Cyber Insurance Requirements Checklist for Small Businesses
Short answer: Most cyber insurers now expect small businesses to have multi-factor authentication on email, remote access and admin accounts, endpoint detection and response on every computer, tested backups kept separate from the main network, regular patching, email filtering, staff phishing training and a written incident response plan. Missing controls can raise premiums, block an application or complicate a claim. Requirements vary by carrier, so confirm the details with your broker.
Cyber insurance applications used to be a short form. Today they are detailed security questionnaires, and carriers verify more than they used to. If you cannot show the controls you claim, you risk a higher premium, a denied application or a disputed claim. This checklist covers what insurers most often ask about and how to prove each item.
This is general information, not legal or insurance advice. Your carrier and broker decide the requirements for your policy.
The cyber insurance controls checklist
| Control | What insurers typically ask | How to show it |
|---|---|---|
| Multi-factor authentication (MFA) | MFA on email, remote access, admin accounts and often all cloud apps | Screenshots of enforced MFA policies and a list of covered accounts |
| Endpoint detection and response (EDR) | Modern EDR, not only antivirus, on computers and servers | Console report showing devices protected and alerts monitored |
| Backups | Regular backups kept separate from the network, often immutable or offline, and tested | Backup reports and records of restore tests |
| Patching | Operating systems and software updated on a schedule | Patch compliance report |
| Email security | Spam, phishing and malicious attachment filtering | Email security configuration and settings summary |
| Security awareness training | Employees trained on phishing, with periodic testing | Training completion records |
| Admin and privileged access | Limited admin rights and separate admin accounts | List of admin accounts and approval process |
| Incident response plan | A written plan with contacts and steps, ideally tested | The plan document and date of the last review |
| Logging and monitoring | Central logs and alerting on suspicious activity | Monitoring dashboard or report |
| Unsupported systems | No end-of-life operating systems or software on the network | Asset inventory with software versions |
| Encryption | Laptops and sensitive data encrypted | Device encryption status report |
How to prepare for a cyber insurance application or renewal
- Get the questionnaire early. Ask your broker for the application or renewal questions at least a month ahead so you have time to fix gaps.
- Run an honest gap check. Mark each control as done, partly done or missing. Our free IT security assessment does this for you.
- Close the high-impact gaps first. Multi-factor authentication, backups and endpoint protection come up on almost every application.
- Collect evidence. Keep screenshots, reports and policy documents that show each control is in place.
- Answer accurately. A wrong answer on an application can create problems when you file a claim. If a control is not in place, say so and tell your broker your plan to add it.
- Review every year. Requirements change at each renewal. Treat this as a yearly process.
Want this reviewed for your business? Book a free IT assessment and get a clear plan.
What if you are missing a control?
You are not alone. Many small businesses are missing at least one item. Start with the controls that stop the most common attacks: multi-factor authentication, tested backups and email protection. Then work through the rest in priority order. A documented plan with dates is better than silence.
How The Computer Guyz helps
We work with Charleston businesses that need to meet cyber insurance requirements and compliance standards such as HIPAA, PCI-DSS and CMMC. We help you identify gaps, put the controls in place, and gather the evidence your questionnaire asks for. Our cybersecurity services include monitoring, endpoint protection, email security, backups and incident response support, and our flat per-user pricing is explained in our pricing guide.
Frequently Asked Questions
Does cyber insurance require multi-factor authentication?
Most carriers now ask about multi-factor authentication on email, remote access and administrator accounts, and some require it before they will offer coverage. Check your application or ask your broker for your carrier requirements.
What is EDR and why do insurers ask about it?
EDR stands for endpoint detection and response. It monitors computers for suspicious behavior and can isolate a threat quickly. Insurers ask about it because it detects ransomware and intrusions that traditional antivirus often misses.
Can a missing backup affect a cyber insurance claim?
It can. Backups affect how quickly you can recover from ransomware, and insurers often ask whether backups are separate from your network and tested. Missing or untested backups can raise your premium or complicate a claim.
How long does it take to prepare for a cyber insurance renewal?
Allow at least four to six weeks before the renewal date. That gives you time to review the questionnaire, close gaps such as MFA and backups, and gather evidence.
Can you help us answer our cyber insurance questionnaire?
We can help you identify gaps, put controls in place and gather the evidence the questionnaire asks for. Your broker or carrier decides the final requirements for your policy.
Get an Exact Quote
Start with a free IT assessment. We review your current setup, flag real risks and give you a clear plan, with no obligation. Call (843) 884-1323, contact us or get an instant quote.
Ready for a straight answer? Start with a free IT assessment. No pressure, no obligation.
Or call (843) 884-1323.