A few years ago, buying cyber insurance for a small business could be as simple as filling out a short form and paying the premium. Today the process feels a lot more like an inspection. Insurers want to know how your staff log in, where your backups live, what software protects your laptops, and who would pick up the phone if something went wrong at two in the morning.
If you run a small firm, that shift can be confusing. You may have assumed cyber coverage was something you simply bought, the way you buy general liability. Instead you get a long questionnaire full of acronyms, and a broker who tells you that a few wrong answers could mean a higher premium, a lower limit, or a polite decline.
The good news is that cyber insurance requirements are fairly consistent from one carrier to the next. Once you understand what underwriters are looking for and why, the list stops feeling arbitrary. Most of it lines up with the basic security habits that keep a business running anyway. This guide walks through the controls insurers ask about most often, what each one means in plain language, and how to get ready before your application or renewal lands on your desk.
Why Insurers Started Asking Harder Questions
Cyber insurance is a young product compared with property or auto coverage. In its early days, carriers had little claims history to work from, so they priced policies loosely and asked very little. As ransomware and email fraud became common, claims grew in size and frequency, and insurers learned quickly which businesses were costing them money.
The pattern they found was fairly clear. Many of the costliest incidents started with something preventable: a stolen password with no second login step, a server missing months of updates, or backups sitting on the same network the attackers encrypted. Underwriters responded by turning those lessons into questions. If a control would have stopped a common attack, it ended up on the application.
That history is useful to keep in mind. Every requirement on a cyber insurance form exists because a business somewhere had a bad day without it. Seen that way, the questionnaire is a free checklist built from real losses, and working through it honestly makes your business safer whether or not you ever file a claim.
How the Application Process Usually Works
Most small businesses buy cyber coverage through an insurance broker. The broker sends you an application, sometimes a short one for smaller policies and sometimes a supplemental ransomware questionnaire that goes into much more detail. You answer questions about your industry, revenue, number of employees, the kind of data you hold, and the security controls you have in place.
Some carriers also run an outside scan of your internet presence. They look at your domain, your email settings, and any systems that face the public internet, checking for things like exposed remote desktop ports or outdated software. If the scan turns up something concerning, the underwriter may ask you to fix it before they will bind the policy.
Your answers matter long after the policy is issued. The application usually becomes part of the insurance contract. If you state that every user has multi-factor authentication and an investigation later shows otherwise, the insurer may have grounds to reduce or deny a claim. Treat the form as a promise about how your business actually operates.
Multi-Factor Authentication Comes First
If there is one control that nearly every carrier asks about, it is multi-factor authentication, usually shortened to MFA. MFA means that logging in takes something beyond a password: a code from an app on your phone, a push notification you approve, or a physical security key. A stolen password on its own is no longer enough to get in.
Insurers tend to ask where MFA is turned on, and the details matter. Expect questions about email, remote access tools such as VPNs, cloud applications, administrator accounts, and your backup system. A business that protects email with MFA but leaves its remote access portal on a password alone may still be seen as a weak risk, because attackers look for whichever door is easiest.
For a small team, getting MFA in place across the board is usually less work than people expect. Most major email and cloud platforms include it at no extra cost. The harder part is making sure no account gets skipped, including shared mailboxes, former employees who were never fully removed, and the old admin login someone created years ago.
Backups That Can Survive an Attack
Underwriters care a great deal about backups, because good backups are often the difference between a business recovering in days and a business negotiating with criminals. Simply having a backup is rarely enough to satisfy the application. Insurers want to know whether your backups would still be usable if an attacker had full control of your network.
That usually means at least one copy kept separate from your main systems. You will see terms like offline, offsite, air-gapped, or immutable. Immutable backups cannot be changed or deleted for a set period, even by someone holding administrator credentials. Insurers may also ask whether your backup system has its own separate login protected by MFA, so that a compromised network account cannot reach it.
The other question that catches many businesses is testing. When did you last restore files from backup to prove it works? A backup that has never been tested leaves you hoping it works. Scheduling regular test restores, and writing down when they happened, gives you a confident answer on the form and real peace of mind.
Endpoint Detection and Response on Every Device
Traditional antivirus software works by recognizing known threats. Endpoint detection and response, or EDR, goes further by watching how programs behave on a computer and flagging activity that looks like an attack in progress, such as a process suddenly encrypting large numbers of files. Many insurers now ask specifically for EDR rather than basic antivirus.
