Cyber insurance controls are the security measures an insurer asks you to have in place, and to prove, before it will offer coverage at a workable price. The core set is multi-factor authentication (MFA), protected backups, endpoint monitoring, patching, email protection and a tested incident response plan. Carriers differ on the details, but a business that can show these working, with dated evidence, is in the strongest position at application and at claim time.
TL;DR
- MFA on remote access and email is the control insurers look for first. A federal advisory council report says insurers universally look for it before deciding whether to underwrite a risk.
- Backups kept separate from your source systems, plus a drilled incident response plan, are the next most common asks.
- Requirements vary by carrier, industry and policy size. Small accounts may only attest, while larger limits can require independent evidence.
- Wrong answers on an application can lead to a denied claim or a rescinded policy, so answer only what you can prove.
- Keep dated records: restore tests, scan results with fixes, and tabletop exercise notes.
Table of Contents
- What cyber insurance controls are, and why insurers ask for them
- The controls insurers most often expect
- How requirements differ by insurer, size and industry
- Healthcare: where insurance controls meet HIPAA
- Building the controls on a limited budget
- Evidence to keep so your answers hold up
- What happens when controls are missing or misstated
- Perspective
- Getting insurance-ready with Nexus
- FAQ
- Sources
What cyber insurance controls are, and why insurers ask for them
An insurer prices cyber risk the way a property insurer prices fire risk: by looking at what you have done to reduce the chance and the cost of a loss. The application is the questionnaire where you describe those measures. Some carriers add an external scan of your internet-facing systems to check your answers.
The Federal Trade Commission advises small businesses to document the legal, regulatory and contractual cybersecurity requirements that apply to them, decide whether insurance is appropriate, and confirm that a policy covers network breaches and data held by vendors. That order matters. Insurance is a financial backstop. It sits on top of your security program and does not replace it. The UK's National Cyber Security Centre makes the same point in its cyber insurance guidance: a policy will not prevent a breach, so you still need to protect your most critical assets.
The controls insurers most often expect
No single standard form exists, so treat this as the common core rather than a universal checklist.
| Control | What insurers typically want to see | Where it usually fails |
|---|---|---|
| MFA | On email, remote access, VPN and administrator accounts | Covers email but not the VPN or accounting system |
| Backups | Recurring, stored separately from source systems, restore tested | Never restored, or reachable from the same network |
| Endpoint protection | Monitored protection on workstations and servers | Gaps on servers, laptops or contractor devices |
| Patching | Defined timelines for critical fixes | No record of when fixes were applied |
| Email security | Filtering, plus staff training | Training done once, never repeated |
| Incident response | A written plan, exercised at least yearly | Plan exists but nobody has run it |
Multi-factor authentication
This is the control with the strongest evidence behind it. The report to the U.S. Department of Labor's ERISA Advisory Council states that insurers universally look for MFA on remote access to systems or accounts before they will consider underwriting a risk. CISA's Cross-Sector Cybersecurity Performance Goals go further and emphasize phishing-resistant MFA as a foundational measure, along with third-party validation of defenses and cybersecurity requirements for vendors.
The practical question on an application is coverage, not existence. "Yes, we use MFA" is only true if it protects every path the question names. If you are rolling it out, our 90-day phishing-resistant MFA plan lays out the sequence for IT leaders.
Backups that an attacker cannot delete
Ransomware crews go after backups first. CISA's performance goals call for recurring backups stored separately from the systems they protect, and CISA recommends separate, offline and immutable copies so that data cannot be wiped before an attack. Insurers ask about this because it sets the size of a ransomware loss. If you can restore, you may not need to pay.
A backup that has never been restored is an assumption. Run a restore, write down the date and how long it took, and file the record. Our guide to the 3-2-1 backup rule with an offline copy shows how to structure copies so one is always out of an attacker's reach.
Incident response plan and tabletop exercises
CISA's goals describe incident response plans that are drilled annually as a critical way to reduce cyber risk. Underwriters like this because a rehearsed plan shortens the time between detection and containment. It also gives you something concrete to show: who calls whom, who talks to the insurer, who decides on shutting systems down. If you are building one, start with our incident response plan guide for small businesses, then adapt the notification steps to your state. Notification deadlines depend on the date you discover a breach, which we cover in our piece on U.S. data breach notification laws.
