Small Business Cyber Insurance Requirements You Can’t Ignore

- Oct. 11, 2026

The renewal email lands on a Tuesday. Your broker forwards it with a short note: “Carrier needs the supplemental application back by Friday.”

You open the PDF. Twenty-two questions. Most are yes/no. Question 4: Do you enforce multifactor authentication for all remote access to your network, including third-party vendors? Question 9: Are backups stored in an air-gapped or immutable environment? Question 14: Is endpoint detection and response deployed on at least 90% of your endpoints?

You don’t know the answer to half of them. Neither does anyone else at your company, because nobody has ever asked before. The IT guy who set things up left two years ago. Your office manager thinks MFA might be turned on for email but isn’t sure about the VPN. And somewhere in the fine print, there’s a sentence that says answering “no” to any of these can result in a denied claim.

This is how a lot of small businesses find out — usually with the clock ticking — that cyber insurance stopped being a form you fill out and pay for. It’s now an audit of your security program, conducted by an underwriter who has never set foot in your office and never will.

If you’re staring at one of those questionnaires right now, this article is for you. We’ll walk through what carriers actually require, what happens when you can’t prove you have it, where small businesses get tripped up, and how to build a security posture that answers “yes” to those questions honestly instead of aspirationally.

Why Cyber Insurers Suddenly Care About Your MFA

Five years ago, most cyber insurance applications were one page. Company name, revenue, industry, a few checkboxes about whether you had a firewall. Carriers were still figuring out how to price the risk, and a lot of them got it badly wrong.

Then the claims came in.

Ransomware losses exploded between 2019 and 2022. Carriers that had been writing $2,000 annual premiums found themselves paying out $400,000 claims — sometimes more than once for the same client, because the client got hit again eight months later. Munich Re, one of the largest reinsurers in the world, has publicly noted the extent to which ransomware drove losses in that period. Several carriers pulled out of the market entirely. Others cut coverage limits, raised premiums, or added waiting periods before coverage began.

The ones that stayed did something predictable: they started requiring controls. Not recommending them. Requiring them.

Think about the economics from the carrier’s side. If a business has MFA on email and VPN, the odds of a credential-stuffing attack succeeding drop dramatically. If backups are immutable and tested, ransomware becomes an inconvenience instead of an existential event. If endpoints have detection and response tools, the dwell time — the gap between compromise and discovery — shrinks from weeks to hours, which means smaller losses.

From an underwriter’s perspective, each of those controls is a lever that reduces expected payout. So they put them in the application. And then they wrote consequences into the policy itself: if you claim you have MFA and a breach shows you didn’t, the carrier may deny the claim or rescind the policy.

That’s the part that catches people off guard. The questionnaire isn’t marketing. It’s part of your contract.

The Core Small Business Cyber Insurance Requirements

Requirements vary by carrier, policy size, and industry. A $1 million limit policy for a 15-person marketing agency looks different from a $5 million policy for a healthcare provider handling PHI. But there’s a core set of controls that shows up on nearly every application today. Here’s what underwriters ask about and what they actually expect to see.

Multifactor Authentication (MFA)

This is the single most common requirement, and usually the first question on the form. Carriers typically want MFA on:

Email accounts (Microsoft 365, Google Workspace)
Remote access, including VPN and remote desktop
Privileged or administrative accounts
Cloud infrastructure consoles (AWS, Azure, Google Cloud)
Any third-party system that touches your data

Some carriers specify acceptable methods. Push notifications with number matching, authenticator apps, and hardware keys (FIDO2) generally pass. SMS text codes are increasingly flagged as weak — they’re vulnerable to SIM swapping — and a growing number of carriers won’t accept them for privileged accounts.

What does “enforce” mean in practice? It means conditional access policies that can’t be bypassed by individual users, not a setting that everyone is supposed to turn on. If a new hire can skip MFA during onboarding, your answer to the questionnaire is technically “no.”

