Cyber insurance requirements for small businesses

Most cyber insurance carriers now expect a small business to have a short list of security basics in place before they'll write a policy: multi-factor authentication (MFA), endpoint protection that someone actually monitors, and backups you've tested. If any of those are missing, expect a higher premium, a bigger deductible, or a polite "no thanks."

The bigger catch is the application itself. Those yes/no questions about your security aren't a formality. They're promises, and they matter most on the day you file a claim.

Why insurers got so picky

Because the claims got expensive. The FBI's 2025 Internet Crime Report logged more than 1 million complaints and $20.9 billion in reported losses, with business email compromise alone accounting for more than $3 billion. Insurers pay for a slice of that, so they've started asking much harder questions before they take on new risk.

The upside: the controls they ask for are the same ones that stop most real-world attacks. Meeting the requirements isn't just paperwork. It makes you a harder target.

What do cyber insurance applications usually ask for?

Every carrier's form is a little different, but the same themes show up again and again.

Multi-factor authentication everywhere that matters

Expect questions about MFA on email, remote access and any administrator account. "Everywhere that matters" is the key phrase. Turning it on for the owner but not for the shared mailbox or the old admin login doesn't count. If you want the backstory on why MFA is such a big deal, we covered it in the 99.9% fix: why two-step sign-in matters.

Endpoint protection that someone is watching

Basic antivirus isn't the bar anymore. Insurers typically ask about endpoint detection and response (EDR), software that watches computers and servers for suspicious behavior, and whether someone actually responds when it raises an alert. An alarm nobody hears doesn't help much.

Backups that are separate, protected and tested

You'll usually be asked whether backups are kept separate from your main network, whether they're protected from being changed or deleted, and when you last tested a restore. A backup you've never restored from is a hope, not a plan. Our post on disaster recovery for small businesses walks through the questions every owner should be able to answer.

Patching on a schedule

Carriers want to know that security updates get installed promptly on computers, servers and network gear, and that someone is checking. "Windows does that automatically, I think" is not the answer they're hoping for.

Email filtering and security awareness training

Phishing and email fraud are behind a huge share of claims, so expect questions about email filtering and whether your team gets regular training on spotting fake invoices and login pages.

A written incident response plan

Some applications ask whether you have a plan for what happens when something goes wrong: who to call, what to shut down, how to keep the business running. It doesn't need to be a novel. It does need to exist.

The application is a promise. Answer it carefully.

Here's the part that surprises people. In a 2022 federal case, Travelers asked a court to rescind a cyber policy after a ransomware attack at one of its insureds, International Control Services. Travelers alleged the company had said it used MFA, when in reality MFA protected only its firewall, not its server and other systems. The case ended with a judgment rescinding the policy.

The lesson isn't "insurers are out to get you." It's that "mostly" isn't "yes." Before you check a box:

• Know what's actually turned on, on every account and every device, not just most of them.
• Ask whoever manages your IT to confirm each answer in writing.
• Keep proof: MFA reports, backup restore tests, training records and patch history.
• Talk to your broker if a question is unclear. Guessing is how good businesses end up with bad surprises.

How to get ready before renewal

If your renewal is coming up, give yourself a few weeks, not a few days.

1. Pull last year's application and read every security question.
2. Check each answer against reality. Where there's a gap, fix it or answer honestly.
3. Close the big three first: MFA on every account, monitored endpoint protection, and tested, protected backups.
4. Write down your incident plan and who to call.
5. Save the evidence in one place so the next renewal is easy.

This is exactly the kind of work our cybersecurity services and managed IT services cover for businesses across Indianapolis and the surrounding areas, including getting Microsoft 365 and Google Workspace locked down so the email questions are an easy yes.

Common questions

Do small businesses really need cyber insurance?

It's a business decision worth discussing with your insurance broker, especially if you handle customer data, send or receive payments by email, or would struggle to operate for a week without your systems. Insurance helps pay for the cleanup. Good security helps you avoid needing it.

What happens if we don't meet every requirement?

It depends on the carrier. Some will still offer coverage at a higher premium or deductible, some will exclude certain incidents, and some will decline. Either way, answer honestly and fix the gaps you can before renewal.

Can our IT provider help with the application?

Yes, and they should. Whoever manages your systems is the best person to confirm what's really in place and to help you collect the proof insurers ask for.

Renewal coming up? Talk to us before you sign or call (317) 854-8755.

Sources: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report · Lockton, "Travelers v. ICS underscores need to respond carefully to cyber insurance application questions"