Security and insurance
What security do cyber insurers require?
The short answer
Most cyber insurance applications ask about the same core controls: multi-factor authentication (MFA) on email and remote access, endpoint detection and response (EDR) on every computer, backups that are tested and kept separate, timely patching, security awareness training, and a written incident response plan. Answers that turn out not to be true can put a claim at risk.
Which controls come up most?
- MFA on email, remote access and admin accounts.
- EDR on every computer and server, not just traditional antivirus.
- Backups that are tested, encrypted and kept where ransomware cannot reach them.
- Patching on a schedule, with a record that it happened.
- Privileged access limited, so everyday accounts are not administrators.
- Security awareness training, usually with simulated phishing.
- An incident response plan: who you call and what you do in the first hour.
Why does the application matter so much?
Because many policies treat it as part of the basis for coverage. Exactly how depends on the policy wording and state law, but two things commonly matter: whether the answers were materially accurate when you gave them, and whether you kept any security requirements the policy itself sets. Treat the questionnaire as a description of how you really operate, not a formality.
Where do we start?
Pull last year’s application and check each answer against reality. Our cyber insurance requirements guide walks through each control and the common reasons claims get denied.