Endpoint Detection and Response (EDR)

Antivirus alone doesn’t cut it anymore. Carriers want EDR, which monitors endpoint behavior rather than just matching known malware signatures. Some policies require EDR on a specific percentage of endpoints — often 90% or 100%. “All endpoints” means all of them, including the laptop the CFO keeps at home and the machine in the warehouse that nobody logs into except to print shipping labels.

Managed detection and response (MDR), where a security team watches the alerts 24/7, may be listed as an alternative or an upgrade. Some carriers price it as a discount.

Backups: The 3-2-1-1 Rule

The old guidance was 3-2-1: three copies of data, on two different media types, with one offsite. Cyber carriers have added a fourth and sometimes fifth element:

Three copies of data
Two different media types
One copy offsite
One copy offline, air-gapped, or immutable
One copy tested for restorability

That last one matters. Underwriters have gotten wise to companies that have backups nobody has ever tried to restore. A backup that fails during recovery is not a backup. Policies increasingly ask when backups were last tested and what the documented restore time is.

Email Security and Phishing Controls

Email remains the number one entry point for attacks on small businesses. Carriers ask about:

Advanced email filtering (beyond the basics bundled with Microsoft 365 Business Basic)
External sender warnings
DMARC, SPF, and DKIM records configured correctly
Link scanning and attachment sandboxing
Impersonation protection for executives and finance staff

The DMARC question trips up a surprising number of companies. It’s a simple DNS record, but nobody on staff owns it, so it’s either missing or set to p=none — which monitors but doesn’t enforce.

Network Security: Firewalls, Segmentation, and IDS/IPS

Questions here tend to focus on whether you have a next-generation firewall with intrusion detection and prevention, whether you segment your network (separating guest Wi-Fi from internal systems, for example), and whether you’re still running unsupported hardware or software. A firewall that stopped receiving firmware updates in 2019 doesn’t impress anyone.

Privileged Access Management

Underwriters want to see that administrative rights are limited. If everyone at the company has local admin on their laptop, that’s a problem. If the shared “admin” account password is on a sticky note in the server room, that’s a bigger one. Expect questions about least-privilege access, separate admin accounts, and password vaulting.

Patch and Vulnerability Management

Patch management shows up in one of two forms: a question about whether critical patches are applied within a set window (often 30 days, sometimes 14 for internet-facing systems), or a question about whether you run regular vulnerability scans. Either way, the carrier wants evidence of a process, not a heroic one-time effort.

Incident Response Planning

Some applications ask whether you have a documented incident response plan and whether it’s been tested in the last 12 months. If you’re a regulated business — healthcare, finance — this is close to a given. For everyone else, it’s an increasingly common ask.

Security Awareness Training

Many carriers require annual training for all employees, often with phishing simulations. The Q&A on the application usually reads something like: “Do you provide security awareness training to all employees at least annually, including simulated phishing exercises?”

Logging, Monitoring, and SIEM

Larger policies often ask about centralized logging and whether you have a security operations center (SOC) or managed SIEM. This is where a lot of small businesses simply can’t answer yes without outside help, and where managed service providers earn their keep.

A Realistic Look at a Supplemental Application

Here’s a trimmed-down version of what a typical supplemental questionnaire looks like for a small business seeking a $1 million to $2 million limit. Real ones run 15 to 30 questions.

| # | Question | Typical acceptable answer |

|—|—|—|

| 1 | Is MFA enforced on all email accounts? | Yes, with conditional access |

| 2 | Is MFA enforced on all remote access? | Yes, including vendor access |

| 3 | Is MFA enforced on all privileged accounts? | Yes, hardware token or app-based |

| 4 | Is EDR deployed on all endpoints? | Yes, 100% coverage, cloud-managed |

| 5 | Are backups immutable or offline? | Yes, with documented retention |

| 6 | Have backups been tested in the last 12 months? | Yes, restore test dated |