Check your policy for its own notice requirement too. Many policies expect you to tell the carrier promptly and use approved response vendors, so put the policy number and the carrier's claims line in the plan itself.
Endpoint monitoring, patching and email protection
These three are the staples of most applications: monitored protection on every computer and server, a patching routine with timelines, and filtering plus training for email. Our summary of what carriers look for, proving MFA, EDR and backups in 90 days, walks through the evidence for each. For the email side, the email security playbook covers filtering, authentication records and phishing handling.
How requirements differ by insurer, size and industry
Expect variation. A 2026 client alert from the law firm Shumaker, Loop & Kendrick notes that requirements vary by carrier, industry and policy form. Some carriers accept a simple attestation, while accounts with high limits may be asked for independent evidence.
Three things tend to move the bar:
- Limit requested. A $1 million policy and a $10 million policy are underwritten differently.
- Data and industry. Healthcare, financial services and companies holding large volumes of personal data get closer scrutiny.
- Market conditions. RPS's Q2 2023 market update described a maturing but unpredictable market, with some carriers easing certain IT control requirements for smaller businesses. That was not a universal trend, so do not assume your carrier has relaxed anything.
Applications also ask who owns security. Beazley's application, for example, asks for a cybersecurity point of contact, such as a CISO, risk manager or equivalent. A small company can name an IT manager or an external security lead, but someone must be named and accountable.
Healthcare: where insurance controls meet HIPAA
If you handle electronic protected health information (ePHI), the insurance questionnaire overlaps with legal duties. The HIPAA Security Rule requires covered entities and business associates to assess risks and vulnerabilities to the confidentiality, integrity and availability of ePHI, as the HHS Office for Civil Rights cybersecurity newsletter explains. A current, documented risk analysis therefore does double duty: it satisfies the regulation and answers a likely underwriting question.
Legacy medical devices and older clinical systems are a common sticking point because they cannot always take MFA or modern agents. The same HHS newsletter names enhanced audit logging and restricted access as possible compensating controls. If you rely on one, write down why the standard control is not possible and what you did instead. Underwriters generally respond better to a documented exception than to a silent gap.
If you are starting from scratch, a security risk assessment is the first document to produce.
Building the controls on a limited budget
You do not need to buy everything at once. Sequence by how much loss each control prevents and how easily you can prove it.
- Weeks 1 to 2: identity. Turn on MFA for email, remote access and every administrator account. List the exceptions and close them.
- Weeks 3 to 4: backups. Separate at least one copy from your network, then perform and record a restore test.
- Weeks 5 to 6: endpoints and patching. Inventory every device, deploy monitored protection, and set a written timeline for critical patches.
- Weeks 7 to 8: email and people. Enable filtering and run short phishing training sessions, with attendance records.
- Weeks 9 to 10: response. Write the plan, name the roles, and run a one-hour tabletop exercise.
- Weeks 11 to 12: review. Scan for vulnerabilities, fix what matters, and read the application again line by line.
If you have no in-house IT team, our small business playbook for reducing cyber risk shows what to do first and what to outsource. Vendors matter too: an insurer will ask how you manage suppliers that hold your data, and our guide to third-party cybersecurity risks maps the main types. Businesses that take card payments in higher-risk sectors face a second underwriting review from their processor, so it is worth understanding high-risk payment processing requirements alongside your insurance application.
The EPA, writing about water utilities but with advice that applies broadly, recommends finding underwriting participants who understand your operations and your cybersecurity measures. In practice, that means working with a broker who has placed cyber policies in your industry and who can explain a questionnaire before you sign it.
Evidence to keep so your answers hold up
The Shumaker alert says carriers increasingly want continuous, documented proof that controls are implemented, not a once-a-year form. It recommends keeping dated backup restoration records, vulnerability scan results with remediation records, and incident response tabletop exercise records.
