Cyber Insurance Requirements for Small Business (2026)

Cyber insurers now expect a small business to have a specific set of security controls in place before they’ll write a policy. The short list: multi-factor login, endpoint detection and response (EDR), backups that are separate from your network and tested, regular patching, email filtering, and staff security training. Many applications also ask about admin rights, an incident response plan and how you verify payment changes.

A few years ago, cyber coverage was a one-page form. Now it’s a security questionnaire, and the answers decide whether you get a quote, what it costs, and whether a claim gets paid.

We’re not an insurance broker, and your carrier’s application is the final word. But we fill out the technical side of these forms with clients all the time. Here’s what the questions are really asking, and what it takes to answer yes.

The Cyber Insurance Checklist

Control	What insurers want to hear	Common gap
Multi-factor login	On email, remote access, admin accounts and backups	Turned on for some users, or not for admin accounts
Endpoint detection and response	EDR on every computer and server, with alerts watched	Basic antivirus only
Backups	Separate from the network, can’t be altered, tested	Backups on a drive connected to the server
Patching	Updates applied on a schedule, no unsupported systems	Old Windows versions still running
Email security	Filtering for phishing and impersonation, SPF/DKIM/DMARC	Only the built-in filter
Security training	Regular training and phishing tests	Never done, or done once
Admin rights	Staff don’t log in as administrators	Everyone is an admin “to make things easier”
Incident response plan	A written plan, with who to call	Nothing written down
Payment verification	Callback procedure for payment changes	Changes made on an email request

Now the details.

Do Cyber Insurers Require Multi-Factor Authentication?

Increasingly, yes. Multi-factor login on email, remote access and admin accounts is the control most likely to stop a quote if it’s missing.

This is the big one. Most applications ask about multi-factor login in several places, and many carriers won’t quote without it.

Expect questions about whether MFA is required for:

Email, including web access and phone apps
Remote access: VPN, remote desktop and any remote-control tools
Administrator accounts: anyone who can change settings or add users
Backup systems: so an attacker can’t log in and delete your backups
Cloud apps that hold sensitive data

The trap is partial coverage. “We have MFA” isn’t the same as “every account has MFA.” That one shared mailbox or the old admin account nobody uses is exactly what attackers look for. CISA’s guidance on MFA is a good plain-language starting point.

Is Antivirus Enough, or Do Insurers Want EDR?

Many applications now ask specifically for endpoint detection and response (EDR), not just antivirus, and some ask whether someone watches the alerts.

Traditional antivirus checks files against a list of known threats. EDR watches what programs actually do and can stop and isolate a computer when it sees ransomware-like behavior, even from something new.

Many applications now ask by name whether you run EDR on every computer and server. Some go further and ask whether someone watches the alerts around the clock. A managed detection service, or an IT provider who monitors alerts, is how most small businesses answer yes.

What Do Insurers Ask About Backups?

They want backups that are kept separate from your network, can’t be altered or deleted, are protected by MFA and have been test-restored.

Backup questions used to be one line. Now they’re often a whole section. Insurers want to know:

What’s backed up: servers, Microsoft 365 or Google Workspace, and important files
Where the backups live: at least one copy should be separate from your network so ransomware can’t reach it
Whether backups can be changed or deleted: “immutable” backups can’t be, for a set period
Whether you’ve tested a restore, and how recently
Who can log in to the backup system, and whether that login has MFA

The most common gap we see is a backup drive plugged into the same server it’s backing up. Ransomware encrypts both. Our backup and disaster recovery guide covers this in more depth.

Patching and Unsupported Systems

Expect questions about how fast you apply security updates and whether you run software that no longer gets updates, such as old versions of Windows.

If you have machines that can’t be updated, like a PC running a piece of manufacturing equipment, say so, and keep those machines on a separate network. That’s a much better answer than pretending they don’t exist.

Email Security

Most breaches and payment frauds at small businesses start with an email. Insurers ask whether you filter incoming mail for phishing and impersonation and whether your domain uses SPF, DKIM and DMARC, the settings that make it harder for someone to send email pretending to be you.

