Cyber Insurance Requirements | What Insurers Demand

What Are Cyber Insurance Requirements?

Cyber insurance requirements are the conditions a business must meet to obtain, keep, or make a claim under a cyber policy. They fall into three groups: security controls an insurer demands during underwriting, obligations set by laws or regulators, and insurance minimums written into customer or vendor contracts. Each has a different source and a different consequence if missed.

Three Layers: Legal, Contractual, and Underwriting Requirements

Underwriting requirements are the ones most businesses mean when they search this topic. They come from the insurer, not from any law. Before quoting or renewing, the carrier asks what controls you run, such as multi-factor authentication, endpoint detection, backups, and patching, and prices or declines the risk based on your answers. Miss one and the usual outcome is a higher premium, a sublimit, or a refusal, not a legal penalty.

Legal requirements come from regulators and data protection laws. In most jurisdictions these rarely require you to buy a policy. They require you to protect data, report incidents, and in some sectors prove that your security program is adequate. That distinction matters, because regulators set a floor for security practice while insurers set a separate floor for insurability. Passing a compliance audit does not guarantee you will pass underwriting, and the reverse is also true.

Contractual requirements come from the other side of a deal. A bank, enterprise customer, or government buyer may require suppliers to carry cyber insurance at a stated limit and to show proof of coverage before signing or renewing a contract. These terms are negotiated, so they vary widely and are rarely visible until a procurement questionnaire arrives.

A single company can face all three at once. A fintech vendor, for example, may need to satisfy its insurer’s control questionnaire, its regulator’s security rules, and a bank client’s minimum coverage clause, each with its own evidence and its own deadline.

Requirements vs Coverage: Why They Are Different Questions

Requirements ask what you must do and prove. Coverage asks what the policy pays for. People often confuse the two because both appear in the same policy documents and broker conversations, but they answer opposite questions.

Requirements are about your side of the bargain: the controls you maintain, the answers you attest to, and the evidence you can produce. Coverage is about the insurer’s side: which costs it will pay after an incident, up to what limits, and under what exclusions. Deciding how much coverage to buy and what it should include is a separate purchasing decision.

The two do intersect in one important place. Some policies tie payouts to the controls you declared, so a control you said was in place but was not can reduce or void a claim. Treat the application as a statement of fact about your security program. If an answer is only mostly true, correct it before you sign, not after an incident.

Is Cyber Insurance Legally Required?

For most businesses, no. No U.S. state requires general businesses to carry cyber liability insurance, and the same pattern holds across most major cyber regimes: the law requires you to protect data and report incidents, not to buy a policy. The exceptions are narrow, and the most notable ones in the Gulf apply to licensed crypto firms.

Usually No, but Regulators Expect Risk Management

Cyber laws and regulations focus on security programs, not insurance purchases. HIPAA does not require a covered entity to buy cyber insurance. New York’s financial cybersecurity rule is the example most often misread as a mandate. It requires covered financial and insurance entities to maintain a cybersecurity program, but it does not require them to purchase a policy.

The distinction matters in practice. A regulator expects documented controls, incident reporting, and accountability. An insurer expects its own proof of controls before it will quote. Treat these as two separate checks, because passing one does not settle the other.

Sector Rules That Push Toward Coverage (Healthcare, Finance, Crypto)

Healthcare and finance are heavily regulated for cybersecurity, but the verified rules in both sectors target controls, not coverage. Their pull toward insurance is indirect: a breach in a regulated sector brings notification duties, regulatory scrutiny, and costs that a policy can offset.

Crypto is where a real insurance mandate appears. Dubai’s VARA Company Rulebook requires licensed virtual asset service providers to hold professional indemnity insurance, directors’ and officers’ insurance, and commercial crime insurance or similar cover for virtual assets in hot wallets, placed with a regulated insurer. That is mandatory insurance, but it is not a standalone cyber policy. Clyde & Co’s 2026 analysis treats cyber insurance as a voluntary addition alongside these statutory lines. A VASP can therefore be fully compliant on insurance and still choose to buy cyber cover separately.

