What Cyber Insurance Actually Requires From Your IT

Cyber insurance is coverage against the financial cost of a cyber incident — ransomware, data breaches, business email compromise and the legal and recovery expenses that follow. What has changed in recent years is that insurers no longer simply ask whether you want cover. They ask what security controls you have in place, and they check.

If your renewal is coming up, the questionnaire is where most businesses get caught out. Here is what insurers now expect, and what happens when the answers do not match reality.

Why the requirements tightened

Ransomware claims became expensive enough that insurers changed how they underwrite. Cover that was once issued on a short form now depends on demonstrable technical controls. Premiums rose, deductibles rose, and — most importantly for business owners — insurers became willing to decline claims where the declared controls were not actually in place.

What insurers ask for

Multi-factor authentication, everywhere

This is the first question on almost every questionnaire, and partial answers cause problems. Insurers expect MFA enforced across all user accounts — email, remote access and administrative accounts. Remote access without MFA is treated as a specific red flag during underwriting.

“We have it available but not everyone uses it” is not a yes. Enforcement means it cannot be skipped.

Endpoint detection and response, with someone watching

Traditional antivirus no longer satisfies most insurers. They expect endpoint detection and response (EDR), and increasingly they want evidence that alerts are actually monitored rather than simply logged.

The distinction matters: installing the tool is not the same as having someone review what it reports. Managed endpoint protection with continuous monitoring is what the question is really asking about.

Backups that are tested and isolated

Insurers ask three things about backups: are they isolated from your main network, are they tested, and do you know how long recovery would take. Backups reachable from the same network that ransomware encrypts are of limited value, because ransomware targets them deliberately.

A backup that has never been restored is an assumption. Tested cloud backup with documented recovery times is what turns a “yes” on the form into a defensible answer.

A written incident response plan

Insurers want a documented plan with named roles — who decides, who contacts the insurer, who speaks to clients, who handles technical recovery. Some also ask whether the plan has been tested with a tabletop exercise.

This is the requirement small businesses most often lack, and it is the cheapest one to fix. It costs a document and an afternoon.

Security awareness training

Most incidents still begin with someone clicking something. Insurers increasingly ask whether staff receive regular training and whether phishing simulations are run.

Patching and logging

Expect questions about how quickly security updates are applied, and whether you retain logs across systems. Centralised logging matters because after an incident, the first question is what happened and when — and without logs there is no answer.

The part that catches businesses out

The application is a legal document. If you state that MFA is enforced everywhere and a breach later occurs through an account without it, the insurer may decline the claim or void the policy on the basis of misrepresentation.

This is the real risk, and it is worse than not having cover at all — because you paid premiums believing you were protected. Answering the questionnaire accurately matters more than answering it favourably.

If you are unsure whether a control is genuinely in place across your whole environment, find out before you sign rather than after.

A practical checklist before renewal

• MFA enforced on all accounts, including remote access and admin accounts
• EDR deployed on every endpoint, with alerts actively monitored
• Backups isolated from the main network, tested, with documented recovery times
• Written incident response plan with named roles
• Security awareness training running on a regular schedule
• Documented patching process with defined timelines
• Centralised logging with a stated retention period
• Network security controls: firewall management, segmentation, least-privilege access

Work through it honestly. Every “no” is either something to fix before renewal or something to declare accurately on the form.

What this means for BC businesses

For smaller businesses in British Columbia, these requirements are not unreasonable — they are broadly the controls you would want regardless of insurance. Businesses handling personal information already carry obligations under BC PIPA and PIPEDA, and the overlap with insurer expectations is substantial.

The practical effect is that the insurance questionnaire has become a useful audit. If you cannot answer it confidently, that gap exists whether or not you buy the policy.

Getting the answers straight

Most businesses do not know with certainty whether MFA is enforced on every account, or when a backup was last restored. Those are answerable questions, and answering them is the work.

Insmart Technology helps businesses across Surrey and the Lower Mainland put these controls in place and document them properly, including IT compliance services and managed cybersecurity. If your renewal is approaching, a free IT and security assessment will show you exactly which questions you can currently answer yes to — and which you cannot.

This article is general information about common insurer requirements, not insurance advice. Your policy terms and your insurer’s specific requirements take precedence — read your own questionnaire carefully and speak to your broker.

About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.