Cybersecurity Insurance Requirements Explained: What Small Businesses Need to Know

Cyberattacks can create serious financial challenges for a business. A ransomware incident, compromised email account, or data breach can lead to lost revenue, recovery costs, legal expenses, and damage to customer trust.

Cyber insurance can help businesses manage some of these financial risks. However, obtaining a policy is not always as simple as completing an application and paying a premium. Insurers may ask detailed questions about your cybersecurity controls, backup procedures, employee training, and ability to respond to an incident.

For small businesses, understanding cybersecurity insurance requirements before applying or renewing a policy can help prevent surprises and identify security gaps.

In this guide, we explain what cyber insurance typically covers, which security measures insurers may ask about, and how to prepare your business.

What Is Cybersecurity Insurance?

Cybersecurity insurance, also called cyber liability insurance or cyber insurance, is designed to help businesses manage certain financial losses arising from cyber incidents, subject to the terms, limits, exclusions, and conditions of the policy.

Depending on the policy, coverage may include:

• Incident response: Access to specialists who investigate and help contain a cyber incident.
• Data recovery: Eligible costs associated with restoring damaged or compromised business data.
• Business interruption: Certain lost income and additional operating expenses resulting from a covered incident.
• Legal expenses: Covered legal defence costs and other eligible legal expenses.
• Data breach response: Certain notification, investigation, and customer support costs.
• Cyber extortion: Eligible costs associated with a ransomware or extortion incident, subject to policy terms and applicable law.
• Third-party liability: Certain claims brought by customers, business partners, or other parties following a covered incident.

Not every policy includes all these benefits. Some policies provide first-party coverage for your own losses, third-party liability coverage, or a combination of both.

The National Association of Insurance Commissioners (NAIC) notes that cyber policies are highly customised, and traditional commercial property or general liability policies may not cover many cyber-related losses.

Before purchasing a policy, ask your insurance broker to explain precisely what is covered, what is excluded, and which limits or sublimits apply.

Are Cybersecurity Insurance Requirements Mandatory?

There is no single cybersecurity checklist that every business must meet to qualify for cyber insurance.

Requirements depend on factors such as:

• The insurer and specific policy.
• Your industry and the type of information you handle.
• Your annual revenue and number of employees.
• Your dependence on technology and online services.
• Your existing security controls and previous claims.
• The coverage limit you want to purchase.

An insurer may require certain controls before offering coverage, while another may offer a policy with different conditions, exclusions, or pricing.

It is important to distinguish three different types of obligations.

1. Insurance underwriting requirements

These are the security measures and other information an insurer uses to evaluate your application. Examples may include multi-factor authentication, endpoint protection, and secure backups.

2. Legal and regulatory obligations

Certain businesses must comply with applicable privacy, data protection, cybersecurity, or breach notification laws. These obligations depend on the jurisdiction, industry, and data involved. Purchasing insurance does not remove those responsibilities.

3. Contractual requirements

Customers, suppliers, lenders, or business partners may require particular insurance coverage or security controls under a contract. Those obligations are separate from an insurer’s underwriting criteria.

Understanding these differences helps you avoid assuming that purchasing a policy automatically makes your business compliant.

8 Common Cybersecurity Insurance Requirements

Although requirements vary between insurers, the following areas are worth reviewing before you apply or renew your policy.

1. Multi-Factor Authentication (MFA)

Multi-factor authentication requires users to verify their identity using more than one authentication factor. It helps protect accounts even when a password has been stolen or exposed.

Insurers may ask whether MFA is enabled for:

• Business email accounts.
• Remote access and VPN connections.
• Administrator and privileged accounts.
• Cloud applications and file storage.
• Remote management tools and other sensitive systems.

A common gap is enabling MFA for email while leaving remote access or administrator accounts unprotected.

What your business should do: Review every important access point and enforce MFA wherever possible. Use phishing-resistant authentication methods, such as security keys or passkeys, where supported and appropriate.

CISA recommends enabling MFA across business systems, especially for remote access and privileged accounts. See its MFA guidance for businesses.

2. Endpoint Protection and Threat Detection

Endpoints include desktops, laptops, servers, and other devices used to access business systems.

Traditional antivirus remains useful, but some businesses also need more advanced capabilities to detect suspicious activity, investigate threats, and contain attacks.

An insurer may ask about:

• Endpoint detection and response (EDR).
• Centralised security monitoring.
• Malware prevention.
• Device coverage across employees and locations.
• How alerts are investigated and handled.
• Whether security tools are actively maintained.

Simply purchasing security software may not be enough if it is not deployed across the relevant devices or if alerts are ignored.

What your business should do: Maintain an accurate device inventory, confirm that endpoints are protected, and establish who is responsible for investigating security alerts and responding to threats.

Learn more about endpoint detection and response (EDR) and how endpoint security can form part of a broader cybersecurity strategy.

3. Secure and Tested Backups

Backups can be essential to recovering from ransomware, accidental deletion, hardware failure, and other disruptive incidents.