GCC and UAE Perspective, Then Global Outlook

In the UAE, cyber insurance is not universally mandatory, though particular contracts, regulated sectors, or business partners may require cover or specific controls. Clyde & Co also notes that the DFSA in the DIFC does not mandate insurance and that VARA is currently the only regime under which licensed firms must maintain mandatory insurance. The Central Bank also applies cyber obligations to banks and insurers, but as security expectations: its 2024 circular directs licensed financial institutions to target full compliance with the UAE Information Assurance Regulation. In Saudi Arabia, the SAMA Cyber Security Framework sets mandatory controls for regulated financial institutions, again as a security baseline.

Some broker articles claim the UAE will mandate cyber insurance for financial and e-commerce firms from January 2027. I could not trace that claim to a regulator or primary source, so confirm any such rule with the Central Bank or your sector regulator before relying on it.

Globally, expect the same split. Governments regulate security practice, while insurers and customers decide who is insurable. For most companies, the practical pressure to insure comes from contracts and lenders, not statutes.

Security Controls Insurers Require Before Quoting or Renewing

Most cyber insurers expect multi-factor authentication, endpoint detection and response, isolated and tested backups, a defined patching process, and a documented incident response plan before quoting or renewing. Carriers differ, but these controls recur across applications, and they mirror how breaches begin. Verizon’s 2026 DBIR found vulnerability exploitation accounted for 31% of initial access, while credential abuse fell to 13%, and phishing was the entry point in 16% of breaches.

Comparison Table: Control, What Insurers Ask, Evidence They Want

Across 2026 underwriting guidance, the consistent baseline is MFA, near-complete EDR coverage, tested backups isolated from production credentials, privileged access controls, and a described patching cadence. The table translates that baseline into what you will be asked and what to have ready. Treat it as typical, not universal, because questionnaires vary by carrier.

Multi-Factor Authentication (Email, Remote Access, Privileged and Cloud Admin Accounts)

Insurers want to see MFA on remote access, privileged accounts, and cloud email. No universal rule requires MFA to obtain cyber insurance, but it has become standard in underwriting.

Scope is where applications go wrong. One IT provider reports that the most common gap in post-claim audits is MFA enabled for Microsoft 365 but not enforced on VPN or RDP, so the email answer looks clean while the real entry point stays open. Underwriters also ask about administrative consoles for cloud services, security tools, and IT management platforms. For evidence, prepare a list of systems where MFA is enforced, including email, cloud apps, remote access, and admin accounts, plus any documented exceptions. Method matters too. Some insurers may still accept SMS codes for limited uses, but expectations are moving toward phishing-resistant methods.

EDR/MDR: Why Antivirus Alone No Longer Qualifies

Basic antivirus typically answers “no” to an EDR question. Insurers distinguish signature-based antivirus from behavioral EDR, which gives visibility into process activity, network connections, and lateral movement.

Having the tool is not enough. Applications may ask whether EDR is deployed to 100% of devices, who responds to alerts, and how quickly. A partial rollout is a common weak point, since underwriters look for genuine coverage rather than a partial deployment. Some carriers go further: EDR on every endpoint and server is the floor, and carriers increasingly ask for 24/7 monitored response, which is MDR. If you have no in-house team watching alerts, an MDR service is often the cleanest answer to the “who responds” question.

Backups: Offline or Immutable Copies and Restore Testing

A backup that ransomware can reach does not protect you or satisfy an underwriter. The standard is backup data that ransomware cannot encrypt, even if it compromises domain admin credentials. That matters because ransomware campaigns increasingly target backup infrastructure.

In practice, many insurers now expect a 3-2-1-1 model: three copies, two media types, one offsite, and one immutable or air-gapped. Testing counts as much as architecture. Most carriers now ask for the date of your last successful restore test. Accuracy matters, too. If you claimed immutable backups at underwriting but did not implement them properly, a ransomware claim may be challenged or denied.