| 7 | Is advanced email filtering in place? | Yes, with sandboxing |

| 8 | Are DMARC, SPF, DKIM configured? | Yes, DMARC at p=reject or p=quarantine |

| 9 | Is a next-gen firewall with IPS deployed? | Yes, on all perimeter connections |

| 10 | Is the network segmented? | Yes, guest, internal, and servers separated |

| 11 | Are local admin rights restricted? | Yes, standard users, separate admin accounts |

| 12 | Are critical patches applied within 30 days? | Yes, documented patch cycle |

| 13 | Is security awareness training conducted annually? | Yes, with quarterly phishing tests |

| 14 | Is there a documented incident response plan? | Yes, reviewed and tested annually |

| 15 | Is remote access to third parties logged and approved? | Yes, with MFA and time limits |

Take a look at how many of those require not just a technology but a documented process. Questions 6, 12, 13, and 14 all hinge on evidence. If you can’t produce a date or a log, the honest answer might be “no.”

And here’s the thing: on most applications, a “no” doesn’t automatically disqualify you. It usually triggers follow-up questions, higher premiums, or a coverage sub-limit. But lying — checking “yes” when you haven’t done it — is where people get into real trouble.

What Happens When You Can’t Back Up Your Answers

There’s a phrase you’ll see in nearly every cyber policy: material misrepresentation. It means you told the insurer something that wasn’t true, and they relied on it when pricing or issuing coverage.

After a breach, carriers investigate. They pull logs. They check whether MFA was actually enforced on the compromised account. They look at your backup configuration to see whether it matched what you described. If the investigation shows your application was inaccurate in a way that affected their decision to insure you, they have grounds to:

Deny the claim entirely
Rescind the policy (as if it never existed, with premiums refunded)
Reduce the payout proportionally
Enforce a sub-limit that’s much lower than the headline number

There’s a well-documented pattern of this in property insurance — the “vacancy clause” disputes after hurricane damage, where insurers argued the homeowner misrepresented occupancy. Cyber is heading the same direction. Courts have upheld denials where businesses claimed controls they didn’t have.

The uncomfortable part: many business owners don’t lie on purpose. They sign the application their broker filled out, based on what someone in IT said in a meeting two years ago. That’s still a misrepresentation. The signer is responsible.

Common Mistakes Small Businesses Make on Cyber Insurance Applications

Let’s walk through the ones that come up most often.

Assuming “it’s enabled” means “it’s enforced.” Microsoft 365 has MFA available on every plan. That’s different from having it enforced. If users can opt out, you don’t have MFA for the purposes of the application.

Counting SaaS licenses as controls. Buying an EDR license and deploying it to 40% of endpoints is not EDR deployment. Underwriters look at coverage percentage.

Forgetting about third parties. Vendors, contractors, and MSPs with remote access are often the weak point. Carriers ask about vendor access specifically because that’s how several high-profile breaches started.

Treating backups as a checkbox. Untested backups regularly fail during ransomware recovery. If you can’t restore in a documented timeframe, you don’t have the control the insurer thinks you have.

Ignoring the “documented” part. A patch process that lives in the IT director’s head isn’t a process. It’s a habit. Carriers want policy documents, logs, or reports.

Waiting until renewal to look at any of this. Building a security program takes weeks or months. If you find out 10 days before renewal that you fail six requirements, you’re either paying a big premium increase or scrambling.

Letting the broker fill it out without review. Brokers are not security auditors. They’re filling in blanks based on what you tell them. You need to know what’s actually true.

How Carriers Price Cyber Coverage for Small Businesses

It helps to understand the math, because it explains why one control can swing your premium so much.

Carriers typically estimate annual expected loss by multiplying a base frequency rate (how often businesses like yours get hit) by an average severity (what a claim costs). For a small business, severity commonly lands somewhere between $50,000 and $250,000 depending on data volume and downtime tolerance. Ransomware with data exfiltration, legal fees, notification costs, and business interruption can push higher.

