Cyber Insurance Requirements: MFA, EDR, and Tested Backups

A renewal questionnaire usually asks whether multi-factor authentication is on for email, remote access, and admin accounts, whether endpoints are monitored with detection and response tools, and whether backups are kept where an attack cannot change them and have been restored in a test.

The stakes keep rising. U.S. cyber losses reached nearly $21 billion in 2025, up from about $16 billion in 2024, and more than 1 million incidents were reported. Cyber insurance underwriting has tightened in response, and application answers now carry legal weight if you file a claim.

Cyber insurance requirements are easier to meet when you collect proof before the renewal form arrives. With that proof in hand, you can answer each question accurately, flag gaps early, and avoid surprises at claim time.

Key Takeaways

• MFA, EDR with monitoring, and tested backups are the controls questionnaires usually ask about. Carriers do not all treat them the same way.
• Every “yes” on an application should be backed by a screenshot, report, or log.
• Policy terms such as notice deadlines and ransomware sublimits shape what a claim pays.

Which Three Security Controls Do Underwriters Verify First?

Underwriters focus on identity, endpoints, and recovery because those controls help determine whether a ransomware attack becomes a short outage or a total loss. Each one needs full coverage, clear ownership, and a record showing it works.

MFA Across Email, VPN, and Administrator Accounts

Multi-factor authentication (MFA) asks for a second proof of identity after the password, such as an app prompt or a hardware key. Insurers care because stolen logins are a common way in. Sophos reports in its State of Ransomware Report 2026 that 79% of ransomware attacks originate from compromised identities.

Underwriters tend to ask about three areas in particular:

• Email: Every mailbox, including shared and former-employee accounts that still sign in.
• Remote access: VPN, remote desktop gateways, and any cloud app reachable from the internet.
• Admin accounts: Domain admins, Microsoft 365 global admins, backup consoles, and firewall logins.

Some carriers send a separate form for this. Travelers, for example, lists a Multi-Factor Authentication Supplement alongside its main CyberRisk application. Check old service accounts and vendor logins, not only the main staff mailbox.

EDR With Active Monitoring and MDR Response

Endpoint detection and response (EDR) records what happens on each laptop and server, flagging suspicious behavior such as a tool suddenly encrypting files. Underwriters want EDR on every endpoint and server, with someone watching the alerts.

That second part is where managed detection and response (MDR) comes in. MDR adds a security team that investigates and contains threats around the clock. Blackpoint describes its MDR as 24/7 human-led Security Operations Center coverage, with analysts who identify, investigate, and contain threats.

Expect questions like these:

1. What percentage of endpoints run EDR?
2. Is EDR on servers as well as workstations?
3. Who reviews alerts after hours and on weekends?
4. Can the team isolate a device without waiting for your approval?

An EDR tool with nobody reading the alerts comes across as a weak answer on most applications.

Installed antivirus is a different question. See why next-generation antivirus is not the whole monitoring question, and whether Microsoft Defender is enough on its own.

Offline or Immutable Backups With Tested Restores

Backups determine whether you can recover without paying a ransom. Many ransomware variants go after backups they can reach, so insurers ask whether at least one copy is offline or immutable. Immutable means the backup can’t be changed or deleted for a set period, even by an admin.

Restore testing matters just as much. CISA’s #StopRansomware Guide advises keeping offline, encrypted backups and testing them regularly, because many ransomware variants try to find and delete or encrypt backups they can reach.

Keep a simple restore log that shows:

• The date of each test
• What was restored (a file, a server, a full system)
• How long it took
• Who ran it and whether it worked

What Supporting Safeguards May Insurers Require?

Beyond the core three, carriers ask about controls that reduce fraud, human error, and the spread of an attack. These answers often affect terms, sublimits, and exclusions more than eligibility.

Email Filtering, DMARC, and Payment Verification

Business email compromise (BEC) tricks staff into paying fake invoices or changing bank details. Insurers ask about advanced email filtering and DMARC, a DNS record that tells mail servers to reject messages that fake your domain.

