Cyber Insurance Readiness: What Insurers Now Require from Your IT

Ransomware losses forced insurers to become de facto security auditors. Underwriters now ask detailed questions about your controls, and the answers directly affect whether you get coverage, what it costs, and whether a future claim gets paid. A questionnaire answered optimistically but inaccurately can void coverage, so the state of your IT is now a direct financial issue.

While every insurer's application differs, the same core controls appear again and again: multi-factor authentication on email, remote access, and admin accounts (this one is nearly universal and often disqualifying if missing), endpoint detection and response on all devices, tested offline or immutable backups, patch management with defined timelines, security awareness training for staff, an incident response plan, and restricted administrative privileges. Increasingly, insurers also ask about 24/7 monitoring or managed detection and response.

In practice, the requirements that trip up small and mid-sized businesses are MFA coverage (it is enabled for some accounts but not all), backups that exist but have never been test-restored or are reachable from the production network, and the absence of any real detection capability. These are all solvable, but not the week your renewal is due.

• Get a copy of your insurer's application or renewal questionnaire early.
• Audit your actual state against every question: honestly; our guide to what an IT security assessment includes covers the areas to check.
• Close the gaps: MFA everywhere, EDR on every endpoint, backups tested and isolated, patching on a schedule, admin rights restricted.
• Document everything: insurers and, later, claims adjusters want evidence.
• Re-answer the questionnaire based on verified fact, not intention.

If a control is not fully in place, do not claim it is. Work with your broker on accurate wording, and prioritize closing the gap instead. An accurate application with a slightly higher premium beats a cheaper policy that fails at claim time.

Cyber insurance readiness is the IT side of buying or renewing a policy. It is not the policy itself, which comes from your broker and insurer, and it is not a promise of approval or a lower premium: underwriters make those decisions. Readiness means you know which controls the application asks about, you have them in place across every account and device, and you can show evidence if an underwriter or a claims adjuster asks. A business is ready when the questionnaire can be answered from records rather than memory.

Use this as a working list before the application arrives.

• MFA on every email account, remote access tool, admin account and backup console, with no exceptions left for executives or shared mailboxes.
• Endpoint detection and response on every laptop, desktop and server, with someone watching the alerts, ideally around the clock.
• Backups with at least one offline or immutable copy, separate credentials, and a recent restore test with the date written down.
• Patching on a defined schedule, plus a list of any end-of-life systems and the plan to retire them.
• Email security, including SPF, DKIM and DMARC on your domain; our email spoofing check shows where you stand.
• Security awareness training and phishing tests, with completion records.
• Separate admin accounts, with administrative rights removed from day-to-day users.
• A written incident response plan that includes your insurer's claims or breach line.
• An up-to-date inventory of devices and cloud services. Our cyber insurance readiness score gives a quick first read on these areas.

Readiness is about controls; coverage is about what the policy pays for, and that is a conversation for your broker, not your IT provider. Questions worth bringing: Does the policy cover business interruption, and is there a waiting period before it applies? Does it cover data restoration and the cost of rebuilding systems? How are ransomware and extortion payments treated, and are there sublimits? Is social engineering or funds transfer fraud covered, and up to what amount? Are privacy breach notification and legal costs included? Does the insurer require you to use its own incident response vendors? Which exclusions apply, for example for systems left unpatched? Bring your control evidence to the same meeting so the answers on the application match reality.

Insurers and adjusters ask for evidence, not intentions. Keep a short folder updated each quarter: a Microsoft 365 report showing MFA status for every user (our Microsoft 365 security check is a starting point), an EDR console export showing device coverage, backup job reports and dated restore test notes, a patch compliance report, training completion records, and the current incident response plan with its date. If you are starting from nothing, a security assessment produces most of this baseline in one pass. Keeping the controls running between renewals is ongoing work, which we handle through managed security services or a fixed-fee managed IT plan; businesses in Vaughan can also see our Vaughan cybersecurity page.

A managed IT provider implements and operates the controls insurers require, MFA rollout, endpoint detection and response, monitored backups, patching, and 24/7 detection, and provides the documentation that supports your application. Many businesses find the premium savings and the avoided risk pay for a meaningful part of the service.

Financial advisors, dealers, insurance agencies and mortgage brokerages often get these questions from carriers and dealers as well as their insurer. Our IT support checklist for financial services firms maps the same controls to record retention, wire-fraud prevention and incident reporting.

Charities and nonprofits face the same questionnaires, often with volunteers and board members in the picture as well as staff. Our IT and cybersecurity checklist for nonprofits and charities covers volunteer accounts, donor data and the board report that doubles as insurance evidence.

IT Rapid Support helps businesses across Toronto and the GTA implement the security controls cyber insurers require and document them properly. Call (289) 582-9930 before your next application or renewal.