Controls reduce the frequency multiplier. MFA can cut credential-based breach frequency by a large margin. Immutable backups reduce severity because you don’t have to pay the ransom. EDR reduces dwell time, which is directly correlated with claim cost.

Here’s a rough illustration of how a carrier might view the same business under different control postures:

|—|—|—|—|

| MFA everywhere, EDR, offline backups | Low | Moderate | $2,500–$5,000 |

| Above plus MDR/SOC, tested IR plan | Very low | Low | $1,500–$3,500 |

Those numbers are illustrative, not quotes. Actual pricing depends on industry, revenue, data volume, and the carrier’s appetite that quarter. But the shape is real: the difference between an unmanaged and a well-managed security posture can be five figures a year in premium alone. Add in the difference between a paid claim and a denied one, and the stakes get much bigger.

Cyber Insurance Requirements by Industry

Different sectors face different expectations. Here’s a quick map.

Healthcare. Anything touching PHI brings HIPAA into the picture. Carriers expect documented risk analysis, access controls, audit logging, and breach notification procedures. Policies often require a HIPAA-specific endorsement and, increasingly, proof of encryption at rest and in transit.

Legal services. Client confidentiality obligations plus trust account rules. Many carriers require MFA on document management systems (iManage, NetDocuments) and email encryption for client communications.

Financial services and wealth management. SEC and FINRA rules drive much of this. Expect requirements around vendor due diligence, business continuity planning, and detailed incident reporting timelines.

Accounting. Tax data is high-value. Carriers usually want MFA, encrypted file transfer, and specific controls for tax software platforms.

Construction, real estate, and logistics. Historically less regulated, but carriers are tightening. Wire fraud (business email compromise) claims are common in these sectors, so email security and payment verification procedures get extra scrutiny.

Manufacturing and pharma. OT/IT convergence is a growing issue. Carriers may ask about segmentation between production networks and corporate networks, plus patch management for industrial systems.

Nonprofits. Often smaller budgets and volunteer-run IT. Carriers may offer lower limits with fewer requirements, but the core controls (MFA, EDR, backups) still show up.

The Gap Between What You Have and What You Can Prove

This is the distinction that separates businesses that breeze through renewals from businesses that struggle.

There are really three states for any control:

You don’t have it.
You have it but can’t demonstrate it.
You have it and can prove it.

State 2 is the most dangerous. It feels safe. You know MFA is on. You know backups run nightly. But when the carrier asks for evidence — or when a breach forces a forensic review — you can’t produce it in a form anyone accepts.

What does “prove it” look like in practice?

A conditional access policy screenshot with a date and your tenant name
An EDR console dashboard showing endpoint coverage percentage and last check-in time
A backup report showing the last successful restore test, with the date and duration
A patch compliance report for the last 90 days
Training completion records for every employee, including new hires
An incident response plan document with a version history and a tabletop exercise summary
Log evidence of vendor remote access, approved and time-limited

Notice how many of those require tooling that logs and reports. This is why managed services exist. Not because small businesses can’t configure MFA — they can — but because producing ongoing, auditable evidence across a dozen controls takes time nobody has.

Building a Cyber Insurance-Ready Program Without Overbuilding

You don’t need enterprise-grade everything. You need the controls that matter, properly implemented and properly documented. Here’s a practical sequence for a small business.

Step 1: Audit what you actually have

Start with a baseline assessment. Go through the carrier’s questionnaire and answer each question honestly. Where you’re unsure, investigate. This usually takes a week for a 20- to 100-person company.

Step 2: Fix the highest-leverage gaps first

MFA on email and remote access, EDR deployment, and immutable backups are almost always the top three. They’re the requirements most commonly cited in claim denials and the ones that move premium the most.

Step 3: Document everything as you go

Every time you implement a control, capture two things: a screenshot or report showing it’s working, and a one-page policy describing what it is and who owns it. This is the paper trail the carrier wants.