They also ask about payment controls. A strong answer includes a written rule: any change to payment details gets confirmed by phone, using a number already on file. Some carriers attach a separate social engineering fraud supplement to dig into these steps.

Security Awareness Training and Phishing Simulations

Training records show the carrier that staff can spot phishing. Most applications ask how often training happens and whether you run simulated phishing tests.

Keep completion reports by employee, along with simulation click rates over time. A falling click rate is useful evidence. We cover how these records support claims in our guide to security awareness training for cyber insurance claims.

Privileged Access, Patching, and Network Segmentation

Privileged access management (PAM) limits who holds admin rights and for how long. Underwriters want separate admin accounts, no daily work done as admin, and a short list of people with full access.

Patch management matters because exploited software vulnerabilities drove 32% of attacks in the 2024 FBI IC3 figures summarized on NAIC’s ransomware page. Expect questions about how quickly critical patches get applied.

Network segmentation keeps an infection on one device from reaching servers and backups. A flat network where every device can reach every other one is a concern.

Vulnerability Scanning and Risk-Based Penetration Testing

Regular vulnerability scanning finds missing patches and exposed services before attackers do. Many carriers also run their own outside scans of your public IP addresses and domains, then ask what you’re doing about the results.

Penetration testing goes further, with a tester trying to break in. For most small businesses, an annual test of internet-facing systems fits the risk. Larger firms or those holding sensitive data may need internal testing too.

An Incident Response Plan Tested Through Tabletop Exercises

An incident response plan lays out who does what when an attack hits. It should name your IT provider, legal counsel, and the insurer’s breach hotline.

A tabletop exercise walks leaders through a mock attack in about two hours. Keep the agenda, attendee list, and lessons learned. These records show the plan works on paper and in practice.

What Evidence Should You Prepare for an Application or Renewal?

Collect proof for every control before you fill out the form. A clean evidence file makes the cyber insurance application faster and protects you if a claim gets reviewed later.

Build a Control-by-Control Evidence Checklist

A simple cyber insurance requirements checklist pairs each question with its proof:

Date every item. Stale evidence weakens an answer.

Document Coverage Gaps, Exceptions, and Remediation

Few businesses hit 100% on every control. An old machine running lab software or a shared login on a vendor portal is pretty common.

List each exception with the reason, the risk-reducing step in place, and a target fix date. Carriers tend to respond better to a documented gap with a plan than to a “yes” that later proves false.

Validate Application Answers With Your IT Provider and Broker

Cyber insurance application requirements use technical wording that’s easy to misread. “MFA for all remote access” may include tools you don’t think of as remote access.

Walk through every question with your IT provider before signing. Then review it with your cyber insurance broker, who knows how a given carrier reads its own questions. The person signing should see the evidence behind each answer.

How Do Legal, Contractual, and Industry Obligations Differ?

Insurer requirements decide coverage, while laws and contracts set separate duties you must meet whether or not you carry a policy. One set doesn’t satisfy the other.

When Client Contracts and Vendor Agreements Require Coverage

Many client contracts require a minimum amount of cyber liability insurance, often naming the client as an additional insured. Larger customers commonly request a certificate of insurance before signing.

Read vendor agreements too. Some shift breach costs onto you, which raises the third-party limit you need. Share these contracts with your broker so the limits match what you’ve promised.

HIPAA Obligations for Protected Health Information

HIPAA compliance applies to covered entities and their business associates. The Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, scaled to your size and risk.

Breach notification has hard deadlines. HHS requires notice to affected individuals no later than 60 days after finding of a breach of unsecured PHI, as of November 10, 2026, plus media notice when more than 500 residents of a state are affected. HHS also published a proposed rule on January 6, 2025 to strengthen Security Rule cybersecurity requirements. Healthcare carriers often add a supplement asking about these duties.

