider, so it pays to understand what managed security services cost per month before you budget for renewal.
Underwriters care about coverage percentage here. “We have EDR” means very little if it sits on 70% of machines. Be ready to state what proportion of your endpoints are covered and how quickly alerts get triaged.
3. Backups That Survive an Attack
This one surprises people, because almost everyone believes they have backups. The question carriers ask is whether your backups would survive a determined attacker.
Research from Sophos found that 94% of organizations hit by ransomware said attackers tried to compromise their backups during the attack, and that median recovery costs for organizations whose backups were compromised came in around eight times higher than for those whose backups stayed intact, as detailed in The Impact of Compromised Backups on Ransomware Outcomes.
So underwriters now probe for specifics. Are backups immutable or kept offline? Are they on separate credentials from your main domain? When did you last perform a full restore test, and how long did it take? A backup you have never restored is a hope, not a control.
4. Patch and Vulnerability Management
For years, stolen credentials were the most common way attackers broke in. That changed this year. The Verizon 2026 Data Breach Investigations Report found that exploitation of vulnerabilities overtook credential abuse as the leading initial access vector, accounting for 31% of breaches, a shift TechRepublic covered in its breakdown of the DBIR findings.
Expect underwriters to follow that data closely. Many carriers now scan your internet-facing systems before they ever send a quote, looking for exposed remote desktop ports, unpatched firewalls, and outdated VPN appliances. They will also ask about your patching windows, particularly for critical vulnerabilities. If your honest answer is “whenever IT gets to it,” that needs to become a documented timeline, whoever handles your IT support.
5. Privileged Access Management
Attackers who land on a normal user’s laptop want one thing next: administrator rights. Carriers know this, so they ask how you control privileged accounts. Do administrators use separate accounts for admin work and daily email? Are domain admin credentials vaulted? Is local admin access removed from standard users?
This area tends to separate well-run environments from the rest. It is also one where small improvements, like removing local admin rights, cost very little and impress underwriters.
6. Email Security and Security Awareness Training
Because business email compromise and funds transfer fraud drive so many claims, carriers want to see filtering, attachment sandboxing, and email authentication records such as SPF, DKIM, and DMARC. They also want evidence that staff receive regular training and phishing simulations.
I push clients one step further here: put a verbal callback procedure in place for any change to payment instructions. It is a policy, not a technology, and it stops a remarkable number of fraud losses. Some carriers will specifically ask about it, and some social engineering coverage is conditioned on it.
7. Incident Response Planning
A written incident response plan, tested through at least one tabletop exercise a year, now sits firmly among standard cyber insurance requirements. Underwriters want to know who makes decisions during an incident, who calls the carrier’s breach hotline, and how you communicate if email is down.
One practical tip: your plan should name your insurer’s incident response panel. Many policies require you to use approved vendors for forensics and legal counsel. Calling your own preferred firm first can create coverage friction at the worst possible moment.
8. Third-Party and Vendor Risk
This is the fastest growing area of scrutiny, and the data explains why. Verizon found that 48% of breaches in its 2026 report involved a third party, up from 30% the previous year. Coverage of the report by Help Net Security highlighted the same rise in supply chain exposure.
For professional services firms especially, your vendors hold your clients’ data. Underwriters increasingly ask whether you assess vendor security before onboarding, whether contracts include security and breach notification terms, and whether vendor remote access is controlled and protected with MFA.
How Underwriters Verify Cyber Insurance Requirements Now
Here is the part many business owners miss: the application is no longer the whole process.
Carriers increasingly run outside-in scans of your domains before quoting. Some ask for screenshots of MFA configurations or EDR dashboards. Larger accounts often get an underwriting call where the carrier’s security specialist asks follow-up questions directly to your IT lead. If you answered “yes” to MFA on all remote access and their scan shows an exposed remote desktop port, that conversation gets awkward fast.
And verification does not stop at binding. After a claim, forensic investigators reconstruct exactly how the attacker got in. Whatever they find gets compared against what you told the carrier about meeting its cyber insurance requirements on day one.
The Case Every Broker Mentions: When Attestations Fail
When I want a client to take the application seriously, I tell them about Travelers and International Control Services.
In 2022, Travelers asked a federal court to rescind a cyber policy it had issued to ICS, an Illinois electronics manufacturing services company. According to Insurance Journal’s reporting, the application, signed by the company’s CEO, stated that MFA protected administrative and privileged access. After a ransomware attack, the investigation found MFA was used only on the firewall and nowhere else. The parties later jointly agreed to rescind the policy, leaving no coverage for the attack, as Insurance Journal reported in its follow-up on the stipulated rescission.
Read that again. Not a reduced payout. No policy at all.
Legal commentators drew the obvious lesson. The National Law Review noted that organizations should have entity-wide MFA in place and be ready to prove it with evidence before applying, at renewal, or whenever an insurer asks.
I do not believe the ICS leadership set out to deceive anyone. More likely, someone answered the question based on what they thought was true. That is precisely the risk. The person signing the application is rarely the person who configures the systems, and the gap between belief and reality becomes the insurer’s grounds for walking away.
What Happens If You Fall Short of Cyber Insurance Requirements
Missing a few cyber insurance requirements does not automatically make you uninsurable. In my experience, gaps usually produce one of these outcomes, from mildest to most severe.
First, higher premiums or a larger retention. The carrier accepts the risk but prices in the gap.
Second, sublimits. You might get a full limit for most losses but a sharply reduced limit for ransomware or funds transfer fraud.
Third, specific exclusions or conditions. Some policies now include coinsurance on ransomware losses if certain controls are missing, meaning you share the loss.