Step 4: Test the things that need testing

Restore a backup. Run a phishing simulation. Walk through your incident response plan with a tabletop exercise. Record the date and outcome. Testing is a control in its own right, and it’s the one most businesses skip.

Step 5: Get outside help where it makes sense

Most small businesses don’t have a security team. Hiring one full-time costs more than the cyber insurance policy itself. A managed service provider or managed security provider can deliver MFA enforcement, EDR, backup management, and audit-ready reporting for a predictable monthly cost — and often at a lower total than the premium increase you’d face without those controls.

Where IP Services Fits Into This Picture

IP Services has been doing managed IT and cybersecurity work since 2001, which means they’ve watched the cyber insurance market tighten in real time. The company’s VisibleOps methodology — developed through research and published in the VisibleOps Handbook series, which has sold over 450,000 copies — is built around the idea that security, compliance, and IT operations aren’t separate projects. They’re the same project.

For small businesses facing cyber insurance requirements, that framing matters. What carriers are asking for isn’t a random list. It’s a security program. MFA, EDR, backups, logging, training, incident response — those are the fundamentals of running IT responsibly. The insurance application is just the moment when somebody finally asks you to prove it.

IP Services offers the pieces that map directly to the questionnaire:

Managed SOC and MDR for the detection, response, and monitoring questions
Managed firewall, IDS/IPS, and email security for network and email controls
Endpoint security with reporting that shows coverage
Compliance-as-a-service for regulated industries where the insurer wants to see governance
Managed backup and disaster recovery with tested restores
Cyber risk assessments and penetration testing to find gaps before the underwriter does
TotalControl™, a system designed to flag IT issues before they turn into outages
Visible AI, which ties cybersecurity and compliance data together

The point isn’t to check every box on the form. It’s to have a security posture that genuinely reduces the odds of a claim, and to have the documentation ready when someone asks. That’s a different kind of value than a one-time assessment, and it’s the kind of thing that tends to pay for itself the first time the carrier asks for evidence.

Frequently Asked Questions About Small Business Cyber Insurance

Do I legally need cyber insurance?

In most states and industries, no. But if you handle credit card data, you’re contractually required by the PCI DSS framework to carry certain protections, and some client contracts mandate cyber coverage. Increasingly, enterprise customers require their vendors to carry it. A few states have introduced legislation requiring cyber insurance for certain public sector contractors.

What happens if I answer “no” to a requirement?

Usually nothing catastrophic. The carrier may exclude coverage for that specific risk, apply a sub-limit, raise the premium, or add a waiting period before coverage starts. In some cases, they’ll decline to quote at all. Answering “no” honestly is far better than answering “yes” falsely.

Can I get coverage with no MFA?

Smaller policies sometimes allow it with a premium surcharge or a social engineering sub-limit. But it’s getting harder. Most carriers now list MFA as a minimum requirement for any policy above a few hundred thousand dollars.

How much cyber insurance does a small business need?

It depends on your data, your downtime tolerance, and your contracts. A rough starting point for many small businesses is a limit equal to your worst-case year of revenue loss plus breach response costs — often $1 million to $3 million. Work with a broker who understands your industry rather than picking the cheapest quote.

Does having an MSP help with cyber insurance?

Yes, measurably. Carriers often ask whether you use a managed service provider for security. A reputable MSP produces the logs, reports, and documentation that underwriters want. Several insurers have partnered with MSPs specifically to make coverage easier for their clients.

What’s the difference between a “warranty” and a “requirement” on the application?

A warranty is a statement you’re contractually promising is true. Requirements are the conditions the carrier expects. Breaching a warranty can void coverage. Read the policy for the word “warranty” — it’s a signal that whatever follows is something you must be able to prove.

How often do I need to update my answers?

At every renewal, and any time something material changes. If you drop a control mid-term — say you stop paying for EDR — you may be obligated to notify the carrier. Policies differ on this, so ask your broker.

Will the insurer actually verify my answers?

