A few years ago, a cyber insurance application was a page of checkboxes. Today it reads like an IT audit. Many policies renew in January, which means the questionnaire is about to land on your desk.
Most business owners hand it to whoever handles IT, or worse, answer it themselves from memory. Both are risky. The answers you sign become part of the policy.
What a wrong answer costs you
If you check "yes" for multi-factor authentication and it turns out half your staff never set it up, you have a problem the day you file a claim. Insurers investigate after a breach. When the application doesn't match what they find, they can reduce the payout or deny it.
If you answer "no," you may still get coverage, but expect a higher premium, a lower limit or a ransomware exclusion. That's the one coverage most small businesses buy the policy for.
Either way, the questions are coming. The only way to win is to make the honest answer "yes."
The 3 questions every insurer asks
Is multi-factor authentication on everywhere it matters?
Email, remote access and every administrator account. Missing MFA on email or remote access is one of the most common reasons an application gets declined or a ransomware exclusion added.
Do you run endpoint detection and response (EDR)?
Traditional antivirus isn't enough anymore. Insurers want EDR on every computer and server: software that watches for attacker behavior and can isolate a machine, not just match known viruses.
Can an attacker delete your backups?
Ransomware goes after backups first. Insurers want copies that can't be changed or deleted, kept separate from your network, and restore tests to prove they work.
What insurers want to see
| Control | What the application asks | What proof looks like |
|---|---|---|
| Multi-factor authentication | Is MFA required for email, remote access and admin accounts? | A report from Microsoft 365 or your remote access system showing MFA turned on for every user. |
| Endpoint detection (EDR) | Is EDR installed on all endpoints and servers? Who monitors it? | A device count from your EDR console that matches your actual device count, plus who responds to alerts. |
| Backups | Are backups offline or immutable? When did you last test a restore? | Backup job history, retention settings and a dated restore test. |
| Patching | How quickly are critical updates installed? | A patch report showing devices up to date, with no unsupported systems like Windows 10. |
| Training | Do employees get phishing and security training? | Training completion records and phishing test results. |
| Incident response plan | Do you have a written plan for a cyber incident? | A short written plan: who to call, in what order, including your insurer's breach hotline. |
Why most small businesses fall short
It's rarely that nobody tried. MFA got turned on for the owner but not the shared front-desk mailbox. EDR got installed on the new laptops but not the old server in the back room. Backups run every night, but nobody has tried a restore since the system went in.
Each gap is small. On an insurance application, each one turns a "yes" into a "partly."
How IDN gets you to yes
Before your renewal, IDN checks each control on the application against what's actually running on your network. You get a straight answer for every question, and a list of what to fix to make the honest answer "yes."
Then we close the gaps: MFA on every account that needs it, EDR on every device with our team watching the alerts, and backups an attacker can't reach, tested on a schedule. When the questionnaire comes back next year, you already have the proof.
We're in Racine, not a call center three states away. When something goes wrong, you get a response in 10 minutes.
- CLIENTS SERVED
- 1,000+
- RESPONSE SLA
- 10-MIN
- YEARS IN SE WISCONSIN
- 20+
Cyber insurance questions
- What do cyber insurers require from small businesses?
- Requirements vary by carrier, but nearly all ask about multi-factor authentication on email, remote access and admin accounts, endpoint detection and response on every device, and backups that attackers can't delete. Many also ask about patching, employee training and a written incident response plan.
- Can I get cyber insurance without MFA?
- Sometimes, but expect a higher premium, a lower limit or an exclusion for ransomware. Some carriers decline the application outright.
- Is regular antivirus enough for cyber insurance?
- Usually not. Most carriers now ask specifically for endpoint detection and response (EDR), which watches for attacker behavior and can isolate an infected machine.
- What happens if my application answers turn out to be wrong?
- Insurers review your controls after a claim. If your application said a control was in place and it wasn't, the carrier can reduce or deny the claim. Verify each answer before you sign.
- When should I start preparing for my renewal?
- 60 to 90 days before the renewal date. That leaves time to close gaps, like turning on MFA or replacing antivirus with EDR, before you answer the questionnaire.
Know your answers before you sign
IDN's free IT assessment checks MFA, endpoint protection, backups and patching against what insurers ask. You get a plain-language list of what's in place and what to fix before your renewal.