Cyber insurance requirements in 2026: what insurers expect before they cover your business

By the CISO Operator team · Published 2026-08-27 · 8 min read

Cyber insurance requirements are the security controls an insurer expects a business to have in place before it will issue or renew a policy at a reasonable premium — and, in practice, before it will pay a claim. Over the past few years those requirements have hardened from a short questionnaire into a real underwriting bar: multi-factor authentication, endpoint detection, tested backups, and payment-verification controls are now table stakes for most carriers.

Why insurers tightened the requirements

Ransomware and business email compromise losses made the mid-2020s brutally unprofitable for cyber underwriters, and the market responded the way insurance markets always do: stricter applications, more verification, higher premiums for weak controls, and — most importantly for you — claims scrutiny after the incident. The application you sign is an attestation. Insurers have rescinded policies and contested claims where the controls a business attested to (most famously multi-factor authentication) turned out not to be fully deployed. Answering an application optimistically is not a shortcut; it is a way to pay premiums for coverage that may not exist when you need it.

The controls most insurers now expect

Exact requirements vary by carrier and revenue band, but small-business applications now consistently probe the same areas. Treat this as the working checklist:

• Multi-factor authentication — on email, remote access (VPN/RDP), and administrator accounts at minimum. This is the single most common knockout question, and "partially deployed" is the answer that causes claim disputes later.
• Endpoint detection and response (EDR) — modern detection on laptops and servers, not just legacy antivirus, increasingly with a named product on the application.
• Backups that would actually survive an attack — separated from the production network (offline or immutable), encrypted, and restore-tested. Underwriters ask about testing cadence, not just existence.
• Payment and funds-transfer controls — out-of-band verification for bank-detail changes and dual approval for wires. These map directly to the social-engineering coverage in the policy; our guide to business email compromise in the AI era covers the underlying attack in depth.
• Email authentication and filtering — SPF, DKIM, and DMARC configured for your domain, plus a phishing-filtering capability.
• Patching and end-of-life discipline — a defined cadence for critical updates and no unsupported operating systems on the network without documented compensating controls.
• Access management — least privilege for admin rights, prompt offboarding, and unique accounts rather than shared logins.
• An incident response plan — written, with named owners and the insurer's breach hotline built into the first steps, plus security awareness training on a regular cycle.

What does cyber insurance actually cover?

Coverage is usually split into two halves. First-party coverage pays your own costs after an incident: incident response and forensics, data restoration, business interruption, extortion payments where lawful and approved, and customer notification with credit monitoring. Third-party coverage pays for liability to others — claims and defense costs when customer or partner data is exposed, and regulatory proceedings where insurable.

The fine print matters more than the headline limit. Three clauses deserve specific attention in any small-business policy review:

• Social-engineering and funds-transfer sub-limits. Money lost to fraudulent-instruction attacks is often capped far below the policy limit — sometimes at a small fraction of it — or excluded without a specific endorsement.
• Conditions of coverage. Some policies condition payment on the controls you attested to remaining in place throughout the policy period, not just on the application date.
• Exclusions. Prior known incidents, acts-of-war language, and unsupported-software exclusions have all been used to contest real claims.

The U.S. Federal Trade Commission publishes a plain-language cyber insurance guide for small businesses that is a useful baseline for reading a quote critically.

How to prepare for an application or renewal in 90 days

• Weeks 1–2: establish ground truth. Inventory where MFA is and is not enforced, what your backup separation and last successful restore test actually look like, and which systems are past end of support. A structured cybersecurity risk assessment produces exactly this evidence base, with the gaps ranked by material risk rather than by questionnaire order.
• Weeks 3–10: close the knockout gaps. Prioritize the controls that both reduce real risk and unblock underwriting — MFA completion, EDR deployment, backup separation, and payment-verification rules typically top the list.
• Weeks 11–13: build the evidence file. Screenshots, configurations, policy documents, and test records tied to each application answer. Answer the application from evidence, not memory — the file also becomes your renewal package next year.

Who should own the application?

The application is a legal attestation about technical controls — which is why the wrong owner is either the broker alone (who cannot verify your controls) or an IT provider alone (who should not sign for business risk). The durable answer is a security leader accountable to management who can verify what is deployed, close the gaps, and stand behind the answers. For businesses that do not need that role full-time, this is squarely the kind of decision a fractional CISO owns: making the attestation true before making it.

One framing note: none of this is insurance-buying advice, and coverage decisions belong with your broker and counsel. The security side, though, is unambiguous — every control insurers now require is a control worth having even if you never file a claim. The application is simply the deadline that gets it funded.