Cyber insurance requirements in 2026 boil down to a short list of controls insurers want proof of. Multi-factor authentication (MFA) on the accounts that matter. Endpoint detection and response (EDR) on nearly every device. Backups an attacker can’t reach, timely patching, staff training and a written incident response plan. Miss one and you may pay more, get a lower limit or get turned down.
And “we have that” isn’t enough anymore. Insurers want evidence.
That matters even if you already carry a policy. The controls that get you approved are the same ones that keep a claim from falling apart after a breach.
Not sure where your gaps are?Request a free technology assessment from our Houston team before your next renewal.
Free Technology AssessmentWhy Do Insurers Keep Raising the Bar?
Because the losses keep coming. The 2026 Verizon Data Breach Investigations Report found ransomware in 48% of breaches, up from 44% a year earlier. Third parties were involved in nearly half of all breaches. That’s a 60% jump in one year.
The same report found that vulnerability exploitation overtook stolen credentials as the most common way attackers get in, the first time credentials lost the top spot in the report’s 19-year history. Patching is slipping, too. Organizations took a median of 43 days to fully patch known exploited vulnerabilities, up from 32.
Underwriters read those numbers and see the same handful of weak spots. So that’s exactly what the application asks about now. Good cybersecurity habits used to earn you a discount. Now they get you in the door.
From “Do You Have It?” to “Prove It”
The list of controls hasn’t changed much. How insurers check it has.
A 2026 guide from Cyber Advisors splits controls into two kinds. Documented ones live in a written policy. Implemented ones are actually deployed and working, and underwriters increasingly want to see those. Dated reports. Screenshots. If your application says MFA is on everywhere, expect to show a coverage report that backs it up.
The Core Cyber Insurance Requirements Checklist
Most carriers ask about the same seven areas. The wording shifts from one application to the next (some ask in yes/no boxes, some want a paragraph), but the substance doesn’t.
1Multi-Factor Authentication Everywhere It Counts
This is the one insurers press hardest. Expect questions about email, remote access, cloud admin consoles, privileged accounts and your backup system.
“Most users” usually won’t cut it. If an old login can’t support MFA, you’ll need a documented workaround and a date to retire it.
2Endpoint Detection and Response
Plain antivirus doesn’t satisfy most carriers now. They want EDR on workstations and servers, plus someone actually watching the alerts. Plenty of applications ask whether you’ve got 24/7 monitoring, in-house or through a provider.
How close to “every device”? Very. One 2026 underwriting guide notes that EDR coverage below roughly 95% often triggers conditions or sublimits.
3Backups Attackers Can’t Reach
Ransomware crews go after backups first. Insurers know it.
So they’ll ask if your backups sit offsite, if they’re immutable or offline, and if they use credentials separate from your main network. They’ll also ask when you last tested a restore. We set up cloud backup services with scheduled restore tests for exactly this reason.
4Patch Management
How fast do you apply critical patches? Do you still run anything unsupported? Those are the two questions. A written patch schedule, plus reports showing you stick to it, carries real weight. One old server running Windows Server 2012 can sink an otherwise clean application.
5Email Security and Training
Phishing is still a favorite way in. Carriers look for advanced email filtering and email authentication (SPF, DKIM and DMARC, the records that prove your mail is really yours).
They’ll also ask about staff training and phishing simulations. Our guide on how to deploy cybersecurity awareness training walks through a program that holds up to underwriter questions.
6Privileged Access Controls
Admin rights are a big target. Insurers want separate admin accounts, least-privilege access, and regular reviews that clear out stale accounts. Vendor access gets a hard look as well. Makes sense, given how many breaches now start with a third party.
7A Written Incident Response Plan
Insurers don’t want you improvising mid-attack. They’ll look for a written plan with named roles, a tabletop exercise in the past year, and logging good enough to support an investigation.
Many also want you to know who your breach counsel and forensics firm will be. Before you need them, not after.
How Insurers Check Your Answers
The application is only step one. Expect follow-up questions, and expect to back up what you said.
| What you claim | Evidence underwriters commonly ask for |
|---|---|
| MFA is enforced | An MFA coverage report from your identity platform |
| EDR is deployed | A device coverage report from your EDR console |
| Backups are protected | Backup configuration details and dated restore-test records |
| Patching is current | A patch compliance report |
| You’re ready for an incident | Your IR plan and notes from your last tabletop exercise |
What Happens If You Fall Short?
Not always a flat no. More often, the terms change.
✓Conditional Quote
Coverage, but only if you close specific gaps by a set date.
↓Sublimit
The policy pays less for certain events. Ransomware is the usual one.