Patching and Vulnerability Management Cadence

Insurers want a defined timeframe, not a promise to patch quickly. Some applications ask whether critical patches are applied within a defined timeframe. No single cadence is universal. One broker checklist lists patching non-critical vulnerabilities within 30 days, scanning at least quarterly, and protecting unpatchable or end-of-life systems through segmentation, while other guidance expects more frequent scanning.

The stakes extend past the application. “Neglected software exploit” endorsements tie coverage directly to how quickly policyholders remediate known vulnerabilities. Unsupported software draws particular attention: Coalition’s 2023 claims report found that organizations running end-of-life software were three times more likely to suffer an incident.

Email Security, Privileged Access, Logging, Incident Response Plan, and Awareness Training

Beyond the headline controls, insurers commonly ask about email filtering and anti-phishing, privileged access management, network segmentation, security awareness training, and incident response and business continuity plans. On privileged access, underwriters look for separation of administrative and standard accounts, so admins do not use privileged credentials for email and web browsing. On logging, an analysis of Marsh’s cyber report notes that logging and monitoring is one of twelve control groups the report scores.

A response plan has to be usable, not just present: carriers want one that is documented, tested, and verifiable. The same applies to training. Insurers want proof of regular phishing simulations and tracked results, and owning a training platform is not enough.

How Cyber Insurance Underwriting Works

Cyber insurance underwriting is how a carrier decides whether to cover you and on what terms. You complete a security application, the insurer tests your answers against outside data such as external scans, and it then prices the policy or declines it based on what it finds. Because the application functions as a security audit, accuracy matters as much as the controls themselves.

Applications, Questionnaires, and External Attack Surface Scans

A cyber application asks for more than revenue and industry. Quoting typically requires revenue data, a classification of the data you hold, an inventory of your security controls, and any prior incident history. The questions themselves get technical, covering firewalls, backups, and MFA, because insurers use them to judge how well your defenses would hold up, not just how big you are.

Carriers no longer rely on the form alone. More underwriters run security scans during the application process, and some pre-screen accounts against external data before an application is even submitted. These scans look at internet-facing assets for exposed services, known vulnerabilities, and misconfigurations, and underwriters have declined to quote or required remediation before binding based on scan results alone. Gallagher Re’s analysis found that external scanning data is particularly useful for identifying the top 20% of risks.

The scans have limits. They offer a surface-level, external-only view, not a look inside your network, and insurers can respond very differently to the same findings. For larger accounts, a supplemental security summary may accompany the questionnaire, explaining control implementations and how any past incident was remediated. A penetration test report is another form of proof some applications ask for, and a report whose scope does not match what the application describes tends to raise questions.

Why Inaccurate Answers Can Void a Claim

An inaccurate application can cost you the policy itself, not just a single claim. The clearest example is Travelers v. International Control Services. ICS applied for a $1 million cyber policy and stated, in an application signed by its CEO and the person responsible for network security, that it used MFA for administrative or privileged access. After a ransomware attack in May 2022, Travelers said it discovered that ICS used MFA only to protect its firewall, and not its servers or other digital assets. Travelers sued to rescind the policy, which would void it from the start. The parties agreed to rescission, and the court entered judgment on August 30, 2022.

The case was resolved by agreement, so it is not a ruling on the merits, but it shows how carriers use the application after a loss. Lockton has seen cyber insurers increasingly raise misrepresentation and concealment issues over incorrect application answers. Some policyholder lawyers call this “post-loss underwriting”: searching for inaccurate answers after a claim, even innocent ones, and even ones unrelated to the loss.

Leaving a question blank is not necessarily safe either. In one federal case, a court let an insurer’s rescission counterclaim proceed where the insured had not answered a question at all, reasoning that incomplete answers and failures to disclose can be misrepresentations. The insurer still has to prove its allegations.