Security Awareness Training

Applications commonly ask whether staff get security training, how often, and whether you run simulated phishing tests. Once a year is the minimum. Short, regular sessions work better. We wrote about how to make cybersecurity training stick.

Admin Rights

If everyone logs in as an administrator, one bad click can install anything. Insurers ask whether everyday accounts have admin rights and how admin accounts are protected. The fix is separate admin accounts with MFA, used only when needed.

Do You Need an Incident Response Plan for Cyber Insurance?

Many applications ask for one, and it can be a single written page: who to call first, how to reach the carrier, how to keep working and who can restore backups.

You don’t need a binder. You need a written page that answers: Who do we call first? Who calls the insurance carrier? (Many policies require you to use their approved responders.) How do we keep working if systems are down? Where are the backups, and who can restore them?

Payment Change Verification

Many policies cover “social engineering” or funds transfer fraud, where someone tricks your staff into wiring money or changing payment details. Coverage often depends on a verification procedure: any request to change payment details is confirmed by phone, using a number you already have on file, not one in the email.

It’s one of the cheapest controls on this list and one of the most valuable. It matters even more for businesses that handle client money, like insurance agencies, title companies and contractors.

What Happens If You Answer the Application Wrong?

If you say a control is in place and it isn’t, the carrier may deny a claim or cancel the policy, so answer accurately and disclose anything that’s only partly done.

This matters more than any single control. If the application says a control is in place and it isn’t, the carrier may deny a claim or cancel the policy. That’s the worst possible outcome: you paid premiums for coverage you didn’t really have.

Some practical advice:

Have your IT provider review the technical questions before you sign
If a control is partly in place, say so, and note when it’ll be finished
Keep proof: screenshots of MFA settings, backup test results, training records
Re-check the answers at every renewal, because your setup changes

How Long Does It Take to Get There?

For a business that already has managed IT with a decent security baseline, usually just a few weeks of tightening: closing MFA gaps, upgrading antivirus to EDR, setting up DMARC, documenting the plan.

For a business starting from scratch, plan on a cleanup project of a month or two. MFA and email security can usually happen in the first week or two. Backups, EDR and admin rights follow. Training and the written plan wrap it up.

If you’re up for renewal soon, start with MFA. It’s the question most likely to stop a quote.

How We Help

MedTech Consulting sets up and documents these controls for businesses across Gwinnett, Barrow and Walton counties: manufacturers, insurance agencies, professional offices, home services companies and medical practices. We’ll go through your application with you, tell you honestly where you stand, and close the gaps that matter most.

Most of these tools and practices are part of our managed IT and cybersecurity services. If you’re wondering what that costs, see our managed IT pricing guide.

Frequently Asked Questions

What do cyber insurance companies require from small businesses?

Most carriers now expect multi-factor login on email, remote access and admin accounts; endpoint detection and response (EDR) on every computer and server; backups that are kept separate from your network and tested; regular patching; email filtering; and staff security training. Many also ask about admin rights, an incident response plan and how you verify payment changes.

Can I get cyber insurance without multi-factor authentication?

It's increasingly hard. Many carriers decline to quote without multi-factor login on email and remote access, and others charge much higher premiums or exclude ransomware. Multi-factor login is the single most important control to have in place before you apply.

What happens if I answer the cyber insurance application wrong?

If you say a control is in place and it isn't, the carrier may deny a claim or rescind the policy. Answer every question accurately, and if a control is only partly in place, say so. It's better to fix the gap or disclose it than to find out after an incident.

Is antivirus enough for cyber insurance?

Usually not anymore. Many applications ask specifically about endpoint detection and response (EDR), which watches for suspicious behavior and can isolate a computer, not just scan for known viruses. Some also ask whether the EDR alerts are monitored by a person.

How much does it cost to meet cyber insurance requirements?

For a small business that already has managed IT, most requirements are covered by tools and practices in a typical plan. For a business starting from scratch, expect a one-time cleanup project plus a monthly cost in the range of managed IT, which typically runs $75 to $150 per user per month.

Cyber Insurance Requirements for Small Businesses: What Insurers Ask For in 2026