A few years ago, buying cyber insurance was mostly a matter of filling out a short form and paying the premium. Today the application can run for pages, and the answers decide whether you get a quote, what it costs, and in some cases whether a claim is paid.
This guide explains the cyber insurance requirements small businesses most commonly run into: the security controls insurers ask about, the evidence worth keeping, how to prepare before an application or renewal, and the mistakes that cause trouble. It draws on the controls IronGate MSP builds into its cybersecurity services for Orlando and Central Florida businesses. Requirements vary by carrier, so treat this as a planning guide and confirm specifics with your insurance broker.
Why Cyber Insurers Now Ask So Many Security Questions
Insurers pay out when attacks succeed, so they’ve learned which controls tend to separate businesses that recover from businesses that don’t. Ransomware, business email compromise, and stolen credentials all come down to a short list of preventable weaknesses, and underwriters now ask about those weaknesses directly. A business that can show the right controls is simply a better risk.
The practical effect is that your security setup and your insurance options are now linked. Controls that were once “nice to have” are commonly treated as conditions for coverage or for reasonable pricing, and the application is where you’re asked to prove them.
The Controls Insurers Commonly Require
Exact questions differ between carriers, but the same core controls appear again and again. Here is how they typically look, along with the evidence that makes your answers credible.
Control | What Insurers Typically Look For | Evidence Worth Keeping |
|---|---|---|
Multi-factor authentication (MFA) | Enforced on email, remote access, cloud applications, and administrator accounts | Report showing which accounts are enrolled and which apps enforce MFA |
Endpoint detection and response (EDR) | Monitored protection on computers and servers, beyond basic antivirus | Console list of protected devices compared with your actual device inventory |
Protected, tested backups | Copies kept separate from the main network and protected from tampering, with restores actually tested | Backup logs and dated restore-test notes |
Patching | Operating systems and software updated promptly, with unsupported systems retired or isolated | Patch reports and an inventory of end-of-life systems |
Email security | Threat filtering and, commonly, email authentication records such as SPF, DKIM, and DMARC | Filtering configuration and domain record settings |
Security awareness training | Regular employee training, often with phishing practice | Training dates, topics, and attendance |
Incident response plan | A written plan that says who does what if an attack happens | The plan itself, with the date it was last reviewed |
MFA Has to Reach Beyond Email
A common gap is enabling MFA on email and stopping there. Underwriters tend to ask about remote access, VPNs, cloud administration, and privileged accounts as well, and a single exposed account without MFA can undo the rest. If your team works in Microsoft 365, our Cloud and Microsoft 365 support covers how identity and access settings fit into the wider environment.
EDR Means Monitored, Not Just Installed
Insurers increasingly distinguish between traditional antivirus and endpoint detection and response, which watches device behavior and can isolate a machine showing signs of attack. The detail that trips people up is coverage. If the console shows 40 devices and you actually have 55, the answer to “is EDR on every endpoint?” is no, however good the product is.
Backups Must Survive an Attack and Prove It
Underwriters ask whether backups are separated from your production network, protected from deletion or encryption, and tested. Having backups running is not the same as being able to restore from them. We explain the difference between copies of data and the ability to run your business again in Backup vs. Disaster Recovery, and the broader ransomware picture in our ransomware protection guide.
Patching, Email Security, and Training Close the Common Gaps
Timely patching, email filtering, and employee training address the most common ways attackers get in. Insurers often ask whether you still run software that no longer receives security updates, since those systems are easy targets. On training, a short recurring program with a simple reporting habit is what most underwriters hope to see; why employee training matters outlines what that looks like.
Why Applications Get Delayed and Claims Get Disputed
The most expensive mistake is an inaccurate application. Answers like “yes, we use MFA” or “yes, backups are tested” are statements the insurer may rely on later. If a claim reveals that MFA covered email but not the VPN that was breached, or that backups had never been restored, the insurer can question whether coverage applies as expected.
