Cyber insurance applications used to feel relatively simple, but that has changed. As cyberattacks have become a routine business risk, insurers have become more interested in how businesses actually protect their technology. For small businesses, that can make a cyber insurance questionnaire feel surprisingly technical.
- Do you have multi-factor authentication?
- Endpoint detection and response?
- Reliable backups?
- Email phishing protection?
- Secure remote access?
- Encryption?
- Patch management?
If you don’t work in IT, some of those questions may be difficult to answer confidently. But they point to a bigger shift: Cyber insurers increasingly want evidence that a business is actively managing its cyber risk, not simply buying insurance against it.
What Cybersecurity Controls Do Cyber Insurers Look For?
There is no universal cyber insurance checklist. Requirements depend on factors such as:
- Insurance carrier
- Business size
- Industry
- Revenue
- Sensitive data
- Technology environment
- Remote access
- Prior claims
- Requested coverage
- Policy limits
Still, certain controls appear repeatedly in underwriting and cybersecurity guidance: multi-factor authentication, endpoint detection and response, backup strategy, email security, encryption, and remote desktop protocol controls are among common requirements that may need to be addressed before certain cyber policies are bound.
1. Multi-Factor Authentication
Multi-factor authentication is one of the most important account-security controls a business can implement. If an attacker steals a password, MFA creates another barrier before that password can be used to access the account.
But insurers may care about more than whether MFA exists somewhere. The real questions may include:
- Is MFA required for all email accounts?
- Is it required for administrators?
- Is it required for remote access?
- Is it required for cloud applications?
- Does every appropriate user have it enabled?
For small businesses, “We have MFA” is not enough information. You need to know where you have it.
2. Endpoint Detection and Response
Traditional antivirus still has a role in cybersecurity. But modern attacks require more visibility. Endpoint detection and response, commonly called EDR, monitors computers and other endpoints for suspicious activity and can provide capabilities beyond basic signature-based antivirus.
Cyber insurers may ask whether endpoints have appropriate security protection because a compromised computer can become an entry point into the rest of the business. The important questions are:
- Are all appropriate devices covered?
- Is the protection centrally managed?
- Are alerts actually monitored?
- What happens when suspicious activity is detected?
Installing security software is the beginning. Someone also needs to manage it.
3. Reliable, Protected Backups
Backups are particularly important when dealing with ransomware, accidental deletion, corrupted data, and other disruptive events. But insurers and cybersecurity professionals increasingly care about more than whether a backup exists. A strong backup process should consider:
- What data is protected
- How frequently it is backed up
- Whether backups are isolated from the original environment
- Whether attackers could delete or encrypt them
- Whether backup jobs are monitored
- Whether restoration has been tested
That’s a much higher standard than: “We sync everything to the cloud.” Cloud storage and backups solve different problems.
4. Email Security
Email remains one of the easiest ways for attackers to reach employees. Phishing, credential theft, malicious attachments, impersonation, and fraudulent payment requests all begin with something that can look completely normal to the recipient. That’s why email phishing security controls may appear in cyber insurance conversations.
For a small business, email protection should be considered alongside:
- MFA
- Employee training
- Domain protection
- Suspicious link detection
- Attachment scanning
- Account monitoring
- Procedures for verifying financial requests
One technology control won’t eliminate phishing. The goal is to make it harder for one deceptive message to become a business-wide incident.
5. Software Updates and Patch Management
Cybercriminals don’t only exploit brand-new security flaws. They also exploit known vulnerabilities that organizations haven’t patched. For a small business, insurers may want to understand whether software updates are being managed consistently. That’s different from saying: “Automatic updates are probably turned on.”
A managed patching process creates visibility into:
- Devices that need updates
- Missing security patches
- Failed installations
- Unsupported software
- Computers that have fallen behind
The goal is consistency in your computer maintenance process.
6. Secure Remote Access
Remote work changed the technology footprint of many small businesses. Employees may access company systems from:
- Home
- Hotels
- Coworking spaces
- Client offices
- Mobile devices
- Personal networks
Remote access needs appropriate controls. That can include MFA, secure remote-access tools, VPNs where appropriate, restricted administrative access, and properly managed devices.
If a cyber insurance questionnaire asks about remote access, don’t assume the person filling out the form knows every way employees or vendors can connect. Your IT vendor will know how to respond.
7. Access Control and Administrative Privileges
Not every employee needs access to everything. Good cybersecurity limits access based on what someone actually needs to perform their job. This is commonly called the principle of least privilege.
For a five-person company, formal access management may sound excessive, but it isn’t. If the bookkeeper needs the accounting system but doesn’t need administrative access to every computer, those permissions should reflect that. If an employee leaves, access should be removed promptly. If somebody has an administrator account, that access should receive stronger protection. Small team doesn’t mean everyone should be an administrator.
8. Encryption
Encryption helps protect data from being read by unauthorized people. Insurers may ask whether sensitive information is encrypted on devices, during transmission, or in other parts of the environment. The exact requirements depend on the organization and policy.
But small businesses should at least understand:
- Where sensitive data is stored
- What devices contain business information
- Whether laptops have appropriate encryption
- How data is shared
- What happens if a device is lost or stolen
You can’t protect information effectively if you don’t know where it lives.
9. Employee Cybersecurity Training
Technology can stop many threats. Employees will still encounter situations technology can’t make every decision about, such as a convincing invoice, a fake Microsoft login page, a phone call pretending to be the owner, a request to change bank details, or a fraudulent MFA approval request. That’s why cybersecurity awareness training matters.
Employee cybersecurity training works well alongside access controls, updates, monitoring, backups, and other protections for small businesses. Employees don’t need to become cybersecurity experts. They need to know how to recognize unusual situations and what to do next.
10. An Incident Response Plan
Cybersecurity controls reduce risk, but don’t eliminate it. Businesses also need to know how they will respond when something does happen. An incident response plan should answer questions such as:
- Who calls IT?
- Who has authority to make decisions?
- Who contacts the cyber insurance carrier?
- Who contacts legal counsel?
- How will employees communicate if normal systems are unavailable?
- Where is the insurance information stored?
- What systems need to be restored first?
Planning before an incident is much easier than making all of these decisions while the business is under pressure.
Insurers May Expect More Than Tools
One of the biggest misconceptions is that cyber insurance readiness means buying a checklist of products. But in order to make a claim, your cybersecurity controls need to remain operational. Someone needs to:
- Monitor them
- Maintain them
- Apply updates
- Respond to alerts
- Remove old users
- Add new users correctly
- Verify backups
- Review configurations
- Replace unsupported technology
That’s why cybersecurity is an ongoing business function and why working with a managed IT services provider makes your cyber insurance easier to maintain. Because your insurance for cyber coverage needs to match how your IT infrastructure actually operates. Managed IT doesn’t replace your insurance broker. It helps manage the environment you’re insuring.
A managed IT provider can help create consistency around areas insurers commonly examine, including:
- MFA
- Endpoint protection
- Backups
- Patching
- Email security
- Remote access
- Account management
- Device security
- Monitoring
- Employee training
This also makes renewals easier. Instead of rediscovering your cybersecurity posture once a year when an insurance questionnaire arrives, you already have someone responsible for maintaining it.
Cyber insurers increasingly want to know how businesses are reducing the likelihood and impact of a cybersecurity incident. For small businesses, that doesn’t mean building an enterprise-sized security department. It means putting sensible controls in place and making sure someone is responsible for them. The goal isn’t to look secure on an insurance application. It’s to actually be secure enough that your answers accurately describe the way your business operates.