Expect questions about coverage as well as the tool itself. Is EDR installed on every laptop, desktop, and server, or only some of them? Who watches the alerts it produces? An EDR tool that raises an alarm at midnight with nobody looking at it offers limited protection, so some applications ask whether alerts are monitored around the clock, either by your own staff or by an outside security provider.
For businesses with a handful of machines, this can feel like a lot. The practical step is to take an inventory of every device that touches company data, including the owner’s home laptop and the reception computer, and confirm each one is protected and reporting in.
Keeping Software Patched and Retiring Old Systems
Attackers love unpatched software because the weaknesses are already public. Once a vendor releases a fix, criminals can study it to learn exactly what to target on systems that have not been updated. Insurers therefore ask how quickly you apply security updates, especially critical ones.
You may be asked whether you have a defined patching process, how long it typically takes to apply critical updates, and whether that process covers servers, workstations, network equipment, and third-party applications as well as the operating system. A business that relies on each employee clicking update when they remember will struggle to answer these questions well.
End-of-life systems are a related concern. When a vendor stops supporting a product, it stops receiving security fixes entirely. That old server running specialized accounting software, or the computer attached to a piece of equipment that nobody wants to touch, can become a red flag on an application. If you cannot retire it yet, insurers will want to hear how it is isolated from the rest of your network.
Email Filtering and Phishing Training for Staff
Email remains one of the most common ways attackers get in. A convincing message leads someone to enter their password on a fake login page or open an attachment that installs malware. Insurers ask about the technical defenses that screen incoming mail and about the human side of the problem.
On the technical side, expect questions about email filtering and about domain settings known as SPF, DKIM, and DMARC. These records help receiving mail servers confirm that a message claiming to come from your domain really did. They make it harder for criminals to impersonate your business to your own clients and vendors, which is a common setup for invoice fraud.
On the human side, many applications ask whether employees receive security awareness training and whether you run simulated phishing tests. Training does not need to be elaborate. Short, regular sessions that show staff what a suspicious message looks like, and a clear way to report one without embarrassment, go a long way. Insurers also tend to ask whether you verify payment changes by phone before sending money, since wire fraud claims are a costly category.
Limiting Admin Access
Administrator accounts can install software, change security settings, and reach nearly everything on a network. If an attacker gains one, the damage can spread quickly. Underwriters want to know who holds these accounts and how they are protected.
A common question is whether staff use separate accounts for everyday work and administrative tasks. Browsing the web and reading email from an account with full admin rights makes it much easier for a single bad click to become a company-wide problem. Keeping admin rights limited to the people who truly need them, and using those accounts only for admin work, reduces that risk.
You may also see questions about privileged access management tools, how often admin accounts are reviewed, and whether old accounts are removed promptly when someone leaves. A simple habit of reviewing user lists every quarter and disabling anything unfamiliar can tidy up years of accumulated access.
A Written Incident Response Plan
When something goes wrong, the first hours matter. Insurers want evidence that your business has thought ahead about what happens during an incident: who gets called, who makes decisions, how you communicate with staff and clients, and how you preserve evidence for investigators.
An incident response plan does not need to be a thick binder. For a small business, a few clear pages can be enough. It should name the people responsible, list key contacts such as your IT provider, your insurance broker, and the carrier’s breach hotline, and outline steps for common scenarios like ransomware or a compromised email account.
Many cyber policies require you to use the insurer’s approved vendors for legal advice and forensic investigation, and to notify the carrier quickly. Building those instructions into your plan ahead of time avoids a scramble later, and it helps you avoid accidentally doing something during a crisis that could affect your coverage.
Encryption, Logging and Other Details Underwriters Notice
Beyond the major controls, applications often include a set of smaller questions that add up to a picture of your overall security habits. Encryption is one. Insurers may ask whether laptops have full disk encryption, so that a lost or stolen device does not expose client data, and whether sensitive information is encrypted when it travels across the internet.
Logging is another. Logs record who logged in, from where, and what they did. They are often essential during an investigation, and insurers may ask how long you keep them and whether anyone reviews them. Network segmentation, which keeps different parts of your environment separated so an intruder cannot move freely, shows up on more detailed questionnaires as well.
