What Security Do Cyber Insurance Companies Require From Small Businesses?

There is no single set of cyber insurance security requirements that applies to every small business. The controls an insurer requires depend on the application, policy, underwriting criteria, and business risk. Use this guide as a preparation checklist, not as a substitute for reviewing your own application.

More Omaha businesses are buying cyber insurance, and more are finding that the application reads like a security audit. Insurers may ask about your security controls when evaluating an application, and missing controls can affect eligibility, pricing, coverage terms, or renewal decisions. This guide explains the controls that applications commonly ask about, what each one means in plain language, and how to prepare before your renewal.

Every insurer and policy is different, so always read your own application and policy, and talk to your insurance agent about coverage questions. What follows is about the technical side.

Why insurers ask about security controls

A cyber policy can cover costs such as incident response, data recovery, business interruption and notifying affected people after a breach. Insurers price that risk by looking at how likely you are to have a claim. Controls like multi-factor authentication and tested backups make common attacks, such as stolen passwords and ransomware, less likely to succeed or less damaging when they do.

The application is also a legal document. If you answer “yes” to a control you do not really have, the insurer may question a claim later. Answer accurately, and fix gaps before you answer where you can.

Multi-factor authentication (MFA)

MFA means signing in with something beyond a password, such as a code from an app on your phone. It reduces the risk of unauthorized access when a password is stolen or guessed, although it does not prevent every account compromise.

Applications commonly ask whether MFA is on for:

• Email, including Microsoft 365 or Google Workspace
• Remote access, such as VPN or remote desktop
• Administrator and privileged accounts
• Cloud applications and backups

Watch the details. Enabling MFA for most users but leaving administrator accounts, remote access, or other in-scope accounts unprotected can create significant gaps. Check how your email platform handles shared mailboxes and their associated sign-in accounts. Our Microsoft 365 security checklist walks through how to check.

Endpoint detection and response (EDR)

Traditional antivirus looks for known bad files. EDR also watches for suspicious behavior on each computer and server, such as a program suddenly encrypting files, and can isolate a machine to stop an attack spreading. Some applications specifically ask about endpoint detection and response (EDR), including whether alerts are monitored and acted on around the clock. Check your application for the required technology and monitoring arrangements.

Questions to be ready for:

• Is EDR installed on every computer and server, not just most of them?
• Who watches the alerts, and how fast do they respond?
• Can it isolate a device remotely?

Backups that you have actually tested

Insurers ask about backups because isolated, recoverable copies can help restore systems after ransomware without paying a ransom. Recovery also depends on backup integrity, restoration procedures, and the extent of the attack. Typical questions include:

• Are backups kept separate from your main network, or offline, so an attacker cannot delete them?
• Are they encrypted?
• How often do you back up, and how far back can you restore?
• When did you last test a restore?

An untested backup does not confirm that your data can be restored. Schedule test restores and keep a record of them. Our backup and disaster recovery page covers what a good setup looks like.

Other security controls insurers may ask about

• Patching. How quickly you install security updates, especially for systems exposed to the internet.
• Email filtering. Tools that block phishing and malicious attachments before they reach staff.
• Security awareness training. Regular training and phishing simulations for employees.
• Admin rights. Whether everyday users have administrator access on their computers. Removing it limits damage.
• Payment verification. Whether you confirm changes to bank details or wire instructions by phone, which helps against invoice fraud.
• Incident response plan. A written plan for who to call and what to do during an attack.
• End-of-life systems. Whether you still run software the vendor no longer patches.

Summary: common application controls

Control	Example application question	What to verify before answering
MFA	Which users, systems, and remote-access methods require MFA?	All accounts and access methods covered by the application’s wording meet the stated requirement.
Endpoint security	Which devices require endpoint protection, and what monitoring is required?	Required devices are covered, and any specified alert-monitoring requirements are met.
Backups	What isolation, encryption, retention, and testing requirements apply?	Backups meet the stated requirements, and restore tests are documented.
Patching	How quickly critical updates are applied	A defined schedule and a report showing it happens
Email security	What filtering and anti-phishing protections are required?	Required email protections are enabled and configured.
Email authentication (best practice)	Not always asked	SPF, DKIM and DMARC configured for every sending domain
Training	Regular training and phishing tests	Records of who was trained and when
Payment controls	Call-back verification on bank changes	A written procedure staff follow
Incident response	A written plan	A plan with names and phone numbers, reviewed yearly

What a cyber policy may cover

Policies differ, but the Federal Trade Commission’s guide to cyber insurance lists items to look for, including:

• First-party coverage for your own losses, such as data recovery, business interruption, and costs to notify customers and provide credit monitoring.
• Third-party coverage for claims made against you, such as lawsuits from customers or partners after a breach.
• Incident response support, such as a hotline or access to forensic and legal firms.

