Cyber Insurance Requirements Small Businesses Commonly Face

Published October 23, 2026 · Last reviewed October 23, 2026

Cyber insurers commonly ask applicants about multi-factor authentication, backups, endpoint detection, patching, staff training and an incident response plan. Requirements differ by insurer and change often, so treat this list as typical, not guaranteed. Answer applications accurately, keep evidence for each answer, and know that in an incident you should call the insurer’s hotline first, because policies often require it.

What insurers commonly ask

Applications vary, and none of the following is a promise about any policy. Insurers have for several years asked small businesses about the same handful of controls, because those controls reduce both the likelihood and the impact of an incident. Expect questions such as these:

Multi-factor authentication on email, remote access and administrator accounts. See MFA for everyone.
Backups that are tested and kept apart from the main network, with at least one copy an intruder cannot erase. See the 3-2-1 rule.
Endpoint protection, sometimes specified as endpoint detection and response, on every computer and server.
Patching within a stated time, especially for internet-facing systems. See patching known exploited vulnerabilities.
Staff training and a way to report suspicious email.
A written incident response plan with named contacts. See the first-hour plan.

Some policies treat funds-transfer fraud, ransomware and business interruption separately, with different limits or conditions. That is common enough that you should read for it. Do not assume that a policy covers a payment sent to a fraudster because it says “cyber” on the front.

Answering and preparing

Action: Complete the application with the person who runs your IT, answering each control question from what is actually in place today, and note the console or report that shows it.
Why it helps: An inaccurate answer can cause a claim to be disputed. A truthful “not yet” is better than a confident “yes” that cannot be shown.
Verification: For each yes you hold an export, screenshot or report dated within the last 30 days, kept in a folder labelled for the policy.
Fallback if delayed: Where a control is missing, ask the broker what the insurer accepts as a plan with a date, and put the date in the plan.

Action: Read the policy for four things: the notification window, any panel of approved responders, the exclusions, and the limits for funds-transfer fraud and business interruption.
Why it helps: These decide whether the policy helps on the day. Many policies require prompt notice and use of approved responders.
Verification: You can state each of the four in one sentence, with the page number in the policy.
Fallback if delayed: If the wording is unclear, ask the broker to explain it in writing and keep the reply.

Action: Put the insurer’s claims hotline, the policy number and the broker’s contact on the incident card by the phone and in a place reachable if email is down. See the one-page incident card.
Why it helps: Insurers frequently control who is authorised to respond. Calling someone else first can complicate cover.
Verification: Two people other than the owner can find the number in under a minute, without using the company network.
Fallback if delayed: Keep a printed copy in a sealed envelope at the owner’s home.

Action: Diary the renewal date three months ahead and refresh the evidence folder then.
Why it helps: Requirements tighten between renewals, and a late scramble leads to rushed answers.
Verification: A calendar entry exists with the policy number in the subject line.
Fallback if delayed: Ask the broker to send a reminder.

How it works

An insurer cannot see your controls, so it uses the application, and sometimes an outside scan of your internet-facing systems, as a stand-in. The easiest way to meet a requirement is to have done the work before being asked, with evidence in hand. Meeting a requirement on paper only, for example by describing MFA as enabled when it covers only some users, tends to surface at the worst time: when a claim is investigated.

Insurance transfers part of the financial loss. It does not restore your data or reopen your doors. The controls above reduce the chance and the size of an incident, and the plan reduces the time to recover. Treat the policy as the last layer. The CISA Cyber Essentials and the Canadian Centre for Cyber Security baseline controls are free lists of the same kind of controls, written for smaller organisations.

Worked example

A hypothetical 60-person distributor receives a renewal questionnaire asking whether MFA covers all email accounts. The IT lead checks the console and finds 52 of 60 accounts enrolled, with eight shared mailboxes excluded. The honest answer is “most, with a plan”. The firm writes the plan, finishes enrolment in two weeks, and replies with the dated export once it is done.

While reading the policy the owner discovers the funds-transfer fraud cover has a separate, lower limit and requires a call-back check on payment changes. That is not yet written down. The firm adopts the payment-change verification routine the same week. Every figure and name here is invented to illustrate the process.

Frequently asked questions

What do cyber insurers require from small businesses?

Requirements differ, but insurers commonly ask about multi-factor authentication, tested backups, endpoint protection, patching, staff training and an incident response plan. Check your application and policy for the exact terms.

Who should I call first in a cyber incident if I have insurance?

Call the insurer’s claims or incident hotline first. Many policies require prompt notice and may only cover responders the insurer approves. Then contact your IT provider, legal counsel and the relevant national reporting body.

Does cyber insurance cover paying a ransom or a fraudulent transfer?

It depends entirely on the policy, its limits and its conditions. Funds-transfer fraud and ransomware are often handled under separate terms. Read the wording and ask your broker to confirm in writing.

What happens if my application answers were wrong?

An inaccurate answer can give the insurer grounds to dispute a claim. Answer from what is in place today, keep dated evidence for each answer, and update the insurer when things change.

Is cyber insurance a substitute for security controls?

No. Insurance transfers part of the financial loss after an incident. Controls and tested backups reduce the chance of an incident and the time it takes to recover.

Want checks like this in your inbox?

The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.