Cyber insurers commonly ask small and midsize businesses about multi-factor authentication (MFA), endpoint protection, backups, patching, access controls, and incident response. But there is no universal checklist for 2026. Requirements vary by insurer, policy, business, and underwriting process.
Before a claim is paid, the insurer may examine more than whether you checked “yes” on an application. The application, the policy wording, your security practices, and the facts of the incident can all matter. No single control guarantees coverage or payment.
The practical goal is to answer accurately, keep evidence, and understand what your policy says to do if an incident occurs.
WHAT INSURERS MAY REVIEW
Underwriting often starts before a policy is issued or renewed. Insurers may ask what systems and data you rely on, what security measures you use, and how you respond to an incident. Travelers, for example, publishes separate cyber insurance applications and an MFA supplement: one illustration of how application questions differ by carrier.
After an incident, the insurer may compare the circumstances and your controls with the application and the policy terms. That does not mean every gap automatically voids coverage. The outcome depends on the specific wording, facts, and applicable law. But inaccurate statements or overlooked policy conditions can create serious problems.
Review the actual policy and endorsements with your broker. Pay particular attention to any language about application representations, required controls, notice deadlines, approved vendors, and consent before incurring response costs.
COMMON CONTROLS AND THE EVIDENCE TO KEEP
Insurers’ questions vary, but these areas commonly come up. Treat the list as a preparation guide, not a promise of what any particular insurer will require.
1. MFA AND ACCOUNT SECURITY
MFA adds a second verification step when someone signs in. Insurers may ask whether it protects email, remote access, cloud services, and administrator accounts. MFA on one application does not establish coverage across your business.
Keep:
- An inventory of key systems and user accounts.
- Identity-provider or system reports showing where MFA is enabled.
- A record of exceptions, who approved them, and when they will be addressed.
- Evidence that former employees’ access is removed and administrator privileges are limited.
2. ENDPOINT PROTECTION AND MONITORING
Insurers may ask how you detect and respond to suspicious activity on laptops, servers, and other endpoints. Be ready to describe your tools, which devices they cover, who reviews alerts, and how incidents are escalated.
Keep deployment and coverage reports, alert-handling procedures, and records of unresolved devices or exclusions. If a managed provider monitors alerts, make sure you understand the service’s scope and escalation process. A tool’s presence alone does not show that every device is protected or alerts are being acted on.
3. BACKUPS AND RECOVERY
A backup is useful only if it can be restored. Insurers may ask how often you back up critical data, whether copies are isolated from your main network, and whether you test recovery.
Keep a simple record of:
- Which systems and data are backed up, and how often.
- Where copies are stored and how access is protected.
- The dates and results of restore tests.
- Your recovery priorities and who is responsible for restoration.
CISA’s ransomware guidance also emphasizes preserving information and planning for recovery. A successful test is more useful evidence than a statement that backups are configured.
4. PATCHING AND VULNERABILITY MANAGEMENT
Insurers may want to know whether you keep systems updated and address serious vulnerabilities promptly. A clear process matters more than an unsupported claim that everything is “fully patched.”
Keep an asset list, patch reports, vulnerability scan results, and documentation of approved delays. Track which internet-facing systems need priority attention. Unsupported or forgotten software can be easy to miss without an inventory.
5. INCIDENT RESPONSE AND STAFF PRACTICES
A written incident plan should make clear who makes decisions and whom to contact. Include your internal lead, IT or managed services provider, broker, insurer, and any outside specialists identified in the policy. Cover scenarios such as ransomware, stolen credentials, business email compromise, and vendor incidents.
Keep the plan, staff training records, and notes from exercises or reviews. If you have not tested the plan, say so. A tabletop exercise can uncover practical gaps before a real incident.
THE APPLICATION IS NOT THE POLICY
The insurance application records what you told the insurer when applying or renewing. The policy sets out the coverage, exclusions, limits, conditions, and claim procedures. Read both, along with endorsements and supplements.
Ask your broker to clarify:
- Which systems and account types must use MFA?
- Are any specific security controls required throughout the policy term?
- What events must be reported, and how quickly?
- Must you use insurer-approved response vendors or get consent before hiring one?
- Are ransomware, business interruption, and funds-transfer fraud covered, and at what limits or sublimits?
- What exclusions, waiting periods, or deductibles could apply?
These questions matter because coverage is not always where businesses expect it to be. For example, business email compromise or fraudulent transfers may have separate terms or limits. Do not assume a cyber policy covers every loss related to a cyber incident.
BUILD A CLAIM-READY EVIDENCE FILE
Create a secure folder for insurance and security records. Review it before renewal and whenever your systems change. A useful starting file includes:
- The signed application and supplemental questionnaires.
- A current inventory of critical systems and data.
- MFA and endpoint-protection coverage reports.
- Backup configuration and restoration-test records.
- Patch and vulnerability-management reports.
- Incident response and recovery plans.
- Staff security-training and exercise records.
- Contact details, notice instructions, and relevant policy endorsements.
Have the person responsible for each control verify the corresponding application answer. If a control is incomplete or limited to part of your environment, explain that clearly and ask your broker how to report it. Do not treat an outdated questionnaire as proof that a control still works.
When your business changes (such as moving systems to the cloud, changing providers, or adding remote access) ask your broker whether the insurer needs to know. Keep records of what changed and when.
HOW FIVE 9 LLC CAN HELP
Five 9 LLC helps businesses assess security risks, prioritize gaps, plan incident response, and strengthen IT controls. Our security services include vulnerability management, security planning, and incident response preparation. We can also work alongside your internal team to document what is in place and identify what needs attention.
A security assessment can help you organize the facts before renewal. Five 9 LLC describes a typical assessment as taking 1–2 weeks; the scope depends on your systems and goals. We do not publish a one-size-fits-all price because the work varies. We can discuss scope and pricing during an initial conversation, and we’ll be clear if a request falls outside our expertise. Our consulting approach includes knowledge transfer so your team understands the work, not just the deliverables.
PREPARE WITHOUT ASSUMING A GUARANTEE
Treat insurer questions as an opportunity to confirm that your controls work and your records are current. Accurate answers and organized evidence can make underwriting and incident response more orderly, but they cannot guarantee that a claim will be covered or paid.
For a claim, follow the policy’s notice instructions promptly, preserve relevant records, and coordinate response decisions with your broker and insurer. For coverage interpretations, rely on your licensed broker or qualified legal counsel.
If you want help reviewing your technical controls or preparing evidence for renewal, book an honest, no-pressure conversation with Five 9 LLC. We’ll help you identify practical next steps and support your team as your needs change.
