What Cyber Insurance Companies Require From Small Businesses

Short answer: Most cyber insurance applications now ask whether you have specific security controls in place, and the same handful show up again and again: multi-factor authentication (MFA) on email, remote access and admin accounts, endpoint detection and response (EDR) on computers and servers, backups kept offline or otherwise protected and tested, timely patching, email filtering, employee phishing training, an incident response plan and tight control of admin rights. Exact requirements vary by insurer, industry and company size, so your insurance agent has the final word. Your job is to answer the application truthfully and close the gaps before you sign it.

Cyber insurance used to be a short form. Today it reads more like a security questionnaire, and the answers affect whether you get coverage, what it costs and whether a claim gets paid. Insurers and brokers commonly treat a few of these controls, MFA above all, as minimum requirements.

Note: TechCore is an IT company, not an insurance broker. We can help you understand and put the technology in place. Questions about coverage, limits and policy wording belong with your insurance agent.

What security controls do cyber insurance applications ask about?

Here is a checklist built from the controls that insurers and brokers most often cite. Use it to see where you stand before the application arrives.

Control	What applications commonly ask	What "yes" usually looks like
MFA	Is MFA required for email, remote access and admin accounts?	Every user, every mailbox, every remote connection, no exceptions for the owner
EDR	Do you run endpoint detection and response on all computers and servers?	A monitored EDR tool on every device, not just basic antivirus
Backups	Are backups encrypted, separated from the network and tested?	At least one offline or immutable copy, with restore tests on record
Patching	How quickly do you install critical updates?	A set schedule, with critical fixes applied within the window your insurer asks for
End-of-life systems	Do you run unsupported software or operating systems?	No, or a documented plan to replace or isolate them
Email security	Do you filter inbound email for phishing and malware?	Filtering, external sender tags, domain protection (SPF, DKIM, DMARC)
Training	Do employees get security awareness and phishing training?	Regular training, plus simulated phishing tests
Incident response plan	Do you have a written plan, and has it been tested?	A short written plan with contacts, reviewed at least once a year
Privileged access	Who has admin rights, and are those accounts protected?	Separate admin accounts, MFA on all of them, least privilege
Remote access	Is remote desktop exposed to the internet?	No open remote desktop; access through a secured, MFA-protected connection

Why is MFA the first question?

Stolen and phished passwords are a common way attackers get in, and MFA makes a stolen password far less useful on its own. One large broker's list of key controls puts MFA for remote access and privileged accounts at the top, and at least one insurer's guidance tells applicants to enforce MFA for all users on email, cloud applications and remote access. Some applications go further and ask about MFA on servers, backups and network equipment.

Be careful with this one. In a widely reported 2022 case, an insurer asked a federal court to void a company's cyber policy after a ransomware attack, alleging the application overstated where MFA was in place. The parties later agreed to end the case with the policy rescinded. The lesson is simple: if you check "yes," it needs to be true everywhere the question covers.

What counts as acceptable backups for cyber insurance?

Insurers want to know you can recover from ransomware without paying. That means:

• Separation. At least one copy that ransomware can't reach: offline, air-gapped or locked as immutable so it can't be changed or deleted for a set period. CISA's ransomware guidance calls for offline, encrypted backups because many ransomware variants hunt for and destroy backups they can reach.
• Protection. Encrypted backups, with MFA on any account that can access or delete them.
• Testing. Restore tests on a schedule, with notes on what was restored and how long it took. CISA recommends regularly testing backups in a disaster recovery scenario.
• Coverage. Everything that matters, including cloud data. A common gap is Microsoft 365: if you assume Microsoft keeps a full backup of your email and files, read does Microsoft 365 back up your email and files before you answer that question.

TechCore's cloud services and backup work covers setting up and testing this kind of backup.

What's the difference between antivirus and EDR?

Traditional antivirus mainly looks for known bad files. Endpoint detection and response watches how programs behave on each computer and server, flags suspicious activity and can isolate a device automatically. Many applications ask specifically about EDR, and some ask whether the alerts are actively monitored, often called managed detection and response (MDR). If your answer is "we have antivirus," expect follow-up questions.

What other questions should you be ready for?

• Patching and end-of-life systems. Expect questions about how fast you install critical updates and whether you still run unsupported software, such as Windows 10 without Extended Security Updates or old servers.
• Email security. Filtering, attachment and link scanning, tagging messages from outside the company, and DMARC to stop others from spoofing your domain.
• Training. Some insurers now expect a training program and may require one at renewal. Short, regular training and phishing simulations are usually enough for a small business.
• Incident response plan. Who do you call first, who decides whether to shut systems down, and where are the insurer's breach hotline and your IT provider's numbers written down? It doesn't need to be long. It needs to exist, be reachable when your network is down, and be reviewed.
• Admin rights. Staff shouldn't work day to day in accounts with admin rights. Admin accounts should be separate, few and protected with MFA.
• Vendors. Some applications ask how you manage vendors that connect to your systems.

How should a small business prepare for the application?

1. Get the application early. Ask your agent for the actual questionnaire weeks before renewal, not the day it's due.
2. Answer with your IT team in the room. Many questions are technical. Your IT provider can tell you what is actually in place, not what you think is in place.
3. Fix the easy gaps first. MFA on every mailbox and remote connection is usually the quickest, highest-value fix.
4. Document what you have. Screenshots or reports showing MFA enrollment, EDR coverage, backup tests and patch status make answers easy to support if a claim is ever reviewed.
5. Don't round up. "Mostly" is not "yes." If a control is partial, tell your agent and ask how to answer.
6. Set a review date. Controls drift. New employees, new laptops and new software can quietly break a "yes."

Our networking and security services cover firewalls and network protection, and our help desk handles day-to-day account questions.

FAQ

Do all cyber insurers require MFA?

Requirements vary by insurer and policy, but MFA questions appear on most cyber applications today, especially for email, remote access and admin accounts. Ask your agent what your carrier requires.

Can my claim be denied if my application was wrong?

Insurers have challenged coverage when application answers about security controls turned out to be inaccurate. Answer every question truthfully and talk to your agent about how a partial control should be described.

Does TechCore sell cyber insurance?

No. TechCore is an IT company. We can help with the network, firewall and backup side of the checklist, and your insurance agent handles the policy.

How long does it take to meet these requirements?

It depends on where you start. Turning on MFA can take days, while rolling out EDR, rebuilding backups or replacing end-of-life systems can take weeks. Starting before renewal season gives you room.

Get ready before your next renewal

TechCore helps businesses in Nashville, Middle Tennessee and Chattanooga with the IT side of this checklist, including network security and backups. Request a free IT assessment and we'll review your current setup against this checklist and tell you where the gaps are.