Cyber Insurance IT Requirements: A Small-Business Guide

Why cyber insurance got complicated

A few years ago, buying cyber insurance was simple. You filled out a short form, paid a modest premium, and moved on. Today, insurers ask detailed technical questions before they'll give you a quote — and if you answer "no" to the wrong one, they may decline coverage, raise your price, or deny a claim later.

Cyber insurance (a policy that helps cover the costs of a data breach, ransomware attack, or other cyber incident) has become harder to qualify for because insurers paid out a lot of claims. Now they want proof that your business has basic protections in place before they take on the risk.

For a 5–50 person company with no IT staff, the application can feel like a pop quiz in a language you don't speak. This guide explains what the questions mean and how to be ready.

What insurers actually require

Requirements vary by carrier, but most applications now ask about the same core controls. Here's what they mean.

Multi-factor authentication (MFA)

MFA means logging in requires two things: your password and a second step, like a code from an app on your phone. This is the single most common requirement — many insurers simply won't cover you without it.

They'll usually ask whether MFA is enabled for:

• Email (especially Microsoft 365 or Google Workspace)
• Remote access (any way employees log in from outside the office)
• Administrator accounts (the powerful accounts that can change settings for everyone)

If you answer "yes" on the form but it isn't actually turned on, a denied claim could follow. Accuracy matters.

Reliable, tested backups

Insurers want to know you can recover your data without paying a ransom. Expect questions about:

• Whether backups exist and run automatically
• Whether at least one copy is stored offline or separated from your network (so ransomware can't reach it)
• Whether you've actually tested restoring from a backup

A backup you've never tested is a guess, not a safety net.

Endpoint protection

"Endpoints" are your computers, laptops, and servers. Insurers want modern security software on each one. Increasingly they ask for EDR (Endpoint Detection and Response) — a more advanced tool than traditional antivirus that watches for suspicious behavior and can stop an attack in progress, not just block known viruses.

Security awareness training

Many breaches start with an employee clicking a bad link. Insurers often ask whether you train staff to recognize phishing (fake emails designed to steal passwords or money). Regular, documented training is what they're looking for.

Patching and updates

Software updates often fix security holes. Applications may ask how quickly you apply updates to computers and critical systems. "When we get around to it" is not a good answer — a managed process is.

Email filtering and firewall

Expect questions about spam/phishing filtering on email and whether you have a business-grade firewall (the device that controls traffic between your network and the internet). A home-router-grade setup may raise flags for a growing business.

Access controls and separated admin accounts

Insurers increasingly ask whether staff have only the access they need, and whether admin accounts are separate from everyday accounts. The idea: if one account is compromised, the damage is contained.

A plain-English readiness checklist

Before you start an application, see how many of these you can honestly check off:

• [ ] MFA is on for email, remote access, and admin accounts
• [ ] Backups run automatically, with one copy kept offline or isolated
• [ ] We have restored a test file from backup in the last few months
• [ ] Every computer has modern endpoint protection (ideally EDR)
• [ ] Staff receive regular phishing/security awareness training
• [ ] Updates are applied promptly across devices
• [ ] Email has spam and phishing filtering
• [ ] We use a business-grade firewall
• [ ] Employees have only the access they need
• [ ] We have a written plan for who to call during an incident

If you're checking fewer than half of these, that's not a reason to panic — it's a roadmap. Most of these are achievable in weeks, not months.

How to fill out the application honestly

The most important rule: answer truthfully. It's tempting to check "yes" to get a lower premium, but insurers can investigate after a claim. If you said you had MFA and you didn't, your claim can be denied — leaving you with both the breach costs and the premiums you paid for nothing.

If you're unsure what an answer should be, that uncertainty is itself useful information. A question you can't confidently answer is usually a gap worth closing.

Practical tips:

• Don't guess. If you don't know whether MFA is on for all admin accounts, verify it before answering.
• Keep records. Save training completion reports, backup logs, and documentation of your tools. Insurers may ask for proof at renewal or claim time.
• Loop in whoever manages your IT. They can answer the technical questions accurately — and may already have much of what you need.

How this affects your premium

In general terms, the more of these controls you have in place, the better your options. Businesses with strong security often see lower premiums, higher coverage limits, and more carriers willing to quote them. Businesses missing the basics may face higher prices, limited coverage, or outright declines.

We won't quote specific numbers — pricing depends on your industry, size, and the carrier. But the pattern is consistent: good security pays for itself twice, once in reduced risk and again in insurability.

A realistic example

Imagine a 20-person accounting firm on the South Shore. They apply for cyber insurance and hit a wall: the application requires MFA on email and remote access, tested backups, and EDR on every machine. They have none of it clearly in place.

Rather than fudging the answers, they spend a few weeks turning on MFA, moving to a backup system with an isolated copy, and deploying EDR across their laptops. They document a simple incident plan. When they reapply, they can honestly check the key boxes — and they qualify.

The side benefit: the same steps that made them insurable also made them dramatically harder to breach in the first place. That's the real point. Cyber insurance requirements are, essentially, a checklist of the protections every small business should have anyway.

Where a managed IT provider fits in

Most of these controls are things a managed IT provider sets up and maintains as part of normal service — MFA, backups, endpoint protection, patching, and the documentation insurers ask for. If you don't have IT staff, having someone who can both implement the controls and accurately complete the application takes a real weight off.

If you're staring at a cyber insurance application and aren't sure how to answer, that's a common spot to be in. We're happy to help you figure out where you stand — book a free 20-minute IT Fit Call at https://elecrics.com/book and we'll walk through the requirements together, no pressure.