Fourth, a declination. Some carriers simply will not quote without MFA and EDR.
The quiet fifth outcome is the worst: you get coverage, but your application contained an inaccurate answer that surfaces only after a claim.
Turning Cyber Insurance Requirements Into a Renewal Plan
When a client brings me in early, here is the process we follow. It works for a twenty-person agency as well as a five-hundred-person firm.
Start Ninety to One Hundred Twenty Days Before Renewal
This gives you time to close gaps rather than just disclose them. An underwriter who sees “MFA rollout completes next month, here is the project plan” responds very differently from one who sees a blank.
Get the Actual Application Early
Ask your broker for the carrier’s current form, not last year’s. Cyber insurance requirements change every cycle, and the newer questions are more specific.
Answer With Your IT Lead in the Room
The executive who signs and the technician who knows the configuration need to review every answer together. If your IT is outsourced, your managed service provider should be part of this conversation.
Collect Evidence as You Go
Screenshots of conditional access policies, EDR coverage reports, the date and result of your last restore test, your incident response plan, training completion records. Keep them in one folder. You will use it again next year.
Run Your Own Outside-In Scan
Free and commercial tools can show you roughly what a carrier will see, and a penetration test goes deeper. Fixing an exposed service before the underwriter finds it saves both money and credibility.
Be Honest About Gaps, and Pair Them With a Plan
Underwriters are not expecting perfection. They are pricing risk and judging management. A clear explanation with a remediation date earns far more goodwill than an optimistic “yes.”
Use a Framework to Organize the Work
Marsh’s twelve key controls and the NIST Cybersecurity Framework both map closely to the cyber insurance requirements carriers ask about. Mapping your environment to one of them makes each renewal easier than the last. If nobody in-house owns that roadmap, a virtual CIO can.
Cyber Insurance Requirements for Professional Services Firms
Consultancies, accounting practices, law firms, staffing agencies, and marketing agencies face a particular mix of pressures. You hold sensitive client data, you move money or advise on it, and your clients increasingly require cyber coverage in their contracts. A gap in your controls can therefore cost you not just a claim but a client relationship.
The upside is that meeting cyber insurance requirements now pays twice. Strong controls support better insurance terms, and they let you answer your own clients’ security questionnaires with confidence. Several firms I work with now reuse their insurance evidence folder when responding to client due diligence requests, and some use it as the starting point for SOC 2 compliance. Same work, two benefits.
The Bottom Line on Cyber Insurance Requirements
Cyber insurance requirements are not arbitrary hurdles. They are a condensed version of what claims data says actually prevents and limits losses, and the same fundamentals behind any solid small business cybersecurity program: strong authentication, monitored endpoints, survivable backups, fast patching, controlled privileges, trained people, a practiced response plan, and discipline around vendors.
Treat the application as a security review rather than paperwork, answer it with the people who know your systems, and back every “yes” with evidence. Do that, and renewal stops being a stressful annual negotiation. It becomes a confirmation of work you have already done.
Frequently Asked Questions About Cyber Insurance Requirements
What are the most common cyber insurance requirements today?
Most carriers expect MFA on email, remote access, and privileged accounts; EDR across endpoints; secure and tested backups; timely patching; privileged access controls; email security and staff training; and a written incident response plan. Marsh’s twelve key controls offer a solid reference list.
Is MFA mandatory for cyber insurance?
For most carriers, effectively yes, at least for email, remote access, and administrative accounts. Higher limits increasingly call for phishing-resistant methods, which CISA describes in detail.
Can an insurer deny a claim if my security controls were not in place?
Yes. If your application misstated your controls, the carrier may deny the claim or seek to rescind the policy entirely, as happened in the Travelers and ICS case.
Why do insurers care so much about backups?
Because attackers target them. Sophos found that most ransomware victims saw attackers attempt to compromise backups, and recovery costs climbed sharply when they succeeded. See Sophos research on compromised backups.
Do insurers check my systems themselves?
Many do. Carriers commonly scan internet-facing assets before quoting and may request screenshots or hold underwriting calls with your IT team.
What if I cannot meet every requirement before renewal?
You may still get coverage, possibly with higher premiums, sublimits, or exclusions. Disclose gaps honestly and show a dated remediation plan.
Why are insurers asking about my vendors?
Third-party involvement in breaches has risen sharply, reaching 48% in the Verizon 2026 DBIR. Carriers want to know you vet vendors and control their access.
Is ransomware still the biggest cyber insurance risk?
It remains the costliest claim type, but business email compromise and funds transfer fraud cause most incidents, according to the Coalition 2026 Cyber Claims Report.
References
- Marsh. Cyber Resilience: Twelve Key Controls to Strengthen Your Security
- Coalition. 2026 Cyber Claims Report Finds Initial Ransom Demands Surged 47%
- Coalition. 2026 Cyber Claims Report
- Verizon. 2026 Data Breach Investigations Report
- TechRepublic. New Verizon Report Reveals the Security Gap Attackers Are Exploiting Most
- Help Net Security. Lessons for Organizations from the Verizon 2026 Data Breach Investigations Report
- CISA. Implementing Phishing-Resistant MFA Fact Sheet
- Sophos. The Impact of Compromised Backups on Ransomware Outcomes
- Insurance Journal. Travelers Asks Court to Rescind Policy Over Alleged MFA Misrepresentation
- Insurance Journal. Travelers and ICS Stipulate to Rescind Cyber Policy
- The National Law Review. Practical Implications of Travelers v. ICS for Cyber Insurance Brokers, Carriers and Insureds