If your business handles health records, payment card data, or other regulated information, expect extra questions about how that data is stored and who can reach it. Firms in healthcare, legal, and financial services often see closer scrutiny because the data they hold is more valuable to criminals and more costly to expose.
Vendors and Third Parties
Small businesses rely on many outside services: cloud software, payroll providers, accounting platforms, and IT companies with remote access to their systems. Each connection is a potential path for an attacker. Insurers increasingly ask how you evaluate and manage these relationships.
Questions might cover whether you know which vendors hold your data, whether contracts address security responsibilities, and whether outside parties with remote access use MFA. If an IT provider manages your network, the underwriter may want to know how that provider secures its own tools, since a compromise there could affect every client it serves.
Keeping a simple list of vendors, what data each one touches, and who your contact is there makes these questions much easier to answer. It also helps during an incident, when you may need to reach a vendor quickly or revoke their access.
Who Answers These Questions When You Have No IT Department
For many small businesses, the hardest part of the application is figuring out who can answer it. The owner or office manager often ends up staring at questions about EDR coverage and immutable backups with no idea where to look. Guessing is risky, because inaccurate answers can come back to haunt you at claim time.
This is where a managed IT provider earns its keep. A managed provider monitors and maintains your systems on an ongoing basis. That ongoing role means they already know which devices are protected, how patching is handled, and where backups are stored, so filling out an insurance form becomes a matter of pulling records. Businesses in Louisiana’s capital region, for example, can look for managed IT support for Baton Rouge businesses that covers security, backup and recovery, and day-to-day help desk work in one relationship.
When you talk with any provider, bring your insurance application along. Ask them to walk through each control and tell you honestly where you stand. A provider with a local team, such as Torapath Technologies in the Greater Baton Rouge area, can sit down with you in person and look at your actual setup, which helps when the questions get specific. Whichever provider you choose, the goal is the same: someone who can explain the gaps in plain terms and help you close them before the renewal date.
When You Already Have an IT Person on Staff
Plenty of growing businesses have one or two people handling technology in-house. These employees are often stretched thin, juggling password resets, new hires, and hardware orders alongside everything else. When a detailed cyber insurance questionnaire arrives asking about round-the-clock alert monitoring and privileged access tools, it can land as a heavy extra load.
A blended arrangement can help here. In a co-managed setup, your internal staff keep ownership of the things they know best, while an outside firm adds specialized tools, after-hours monitoring, or security expertise that would be hard to build alone. Many businesses look for co-managed IT support for in-house teams specifically when insurance requirements outgrow what one internal person can reasonably cover.
The key to making it work is a clear division of responsibilities. Decide in writing who handles patching, who watches EDR alerts, who owns backups, and who would lead during an incident. That clarity makes your insurance answers accurate, and it prevents the dangerous situation where each side assumes the other is handling something important.
Answering the Application Honestly
It can be tempting to check yes on a control you plan to implement soon, or one that is mostly in place. Resist that urge. If a claim arises and the investigation finds the control was missing, the insurer may argue that the application misrepresented your risk. That is a painful conversation to have in the middle of a crisis.
If you have a gap, say so and explain your plan to fix it. Brokers can often work with underwriters on timelines, and some carriers will issue a policy with conditions or adjust the terms while you finish the work. Being upfront usually leads to a better outcome than being caught out later.
Keep a copy of the completed application and any supporting documents. Note who answered each section and where the information came from. At renewal, you can compare the new form with last year’s answers and see clearly what has improved.
Getting Ready Before Renewal Season
The worst time to discover you need MFA everywhere or a tested backup is a week before your policy expires. Starting a few months early gives you room to make changes properly, without rushing a rollout that frustrates staff or leaves accounts out.
A practical approach is to request a blank copy of the application from your broker well ahead of renewal. Sit down with whoever manages your technology and go through it line by line. Mark each control as in place, partly in place, or missing, and build a short plan for anything that falls short. Prioritize the big items first: MFA, backups, EDR, and patching tend to carry the most weight with underwriters.
Cyber insurance requirements can look intimidating at first glance, but they describe a sensible baseline for any business that depends on computers and data. Working toward them protects your clients, your staff, and your ability to keep the doors open after a bad day. The insurance policy is a backstop, and the controls behind it are what keep most incidents from turning into claims in the first place.