Cyber insurance guide
Security controls cyber insurers look for
Cyber underwriting has shifted from a short form to detailed security questions. These are the controls insurers ask about most.
The core controls
- Multi-factor authentication on email, remote access, cloud services, and administrator accounts
- Endpoint detection and response on workstations and servers
- Backups that are encrypted, segregated from the network, and tested
- Patching of critical vulnerabilities on a defined schedule
- Privileged access management, limiting and monitoring administrator accounts
- Email security, including filtering and protections against spoofing
- Security awareness training and phishing simulations
- An incident response plan that has been rehearsed
Why insurers focus on these
Most ransomware and email compromise incidents start with stolen credentials, phishing, or unpatched remote services. Controls that block those entry points reduce claims, so they shape eligibility, retention, and limits.
Answer applications carefully
Application answers become part of the policy. An answer that overstates your controls can give the insurer grounds to deny a claim. If a control is partial, say so and describe the plan to complete it.
Small businesses can meet these standards
Many of these controls are built into common business email and cloud platforms and need only to be turned on and enforced. Managed service providers can deploy endpoint protection and backups for small offices.
See the application checklist.
Frequently asked questions
Is MFA required for cyber insurance?
Most insurers ask about multi-factor authentication on email, remote access, and privileged accounts, and many will not offer coverage without it.
What is EDR?
Endpoint detection and response software monitors computers and servers for malicious behavior and can isolate infected devices.
Do backups need to be offline?
Insurers prefer backups that are offline, immutable, or otherwise segregated so ransomware cannot encrypt them, and that are tested regularly.
More coverage and guides
- First-party cyber coverage
- Third-party cyber liability
- Ransomware and cyber extortion coverage
- Social engineering and funds transfer fraud
- Cyber business interruption
- Regulatory defense and PCI coverage
- Data breach notification laws by state
- Security controls cyber insurers look for
- Cyber insurance application checklist
- What affects cyber insurance cost
- Building a cyber incident response plan
Last updated October 15, 2026 · How we research