The FTC also suggests asking whether the policy covers incidents at your vendors, attacks from outside the United States, and terrorism-related events. These are questions for your insurance agent, but your IT provider can help explain the technical scenarios.

A common gap: social engineering and wire fraud

Business email compromise, where an attacker uses a hijacked or look-alike email account to redirect payments, is one of the costliest types of cybercrime reported to the FBI’s Internet Crime Complaint Center (IC3). Coverage for these losses varies. Some policies require a separate endorsement, impose sublimits, or specify conditions for payment verification. Ask your agent to confirm the applicable terms.

Practical steps that help both security and coverage:

• Call the vendor at a number you already have on file before changing bank details. Do not use the number in the email.
• Require two people to approve wire transfers above a set amount.
• Turn on MFA for email so stolen passwords alone do not let an attacker in.
• Block automatic forwarding of email to outside addresses.

Ransomware: what insurers want to see

Ransomware is one of the main reasons insurers have tightened requirements. CISA’s #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data, testing them regularly, keeping systems patched, using MFA, and having a written incident response plan. These are security best practices; they overlap with many application questions but are not a statement of any insurer’s underwriting requirements.

A good test is to imagine every computer and server in your office encrypted on a Monday morning. Could you restore your key systems from backups the attacker could not reach, and how long would it take? If you are not sure, that is the gap to close first.

A worked example

Consider a 20-person Omaha accounting office filling out its renewal. It has MFA on Microsoft 365 email but not on its remote desktop server. It has antivirus but not EDR. Its backups go to a drive connected to the server.

Before answering the application, the office:

1. Puts remote access behind a VPN with MFA, or moves it to a cloud service that supports MFA.
2. Replaces antivirus with a monitored EDR product on every workstation and the server.
3. Adds a cloud or offline backup copy that the server cannot delete, and tests a restore.
4. Writes a one-page incident response plan and a payment verification procedure.

These changes address common security gaps. The office should verify that the implemented controls meet its insurer’s requirements before answering the application.

What to ask your IT provider

• Can you give me a written list of which accounts have MFA, and which do not?
• Is EDR on every device, and who responds to alerts, including at night?
• Where are our backups stored, can ransomware reach them, and when was the last test restore?
• How quickly are critical patches applied, and can we see a report?
• Will you review our insurance application answers with us before we submit?
• If we have an incident, what will you do in the first hour, and does that match our insurer’s requirements?

How to prepare before renewal

1. Get the application early. Ask your agent for it a couple of months before renewal so you have time to close gaps.
2. Take inventory. List every computer, server, user account and cloud service. You cannot answer “all devices” without knowing what all devices are.
3. Prioritize gaps against the application requirements. Start with practical changes, such as enabling required MFA and deploying the specified endpoint protection, while accounting for legacy systems and implementation constraints.
4. Test a restore and write down the date and result.
5. Write things down. A short incident response plan and a record of training help you answer honestly and quickly.
6. Review answers with your IT provider before you sign, so each “yes” is accurate.

How Cambium Data helps

Serving Omaha businesses since 2009, Cambium Data helps put practical security in place. We can review your insurance application with you, check each control against what you actually have, and fix the gaps. See our cybersecurity services, contact us, or call (402) 514-3200.

Sources

• FTC, Cyber Insurance (Cybersecurity for Small Business)
• CISA, #StopRansomware Guide
• CISA, More than a Password
• FBI, Internet Crime Complaint Center (IC3)

Frequently asked questions

Will I be denied cyber insurance without MFA?

Missing MFA can affect eligibility, pricing, or coverage terms, depending on the insurer and policy. Check the application and confirm the requirements with your agent.

Is antivirus enough, or do I need EDR?

Many applications now ask about EDR specifically. Traditional antivirus alone may not satisfy those questions.

What if I answer an application question wrong?

Inaccurate application answers can have serious consequences for coverage, depending on the circumstances, policy terms, and applicable law. Verify technical details with your IT provider and discuss coverage questions with your agent before submitting.

How often should we test backups?

At least on a regular schedule, such as quarterly, and after major changes. Keep a record of each test.

Does cyber insurance replace good security?

No. Insurance helps with the cost of an incident. Security controls make incidents less likely and less severe.

TU

Tony Underwood

Founder, Cambium Data

Tony founded Cambium Data in 2009 and still leads the team. A Navy veteran with more than three decades in IT, he helps Omaha businesses run secure, dependable technology and put AI to practical use.

LinkedInsite.tonyunderwood.us