However, having a backup service does not automatically mean your recovery plan is effective. Attackers may also target backups connected to the same network as production systems.

Insurers may ask whether your business:

• Backs up important data regularly.
• Protects backups from unauthorised access.
• Maintains offline, isolated, or immutable copies where appropriate.
• Encrypts sensitive backup data.
• Tests restoration procedures.
• Has defined recovery priorities and targets.

What your business should do: Identify the data and systems you cannot afford to lose, implement a suitable backup schedule, and test whether you can restore the information successfully.

CISA provides cybersecurity resources for small and medium-sized businesses, including guidance on backups, logging, encryption, and basic security practices.

4. Software Updates and Vulnerability Management

Outdated software can expose a business to known security vulnerabilities. These weaknesses may affect operating systems, applications, firewalls, routers, and remote access tools.

An insurer may ask how your organisation handles:

• Operating system and application updates.
• Critical security patches.
• Unsupported software and legacy systems.
• Firewall and network device firmware.
• Identification and remediation of vulnerabilities.

A policy may specify expectations around patching or unsupported systems. The exact requirements and deadlines should be confirmed with the insurer.

What your business should do: Establish a documented patching process, prioritise critical vulnerabilities, and identify systems that no longer receive security updates. Plan to replace or appropriately isolate unsupported technology.

5. Email Security and Phishing Prevention

Phishing attacks attempt to trick employees into revealing credentials, opening malicious attachments, transferring money, or disclosing sensitive information.

Business email compromise can be particularly damaging when criminals impersonate a manager, supplier, or business partner.

An insurer may ask about email filtering, malicious attachment protection, anti-spoofing controls, and employee awareness training.

Useful safeguards include:

• Filtering suspicious emails and malicious attachments.
• Implementing SPF, DKIM, and DMARC where appropriate.
• Enforcing MFA for email accounts.
• Training employees to recognise suspicious messages.
• Verifying payment and banking detail changes through a trusted, separate channel.
• Establishing a clear process for reporting suspicious emails.

What your business should do: Combine technical email protection with employee training and a process for verifying unusual financial requests.

Read more about email security and phishing prevention.

6. Access Controls and Password Security

Cyber insurance applications may ask how your organisation manages user accounts and permissions.

Important questions include whether your business:

• Requires unique passwords.
• Uses a business password manager.
• Restricts administrator privileges.
• Removes access when employees leave.
• Reviews access to sensitive systems.
• Controls access granted to third-party providers.

What your business should do: Apply the principle of least privilege, giving employees access only to the systems and information they need. Review privileged accounts regularly and remove unnecessary access promptly.

For practical guidance, see our article on password management and business security.

7. Incident Response and Recovery Planning

Even well-protected businesses can experience cyber incidents. Insurers may therefore want to understand whether your organisation can respond quickly and limit the damage.

Your incident response plan should explain:

• Who is responsible for making decisions during an incident.
• How employees report suspected attacks.
• Who to contact for IT support and specialist incident response.
• How affected systems can be isolated.
• How backups and critical operations will be restored.
• When legal, regulatory, or customer notifications may be required.
• How to contact the insurer and obtain approval for incident response expenses.

What your business should do: Document an incident response plan, assign clear responsibilities, keep contact information accessible, and test the plan periodically.

Importantly, review your policy’s incident notification procedure before an incident occurs. Some policies require prompt notification or insurer-approved providers, and failure to follow the applicable terms may affect a claim.

8. Employee Cybersecurity Training and Written Policies

Employees play an important role in protecting business systems. A single compromised account can provide an attacker with an entry point into an organisation.

Depending on the insurer and risk profile, questions may cover security awareness training, phishing education, acceptable-use policies, and procedures for handling sensitive data.

Useful policies include:

• Password and MFA requirements.
• Email and internet use.
• Handling confidential information.
• Remote working and personal devices.
• Reporting suspected security incidents.
• Employee onboarding and offboarding.
• Access to customer and financial information.

What your business should do: Provide regular security awareness training and ensure employees know how to report suspicious activity. Keep records of training and written policies where appropriate.

Cyber Insurance Readiness Checklist

Use this checklist to identify areas that may need attention before you apply for or renew cyber insurance.

• MFA is enabled for email, remote access, and privileged accounts.
• Business computers and servers have appropriate endpoint protection.
• Security alerts are reviewed and investigated.
• Important business data is backed up regularly.
• Backup restoration is tested.
• Operating systems and applications receive security updates.
• Unsupported systems have a documented remediation plan.
• Email filtering and anti-phishing measures are in place.
• Employee access is limited to business needs.
• Former employees’ accounts are disabled promptly.
• Employees receive cybersecurity awareness training.
• An incident response plan is documented.
• The business knows how to notify its insurer following an incident.
• Security controls and application answers can be supported by evidence.

This is a general readiness checklist, not a universal list of mandatory insurance conditions. Always compare it with the requirements supplied by your own insurer.

What Information Should You Prepare for a Cyber Insurance Application?

A cyber insurance application may ask for information about your organisation’s technology, operations, security measures, and past incidents.

