Cyber Insurance Requirements for Small Business: What the Application Asks and the Proof to Have Ready

A cyber insurance application reads like a security questionnaire, and the person who signs it is you, not your IT provider. Cyber insurance requirements for small business are the security controls a carrier asks about on that application and again at renewal, such as multifactor authentication (MFA), endpoint protection, backups, patching, training and an incident response plan. They differ by carrier and can change at renewal, so the application in front of you is the real list. Treat every "yes" on it as a statement you can back with a report.

This guide is for owners and finance leads at businesses of 10 to 100 people with no in-house security staff. It is not insurance or legal advice. Which coverage you buy, and how your policy treats an answer, are questions for your agent or broker and the policy wording. The FTC's cyber insurance guidance for small businesses says the same: "discuss with your insurance agent what policy would best fit your company's needs."

You sign the application, so every answer is a statement of fact

The carrier uses your answers to decide whether to offer a policy and on what terms. Your managed IT provider (MSP) may run the controls, but you sign the form.

One documented case shows the stakes. In July 2022, Insurance Journal reported that Travelers had asked a federal court to rescind a cyber policy it issued to International Control Services (ICS), an Illinois electronics manufacturing services company. The application, signed by the company's leadership, said ICS used MFA for administrative or privileged access. After a ransomware attack in May 2022, Travelers alleged that ICS "only used MFA to protect its firewall, and did not use MFA to protect any other digital assets." In August 2022, the two sides agreed to have the court rescind the policy and declare it "null and void, from its inception," leaving no coverage under it.

The lesson: read each question for its scope words (all users, all remote access, every privileged account, email) and answer for exactly that scope. A question about "privileged access" covers every admin login, not one device.

Cyber insurance requirements for small business, control by control

Thresholds quoted online are not your requirements; the wording on your application is. These are the controls an application may ask about. For what each security layer does, see our guide to cybersecurity for small business.

Multifactor authentication (MFA)

• What the question checks: whether a second factor protects the logins an attacker wants most. CISA's Cyber Essentials sets the order: "MFA should be required of all users, but start with privileged, administrative, and remote access users." On method, CISA's MFA guidance for businesses says they "should aim to use a phishing-resistant MFA method."
• A true yes: MFA on every account in the question's scope, including shared admin logins. An account that cannot use MFA is a disclosure question for your agent, not a yes.
• Proof to have ready: an MFA coverage report from your email and identity systems that lists every account, its MFA status and the named exceptions.
• Ask your MSP for: that report, pulled the week you sign, plus the MFA settings on your backup console and remote access.

Endpoint protection and EDR

• What the question checks: what security software runs on your laptops and servers, and sometimes whether anyone reviews its alerts. Traditional antivirus blocks known threats; endpoint detection and response (EDR) records what happens on a device and can isolate it.
• A true yes: the product the question names is installed and reporting on every device in scope. If the question asks about monitoring around the clock, someone is actually watching at 2 a.m.
• Proof to have ready: a deployment report listing every device, whether the agent is installed and when it last checked in.
• Ask your MSP for: what it deploys (antivirus or EDR), who reviews alerts after hours, and the deployment report.

Backups and restore tests

• What the question checks: whether you can recover from ransomware without paying. The #StopRansomware Guide from CISA and its federal partners says: "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario." Offline matters because "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups."
• A true yes: a copy an attacker on your network cannot reach or delete, and a restore that has been tested, not assumed. Separate credentials and MFA on the backup console belong in the same answer.
• Proof to have ready: a restore-test log with dates, what was restored and whether it worked, plus a short note on where the offline or separate copy lives. A backup job that reports success is not proof of a restore.
• Ask your MSP for: the date of the last successful restore test, a list of who can delete backups, and how the backup console is protected.

Patching and unsupported systems

• What the question checks: how fast security updates go in, and whether anything still runs past its end of support. Cyber Essentials is direct: "Enable automatic updates whenever possible. Replace unsupported operating systems, applications and hardware."
• A true yes: if the question names a time window for critical patches, your report shows you meet it, and no unsupported system is left undisclosed.
• Proof to have ready: a patch status report for every device and a list of systems past end of support, with the plan for each.
• Ask your MSP for: both reports, and the patch window it actually works to.

Email security and security awareness training

• What the question checks: whether suspicious email is filtered before it reaches staff, and whether staff are trained to spot what gets through. An application may also ask about phishing simulations.
• A true yes: filtering on every mailbox, and training completed by the people the question covers, on the schedule it names.
• Proof to have ready: training completion records with a date for each employee, and phishing test results if the question asks for them.
• Ask your MSP for: whether it runs the training, and completion reports you can hand over without editing.

Admin access and third-party access, including your MSP's

• What the question checks: who holds administrator rights, and how outside parties reach your systems. Your MSP is one of them, and its technicians may hold admin access to every system it manages.
• A true yes: admin rights held only by named people who need them, and every vendor's remote access protected by MFA and logged.
• Proof to have ready: a list of admin accounts and who holds each one, and a list of vendors with remote access.
• Ask your MSP for: a written description of how its technicians sign in: MFA on its remote tool, a named account for each technician, and an access log it can show you.

A written incident response plan

• What the question checks: whether you know what happens in the first hours of an incident: is the plan written, who is called first, has it been tested. Cyber Essentials tells leaders to develop "an incident response and disaster recovery plan outlining roles and responsibilities," and adds: "Test it often."
• A true yes: a written plan with names and phone numbers, including who notifies the carrier and how, and the date it was last tested.
• Proof to have ready: the plan, its contact list and the date of the last test or tabletop exercise.
• Ask your MSP for: its role in your plan and the hours it responds to an incident. The IT support SLA guide covers how to put incident hours in the contract.