Not usually before issuing a policy. But after a claim, yes. Forensic investigators will look at logs, configurations, and email records. Discrepancies between the application and reality are one of the most common reasons claims get disputed.

Can I self-insure instead?

You can, and some businesses do. The math is simple: if you can absorb a $250,000 loss without shutting down, cyber insurance may be optional. If that number would end your business, it’s not.

The Real Cost of a Denied Claim

Let’s put numbers on this, because abstract warnings don’t land the way specifics do.

Say a 45-person accounting firm gets hit by ransomware in March. Attackers encrypt file servers and the backup NAS because the backup was on the same network with domain credentials that had already been compromised. They exfiltrate client tax records. The ransom demand is $180,000.

Now line up the real costs:

Forensic investigation: $35,000
Legal counsel and notification to affected clients: $60,000
Ransomware payment (if decided): $180,000
Downtime and lost billable hours over three weeks: $220,000
Client churn after public disclosure: unknown, but real
Regulatory fines if state regulators get involved: $25,000+

That’s somewhere north of $500,000 before you factor in reputational damage. If the firm’s cyber policy had a $1 million limit but the carrier denies the claim because the application claimed immutable backups that didn’t exist, the entire loss lands on the owners.

Compare that to the cost of doing it right. MFA enforcement, EDR across 60 endpoints, immutable cloud backups, managed detection and response, and quarterly phishing training might run a 45-person firm somewhere between $2,500 and $6,000 a month, depending on scope. That’s a real number, and it’s not nothing. But it’s a fraction of a single bad week.

And here’s the part that’s easy to miss: the same controls that satisfy the insurer also reduce the chance you ever need to file a claim. Insurance is a transfer of financial risk. Security controls are a reduction of the risk itself. You want both. Relying on one without the other is how businesses end up in litigation with their carrier while simultaneously trying to recover from an attack.

What to Do This Week

If you’ve got a renewal coming up or you’re getting your first cyber policy, here’s a short list to start on.

Pull out your current policy and application. Read the warranties. Highlight every statement you promised was true.
Verify each one. Not “I think so” — verify. Log into the EDR console. Check the backup reports. Look at the conditional access policies.
Document the gaps. Make a list of what you can’t prove and rank it by how much it affects the carrier’s view of your risk.
Fix the top three. MFA, endpoint detection, and immutable backups cover most of the ground on a typical small business application.
Capture evidence as you go. Screenshots, dated reports, policy documents. Future you will thank present you at renewal time.
Get a second opinion before you sign. A managed security provider or an independent consultant can review the application with you and flag anything that’s likely to cause problems later.

None of this is glamorous work. It’s the IT equivalent of getting your oil changed on schedule — unexciting, mildly annoying, and the reason your engine doesn’t seize on the highway.

Where This Leaves You

Cyber insurance requirements for small businesses have shifted from recommendations to conditions, and the shift happened fast. Carriers learned the hard way that writing policies without requiring controls was a losing proposition. Now they ask for MFA, EDR, tested backups, email security, logging, training, and documented response plans. They ask for evidence, and after a claim, they go looking for it whether you offer it or not.

The businesses that handle this well aren’t the ones with the biggest security budgets. They’re the ones that treat the insurance questionnaire as what it is: a checklist of things any well-run IT environment should have anyway. If you can answer those questions honestly and back up the answers, you’re not just insurable. You’re harder to breach in the first place.

If you’re not sure where you stand, that’s a reasonable place to start. IP Services offers cyber risk assessments and compliance-focused managed services that map to what carriers actually ask about — and they’ll tell you honestly where your gaps are before an underwriter does. You can reach their team at 866-226-5974, or dig into their resources on the IT expert blog if you’d rather read first and call later.

Either way, don’t wait for the Friday deadline on that questionnaire. The controls take time to put in place, and the evidence takes time to accumulate. The best moment to start was last year. The second-best moment is this week.

Posted in Cybersecurity, Insurance, Managed Services