The fix isn’t to give cautious answers. It’s to know your real answers before you sign. Check each control across your whole environment, note any exceptions, and either fix them first or describe them accurately. Many carriers also run external scans of internet-facing systems during underwriting, so what you declare should match what an outsider can see.
How to Prepare Before an Application or Renewal
- Get the application or renewal questionnaire early, and read it before your deadline rather than during it.
- Inventory your devices, accounts, and software so every answer is based on the full environment.
- Check MFA enforcement on email, remote access, cloud apps, and admin accounts, and close any gaps.
- Compare your EDR console to your device list and add any unprotected computers and servers.
- Run a backup restore test and record the date and result.
- Review patch status and identify unsupported systems to retire or isolate.
- Write down or update your incident response plan, including contacts and decision-makers.
- Save the evidence in one folder so you can respond quickly to follow-up questions.
Many of these steps can be completed in days or weeks rather than months, though the timeline depends on your environment. Starting before your renewal date keeps you from rushing and from answering questions you haven’t verified.
Requirements That Go Beyond the Basics
Larger policy limits, higher-risk industries, and some carriers bring additional questions. These can include how administrator accounts are managed, whether the network is segmented, how vendors with access to your data are vetted, and whether you’ve exercised your incident response plan rather than just written it. If you hold sensitive data or operate in a regulated field, expect closer attention, and note that insurance requirements are separate from legal ones such as those discussed in our guide to HIPAA-compliant IT support.
Where Your IT Provider Fits, and Where Your Broker Does
Your IT provider and your insurance broker do different jobs. A broker helps you choose coverage, limits, and exclusions, and is the right person to interpret what a policy will actually pay for. Your IT provider implements and documents the controls that make the application accurate. IronGate MSP’s cybersecurity support covers the technical layers insurers ask about, including endpoint protection, email threat filtering, MFA setup, monitoring, and backup planning, alongside managed IT support for patching and day-to-day upkeep.
Policy decisions belong with a licensed broker or agent, so bring your IT provider into the conversation early. A short call between the two often resolves ambiguous questions before they become wrong answers.
Common Mistakes When Preparing for Cyber Insurance
- Answering “yes” to a control that exists in one place but not across the whole environment
- Assuming backups work without ever running a restore test
- Treating basic antivirus as the same thing as EDR
- Leaving old, unsupported systems on the network without mentioning them
- Waiting until the renewal deadline to look at the questionnaire
- Assuming insurance replaces security rather than depending on it
Frequently Asked Questions
Is cyber insurance legally required for a small business?
Generally, no general law requires a small business to carry cyber insurance. However, customer contracts, vendor agreements, or industry arrangements sometimes require proof of coverage, so check your agreements. Even when it’s optional, many owners buy it because a single incident can cost more than a small business can absorb.
Does cyber insurance cover ransom payments?
It depends on the policy. Some policies include cyber extortion coverage, others limit or exclude it, and conditions often apply. Ask your broker exactly what is covered, what the sub-limits are, and what the policy requires you to do before and after an incident.
Will improving my security controls lower my premium?
It can improve your chances of getting coverage and may help with terms and pricing, but premiums depend on many factors, including your industry, size, claims history, and the market. Think of strong controls as improving your options rather than guaranteeing a specific price.
Can good cyber insurance replace a security program?
No. Insurance helps pay for losses after an incident, but it doesn’t restore your reputation, return stolen data, or keep systems running. It also often depends on you maintaining the controls you declared, which is why security and insurance work best together.
Conclusion
Cyber insurance requirements for small businesses come down to a consistent set of controls, MFA, EDR, protected and tested backups, patching, email security, training, and a written response plan, plus the evidence to back up your answers. The businesses that fare best treat the application as a snapshot of their real security, not a form to get through.
If you’d like to see where your environment stands before your next application or renewal, IronGate MSP offers a no-obligation consultation. Schedule a consultation.