$Higher Premiums or Deductibles
Weak controls cost more to insure.
✕Decline
Big gaps, like no MFA on email or remote access, can end the conversation.
When Your Answers Don’t Match Reality
The expensive problem tends to show up after a breach. Say your application listed a control, and the forensic investigation shows it wasn’t there. Your insurer may push back on the claim.
Short version? Keep every control you attested to running all year, not just the month before renewal. We cover how this plays out in cyber insurance claim challenges and best practices for avoiding them.
How to Get Ready Before Your Next Renewal
Start about 90 days out. That leaves time to fix what turns up instead of scrambling.
- Pull last year’s application. Re-read every answer and check it’s still true.
- Get a risk assessment. A cybersecurity assessment maps your real controls against what carriers ask about.
- Close the high-impact gaps first. MFA, EDR, and backup protection usually matter most.
- Gather your evidence. Coverage reports, patch reports, restore-test records, all dated.
- Check for exposed passwords. A dark web scan shows whether employee logins are already floating around.
- Update your incident response plan. Run a tabletop exercise if it’s been more than a year.
Where an IT Partner Fits
Buying cyber insurance for small business owners usually isn’t the hard part. Keeping the controls behind the policy running is. Most small and mid-sized businesses don’t have a security team to babysit this list, and that’s where managed IT services come in. A provider deploys and watches the tools, pulls the reports underwriters want, and keeps everything running between renewals.
Function4 has worked with Houston businesses since 2012. Our cybersecurity services cover assessments, endpoint protection, monitoring, and dark web scanning. We also launched a cybersecurity insurance program with TechRug to help local businesses pair strong controls with coverage.
Frequently Asked Questions
What does cyber insurance cover?
It splits into two buckets. First-party coverage pays your own costs after an incident: forensic investigation, data restoration, business interruption, breach notification, and, on some policies, ransom payments. Third-party coverage handles claims against you, like lawsuits and regulatory penalties tied to the breach. Every policy draws those lines a little differently, though. Read the exclusions and sublimits closely before you sign, especially the sections on ransomware and social engineering fraud (the fake-invoice scams that trick staff into wiring money).
How much does cyber insurance cost for a small business?
Depends on a lot. Your industry, revenue, and the data you hold all play in, and so do your security controls (more every year). Two businesses the same size can get very different quotes. Strong MFA, EDR, and backups usually bring premiums down. A broker can give you real numbers.
Does cyber insurance cover ransomware?
Usually, with a catch. Many policies cap ransomware payouts with a sublimit, and some add coinsurance so you share part of the loss. Even getting offered ransomware coverage can come down to your backup protection and EDR.
Is cyber insurance required by law?
No U.S. federal law requires most businesses to carry it. Your clients might, though. Contracts and vendor agreements increasingly demand proof of coverage, and some larger companies won’t sign with a supplier that can’t show it.
Do I still need cyber insurance if I have good security?
Yes. Good security lowers your odds of a breach but can’t get them to zero. Insurance picks up what controls can’t stop, like legal fees, notification costs, and lost income while you’re down. The two work together. Solid security keeps premiums reasonable, and the policy covers what slips through anyway.
What’s on a cyber insurance questionnaire?
Expect questions about MFA, EDR, backups, patching, email security, training, privileged access, vendor access, and incident response. Many also ask about past incidents and what kinds of sensitive data you store. Keep records that support each answer. Insurers can and do ask for proof.
Is MFA required for cyber insurance?
For nearly every carrier, yes. Email, remote access, cloud admin, and privileged accounts are the usual minimum, and gaps there are a common reason for a decline.
Why do cyber insurance claims get denied?
A few usual suspects. A control listed on the application that wasn’t actually in place. A loss that falls under an exclusion. Late notice to the insurer. Policies are also typically claims-made, so a lapse in coverage can leave an incident uninsured. Keeping your attested controls running year-round is the best protection we know of.
What is a cyber risk assessment?
Think of it as a checkup before the application. We go through your systems, devices, accounts, and policies, find the weak spots, and rank them by risk. You see where you stand against underwriter requirements and get a fix list in priority order, so the money goes where it counts.
How long does it take to meet cyber insurance requirements?
Longer than most people expect. If MFA and EDR are already in place, gathering evidence might take a few weeks. Starting from scratch, plan on two to three months to deploy tools and test backups. That’s why we suggest starting 90 days before renewal.
Ready for Your Next Renewal?
Cyber insurance requirements aren’t going to loosen up. If you aren’t sure how your controls stack up, start with a free assessment, and we’ll show you where the gaps are.
Get your free technology assessment.Prefer to talk first? Call (346) 270-2334.