PCI-DSS Obligations for Payment Card Data

PCI-DSS applies to anyone who stores, processes, or transmits payment card data. The standard sets a baseline of technical and operational requirements for protecting cardholder data.

PCI-DSS compliance is enforced through card brands and your payment processor. Insurers ask whether you’re compliant and whether card data touches your network at all. Using a hosted payment page reduces both risk and paperwork.

Why SOC 2 Does Not Replace Underwriting Review

A SOC 2 report is an independent CPA examination of controls over security, availability, processing integrity, confidentiality, or privacy. It helps customers trust a service provider.

Underwriters still ask their own questions. A SOC 2 scope may exclude systems an insurer cares about, and the report covers a past period. Use the report as supporting evidence, but answer each application question directly.

What Policy Terms and Costs Should You Review?

Policy wording decides what a claim pays, so read the terms as closely as the premium. Small details in a cyber insurance policy can change outcomes after a data breach.

First-Party Recovery Costs vs. Third-Party Liability

First-party coverage pays your own costs. The FTC lists items such as forensic services, customer notification, and lost income from business interruption among typical first-party costs.

Third-party liability covers claims others bring against you, such as lawsuits from affected customers and regulatory inquiries. Most small businesses need both. Check whether regulatory fines are covered where state law allows.

Ransomware Coverage, Fraud Sublimits, and Exclusions

Ransomware coverage may carry a lower sublimit than the main policy limit. Funds transfer fraud and social engineering often have separate, smaller sublimits too.

Common exclusions to look for:

• Losses from unpatched systems past a stated window
• War or state-sponsored attack wording
• Prior known incidents
• Failure to maintain controls listed on the application

Limits, Deductibles, and Factors That Affect Premiums

Cyber insurance costs depend on revenue, industry, data volume, claims history, and control maturity.

Size limits to your realistic worst case, including downtime, notification, and contract duties. A higher deductible lowers the premium but raises your cash need during an incident.

Notice Deadlines, Consent Requirements, and Control Conditions

Late notice is a common reason claims shrink or fail. Insurers typically require notification before paying a ransom, and skipping that step can lead to denial.

Check whether you must use the carrier’s approved breach coach and forensic firms. Look for conditions that require you to keep MFA and backups in place for the full policy term. Put the breach hotline number in your incident response plan.

How Can Jacksonville Businesses Prepare With NetTech?

NetTech Consultants has served Northeast Florida and Southeast Georgia from Jacksonville since 1995. The team is in Jacksonville, not a national call center, and its security work touches the controls insurers ask about. Exact services depend on the plan you choose, so confirm the scope in writing before renewal. NetTech doesn’t promise policy approval or lower premiums; its role is to help you build and document controls.

Assess MFA Enforcement and Sophos Endpoint Protection

NetTech deploys MFA, including Microsoft 365 MFA. Before renewal, check for any accounts still without enforcement, including service logins and former staff mailboxes.

For endpoints, NetTech uses Sophos endpoint protection and Blackpoint MDR, with a local security operations center and 24/7 monitoring. Ask for the device list and the MDR service description, and compare them with your asset list before you answer the form.

Verify Blackpoint MDR Monitoring and Backup Recovery Evidence

Put the MDR service description in your evidence file next to your answer on who reviews alerts after hours.

For managed backup and disaster recovery clients, ask NetTech for the backup settings in writing, and request a restore test before renewal. Keep the dated results with your application.

Confirm Training Records, Service Scope, and Remediation Ownership

NetTech runs annual security awareness training and monthly phishing simulations, along with email filtering on Microsoft 365. Pull completion reports and click-rate trends for your file.

Then confirm who owns each open gap. Get a short written list of what NetTech manages, what your team manages, and the dates for any fixes before you answer the application.

If your renewal is coming up, request a free IT risk assessment through NetTech’s Jacksonville cybersecurity page or call (904) 992-6970. The office is at 13400 Sutton Park Dr. S, Suite 901, Jacksonville, FL 32224.

Frequently Asked Questions