A simple evidence folder, reviewed quarterly, covers most needs:
- MFA enrollment report showing coverage by system and user group
- Backup configuration, plus the most recent restore test with date and result
- Endpoint protection deployment report against your device inventory
- Patch reports and the latest vulnerability scan, with what was fixed and when
- Training attendance and phishing test results
- The incident response plan, its owner, and the notes from the last exercise
- The signed application and any attestation, so you can compare it with reality later
The habit of documenting a security program, testing it and having it assessed independently is not unique to insurance. The FTC's order against LabMD required a documented program with risk assessments, safeguards, regular effectiveness testing and initial and biennial independent assessments. Insurers are asking for a lighter version of the same discipline.
What happens when controls are missing or misstated
This is where the application becomes serious. According to the Shumaker alert, misrepresenting controls can lead to claim denial or policy rescission, and material security gaps can lead to higher retentions, unfavorable terms or declination of coverage.
The lesson is not to promise less. It is to answer precisely:
- If MFA covers email but not the VPN, say so on the form, or fix the VPN before you sign.
- If backups exist but have never been restored, run the restore first.
- If a control is planned, describe it as planned, with a date.
- Have the person who actually runs IT review the answers before the owner signs.
Also ask your broker whether the policy would respond to a new type of attack. The NCSC warns that a policy may not cover a novel attack method and advises checking with your broker. Read exclusions and sublimits for ransomware, social engineering and vendor outages before you need them.
Perspective
Most of the insurance trouble we see comes from fragmentation, not neglect. One vendor runs email, another the firewall, a third the backups, and nobody can say with confidence that MFA covers every system on the application. The form asks one question and the answer lives in four places.
We built Nexus to close that gap. When cybersecurity, managed IT, cloud, data protection and compliance sit under one agreement with one point of accountability, the evidence an underwriter wants (restore tests, scan results, patch records, exercise notes) comes out of one program, and it stays current because the same team runs it.
Our approach is to treat the application as a snapshot of controls you already operate every day. Fix the gaps first, document as you go, and let the insurer see a business that can detect and contain an incident quickly. That is also the best argument for better terms.
Nick - Sr. Executive
Getting insurance-ready with Nexus
If the checklist above shows more gaps than your team can close, Nexus combines 24/7 threat detection, managed IT, cloud management, data protection and compliance assessments (SOC 2, HIPAA, PCI-DSS, ISO 27001) under one provider and one SLA, on flat monthly pricing. Pricing is not published, so ask us for a scoped quote.
See the full range on our services page, or start at accountnext-nexus.com to talk to a specialist about the controls your next renewal will ask for.
FAQ
Is MFA really required for cyber insurance?
For most carriers it is the baseline. A report to the Department of Labor's advisory council says insurers universally look for MFA on remote access before deciding whether to underwrite. Applications usually extend the question to email and administrator accounts, so check the exact wording on yours.
Can a small business qualify without a full security team?
Often yes. Smaller accounts may only need to attest to their controls, while higher limits can require independent evidence. You can meet the core expectations with MFA, separated and tested backups, monitored endpoints and a short response plan, run in-house or by a managed provider.
What proof should I keep for my controls?
Keep dated records: backup restore tests, vulnerability scan results with the fixes made, and tabletop exercise notes. Add MFA coverage reports, patch logs and training attendance. Review the folder every quarter so it matches what you told the insurer.
What if I answered an application incorrectly?
Contact your broker promptly and correct it, because misrepresented controls can lead to claim denial or policy rescission. Fix the underlying gap and document the date. Do not wait for a claim to find out how the carrier reads the answer.
Does HIPAA compliance satisfy a cyber insurer?
Not by itself, but they overlap. The HIPAA Security Rule requires risk assessment for ePHI, and a documented assessment helps with underwriting. Insurers may still ask for specific controls such as MFA and backups that the rule does not name.
Sources
- Federal Trade Commission: Cybersecurity for Small Business
- Report on Cybersecurity Insurance and Employee Benefit Plans (U.S. Department of Labor ERISA Advisory Council)
- CISA Cross-Sector Cybersecurity Performance Goals
- NCSC (UK): Cyber insurance guidance
- Shumaker, Loop & Kendrick client alert on cyber insurance
- RPS 2023 Q2 Cyber Market Update
- Beazley cyber insurance application
- HHS OCR Cybersecurity Newsletter, Fall 2021
- EPA: Cyber Insurance for Drinking Water and Wastewater Systems
- FTC order in the LabMD matter
- DavinciPay: high-risk payment processing