Preparing this information in advance can make the application process easier.

Information	What to prepare
Business profile	Industry, revenue range, employee count, and locations
IT environment	Computers, servers, cloud platforms, and remote access
Security controls	MFA, endpoint protection, email security, and access management
Backup arrangements	Backup frequency, storage protections, and recovery testing
Policies and training	Written security policies and training records
Incident history	Previous cyber incidents, claims, and remediation measures
Recovery planning	Incident response contacts, recovery procedures, and business continuity plans
Existing insurance	Current policies, limits, deductibles, exclusions, and renewal dates

Answer every application question accurately. If you are unsure whether a control is enabled or whether it covers all relevant systems, confirm the facts with your IT provider before submitting the application.

Do not claim that a control is in place simply because it is planned, purchased, or partially deployed. Incorrect or incomplete application answers can create serious coverage problems.

What Happens If Your Business Does Not Meet the Requirements?

If your business does not meet an insurer’s expectations, the outcome will depend on the insurer and the specific application.

Possible outcomes include:

• A request for additional information or evidence.
• Recommendations or conditions to improve security.
• Different pricing, deductibles, limits, or exclusions.
• A requirement to address particular security gaps.
• A decision not to offer coverage.

There is no guarantee that implementing a particular security product will secure approval or lower your premium.

If your application identifies gaps, ask the insurer or broker which controls are essential, which improvements are recommended, and whether any proposed changes must be completed before coverage begins.

Does Cyber Insurance Replace Cybersecurity?

No. Cyber insurance and cybersecurity serve different purposes.

Cybersecurity controls aim to prevent, detect, and contain attacks. Cyber insurance can help manage certain financial consequences of covered incidents.

A policy cannot guarantee that your business will recover quickly, prevent reputational damage, or compensate you for every loss. Claims remain subject to the policy’s terms, exclusions, conditions, limits, and applicable law.

A stronger approach combines appropriate security controls with insurance that fits the organisation’s risk profile.

For a small business, this may include managed IT services, endpoint protection, MFA, secure backups, email security, employee training, and an incident response plan.

How a Managed IT Provider Can Help With Cyber Insurance Readiness

Preparing for cyber insurance often requires more than completing a questionnaire. Your business needs to understand which systems are protected, where security gaps exist, and whether the controls described in the application are actually working.

A managed IT provider can help by:

• Reviewing your existing IT environment and security controls.
• Identifying gaps in MFA, endpoint protection, patching, and backups.
• Helping document your IT and security arrangements.
• Supporting backup and recovery testing.
• Assisting with security improvements before renewal.
• Coordinating technical information for your insurance broker or underwriter.

At Keltic Fish, businesses can discuss their managed IT and cybersecurity needs to understand how their technology environment can better support security and operational resilience.

No IT provider can guarantee insurance approval or claim acceptance. The insurer makes underwriting and coverage decisions based on the application and policy terms.

Explore Keltic Fish cybersecurity services or learn about managed IT services.

Frequently Asked Questions About Cybersecurity Insurance Requirements

Is multi-factor authentication required for cyber insurance?

Some insurers require MFA for particular systems or accounts, while others apply different underwriting criteria. Check your insurer’s application and policy conditions, paying particular attention to email, remote access, and privileged accounts.

Do small businesses need cyber insurance?

Cyber insurance may be worth considering if your business relies on digital systems, stores sensitive information, processes online payments, or depends on technology to serve customers. Whether it is appropriate depends on your risks, financial position, contractual obligations, and available coverage.

Does cyber insurance cover ransomware?

Some policies cover certain ransomware-related expenses, incident response, data restoration, or business interruption. Coverage varies, and exclusions, sublimits, consent requirements, and applicable laws may affect what is covered. Never assume ransom payments or every recovery expense will be reimbursed.

Will having EDR lower my cyber insurance premium?

EDR may support your security posture and help answer an insurer’s questions about threat detection. However, it does not guarantee a lower premium, policy approval, or claim payment. Insurers consider multiple factors.

Can an insurer deny a claim if my business lacks security controls?

Coverage depends on the policy wording, application representations, applicable law, and the facts of the incident. A security failure does not automatically mean every claim will be denied, but inaccurate application answers, unmet policy conditions, or relevant exclusions may create coverage disputes.

How often should we review our cyber insurance requirements?

Review them before each application or renewal and whenever your IT environment, business operations, or risk profile changes significantly. Confirm any ongoing obligations directly with your insurer or broker.

Protect Your Business Before the Next Cyber Incident

Cyber insurance can be an important part of your business risk management strategy, but the application process also provides an opportunity to identify weaknesses in your technology and security practices.

Start by checking your MFA, endpoint protection, backups, patching, email security, access controls, and incident response procedures. Then compare your findings with the requirements of your insurer and address any gaps before submitting your application or renewal.

Need help reviewing your business’s IT and cybersecurity setup?

Contact Keltic Fish to discuss your managed IT and cybersecurity needs and the practical steps your business can take to strengthen its security posture.