Check your policy before an incident, not during one. A policy can name a breach hotline or vendors you are expected to call first. The FTC suggests looking for a breach hotline "that's available every day of the year at all times." Your plan should say who calls it.

The evidence pack: one table to copy

Collect the reports in one folder before you answer anything.

Handle health records or card data? HIPAA or PCI DSS may add its own requirements; see our guide to MSP compliance for HIPAA, PCI and SOC 2. NIST's Small Business Cybersecurity Corner collects free guidance by topic.

How to answer when the honest answer is "mostly"

Answer only what you can prove. If a control covers some accounts or devices but not all, say so, and ask your agent how to disclose it. "MFA on every account except two shared logins" is an answer. "Yes" is not.

Check the reports against your own staff and device lists. A coverage report shows only what the tool knows about, so a laptop the MSP never enrolled will not appear on it. Ask about anything missing from either side.

Fix gaps before the renewal date, not after a claim. Ask for the reports early enough to close what they show. Changing providers close to a renewal? The MSP onboarding checklist covers what a new provider should have in place first.

The five buyer signals, applied to insurance evidence

Use the same five signals you would use to compare any MSP:

• Response time during an incident. Who answers at 2 a.m. on a holiday weekend, how fast, and does the contract say so, not just the proposal?
• Ticket tracking for evidence requests. A request for the MFA report is a ticket, logged and dated like any other.
• Proactive monitoring. Who reviews endpoint alerts, how fast, and what happens to an alert at night. If your application asks about monitoring, this is your answer.
• Experience with clients who carry cyber insurance. Asked, not assumed: "Have you helped a client our size answer a renewal questionnaire, and which reports did you produce for it?"
• Security posture evidence. The evidence pack above, delivered without chasing, plus MFA on the provider's own remote tools.

Red flags when an MSP helps with your application

• "Just tick yes." Advice to answer a question you cannot prove puts your signature on the risk.
• An answer with no report behind it. If the MSP cannot show the report, you cannot either.
• Backups that have never been restore-tested. If nobody can give you the date of the last successful restore, the backup answer is not a yes yet.
• The MSP's own remote tools without MFA. Its access can reach every system it manages.
• A promise instead of evidence. "We'll get you covered" or "we are insurance compliant" in place of reports. No MSP decides whether a carrier offers you a policy; the carrier does.

Your cyber insurance application may be the most honest security review your business signs all year. Judge an MSP on whether it can hand you the evidence behind every "yes", not on whether it promises you will be covered. Write that duty into the contract: which reports, how often and how fast. Our guide to MSP contract red flags covers the rest.

What to ask an MSP before your renewal

1. "Can you pull an MFA coverage report for every account, including admin logins and the backup console?"
2. "Is what you deploy on our devices antivirus or EDR, who reviews its alerts after hours, and can we see the deployment report?"
3. "When did you last restore our data in a test, what did you restore, and where is the log?"
4. "How do your technicians sign in to our systems, and is that protected by MFA?"
5. "What is your role in our incident response plan?"
6. "If we ask for these reports before renewal, how fast can you deliver them, and is that in the contract?"

As with any provider, ask how you leave before you sign: who holds the backups, the admin credentials and the reports if the contract ends. Our list of questions to ask before hiring an MSP covers the wider evaluation.

Compare providers, then ask for the reports

Compare managed cybersecurity providers in your state, then ask each one for the reports your insurer will want to see. The cybersecurity provider directory links every state; for backup alone, see the backup and disaster recovery directory. Earlier in the process? Start with the MSP buyer's guide.

Frequently asked questions

Does my MSP fill out our cyber insurance application?

No. The business signs the application, so the answers are yours. Your MSP's job is to supply the evidence: MFA coverage, endpoint deployment, backup and restore-test records, patch status and a written description of its own access to your systems. Go through the technical questions with the MSP, get the report behind each answer, and answer only what those reports show. If the MSP offers to fill it in for you, read every answer before you sign.

What happens if an answer on the application turns out to be wrong?

That depends on your policy and the facts, so ask your agent or broker how your policy treats inaccurate answers. One documented case: as Insurance Journal reported, the application International Control Services signed said it used MFA for administrative or privileged access, and Travelers alleged that ICS used MFA only to protect its firewall. In 2022 the two sides agreed to have a federal court rescind the policy, leaving no coverage under it. The safer course is to answer only what you can prove and to disclose gaps accurately.

Is antivirus enough, or do insurers want EDR?

Read the exact wording of the question on your own application, because each carrier writes its own: one may ask about antivirus, another about endpoint detection and response (EDR), another about round-the-clock monitoring of alerts. Then ask your MSP what it actually deploys, whether that is antivirus or EDR, and for the deployment report that shows which devices have it. If the wording is unclear, ask your agent what the carrier means before you answer.

Does cyber insurance cover ransomware?

Policies differ, so check your policy wording and its exclusions with your agent. The FTC lists cyber extortion and fraud among the costs first-party cyber coverage can include, along with forensic services and lost income from business interruption. Whether a policy pays for a given ransomware incident depends on its terms, and on the answers you gave on the application.

What should we do if we cannot answer yes to a control?

Do not guess, and do not round up. Answer accurately, ask your agent how to disclose a control that is only partly in place (for example, MFA on every account except two shared logins), and fix the gap before the renewal date rather than after a claim. Ask your MSP for a dated plan to close it, and keep the report that shows it closed.

Do cyber insurance applications ask about our IT provider?

They can. A question about third-party or vendor remote access covers your MSP, whose technicians can sign in to your systems. Ask the MSP to describe in writing how its technicians sign in: MFA on its remote tools, a named account for each technician, and access logs it can show you. If your application asks about vendor access, that written answer is part of yours.