Cyber insurance underwriting has tightened significantly. Where a basic application form once sufficed, most carriers now expect documented security controls before they'll even generate a quote.

Multi-Factor Authentication (MFA)

This is close to a universal requirement now, particularly for remote access, email, and admin accounts. Many carriers will decline to quote at all without MFA in place across these access points.

Endpoint Detection and Response (EDR)

Basic antivirus is increasingly considered insufficient. Carriers often look for modern EDR tools capable of detecting and responding to threats in real time, not just signature-based antivirus scanning.

Backup Strategy

Insurers typically want to see backups that are both regularly tested (not just scheduled) and at least partially offline or immutable — backups connected to your live network can be encrypted by the same ransomware attack they're meant to protect against.

Email Security & Phishing Training

Since phishing remains a leading entry point for breaches, many carriers ask about email filtering tools and whether employees receive regular phishing-awareness training.

Patch Management

A documented process for applying security patches within a reasonable window (rather than ad hoc) is increasingly part of the underwriting conversation, especially for known critical vulnerabilities.

Incident Response Plan

Having a written, and ideally rehearsed, incident response plan signals lower risk to underwriters and can meaningfully affect both eligibility and pricing.

What This Means for Small Businesses

If you're applying for cyber coverage for the first time and don't have these controls in place, budget time to implement them before applying — a rushed or inaccurate application can lead to a denied claim later if the controls weren't actually in place as represented.

Specific requirements vary by carrier and by the size/industry of your business. A cyber insurance broker can tell you which controls are non-negotiable for your specific application.