The legal standard differs by jurisdiction. In some places an insurer can rescind over a material misrepresentation even if it was an honest mistake. Massachusetts, for example, requires intent to deceive or an increased risk of loss. Treat every answer as a statement of fact, have the person who runs security review it, and get legal advice for high-stakes applications.

Why Premiums and Requirements Vary Between Carriers

No single rulebook governs cyber insurance. Requirements and pricing vary by carrier, revenue, industry, policy limits, claims history, and data exposure, and each carrier weights those factors differently. Larger organizations generally face stricter requirements.

Appetite is the other driver. Each insurer has narrowed down what it is comfortable quoting, and appetite in cyber shifts faster than in most commercial lines: a carrier that wrote healthcare risks aggressively one quarter may pull back after poor loss results. Claims history matters too, and missing MFA or EDR can mean an automatic decline at some carriers.

This also makes quotes hard to compare. Coverage terms differ significantly between carriers, so premium alone is a poor yardstick. Compare retroactive dates, sublimits, and exclusions side by side, and use a broker who works with cyber carriers regularly.

Cyber Insurance Requirements by Business Size

Cyber insurance requirements scale with company size. Small businesses are usually asked to prove a core set of controls, such as MFA, EDR, and tested backups, on a short questionnaire. Mid-size firms face deeper scrutiny and ransomware-specific questions. Enterprises are expected to show evidence of governance and board-level oversight.

Small Business: What Is Realistic and What Insurers Usually Accept

Small businesses are typically underwritten on yes/no attestations, not full audits. Underwriters usually start with questions on MFA, EDR or MDR, and backups, and most small and mid-sized organisations won't face a full-blown audit.

The realistic target is a short list of controls you can document: MFA on email, remote access, and admin accounts; EDR on every endpoint; and immutable offsite backups with a documented, tested restore. Keep the restore-test report, because underwriters accept evidence. Insurers may also ask for training records, such as completion logs. If a gap remains, you may still qualify, but with higher premiums, lower limits, or exclusions for certain breach types. One managed IT provider suggests tackling MFA and backups first because they carry the most underwriting weight, then EDR, patch automation, and email filtering.

Smaller firms are also less likely to be insured. GlobalData’s 2025 UK SME survey found that 13.1% of sole traders, 26.4% of micro firms, and 40.1% of small firms hold cyber insurance. Research from the University of Kent links SME hesitation to limited awareness, cost concerns, and a belief that coverage has little value unless clients or regulators require it. For many small businesses, a customer contract is what first makes the requirements real.

Mid-Size Companies: Where Scrutiny Increases

Scrutiny rises with revenue and policy limits, and ransomware becomes the focus. A Gallagher UK market update, for example, splits the market into SME (£0–50m turnover), mid-market (£51m–£400m), and large (£400m+). For insureds above £50 million in revenue, or those seeking higher limits, it lists a mid-market cyber application and a ransomware application as mandatory, with minimums that include cold storage completely isolated from the network and recovery of all critical data and systems within 10 days. That document is UK-specific and undated, so treat the figures as an illustration of the pattern, not a current rule.

Definitions of “mid-size” also differ. Cowbell, for instance, treats SMEs as up to $100 million in revenue and the middle market as $100 million to $1 billion, while Gallagher’s UK bands differ. Carrier eligibility can shift as you grow too: some UK insurers cap the revenue they will quote, so a growing company may outgrow a carrier’s range. Security advisors also report that privileged access management and network segmentation draw more attention at this size, though that reflects practitioner commentary and not a published carrier standard. Check which band your carrier uses before assuming which questionnaire applies.

Enterprise: Evidence, Governance, and Board Reporting

Enterprises are asked to prove controls and show that governance exists around them. One practitioner describes applications asking for an asset inventory, vendor list, EDR coverage, MFA enforcement, backup architecture, an incident response plan, and tabletop exercise evidence. CISOs often play a direct role, briefing the underwriter on how the company protects the business.

Board involvement matters too. Advisors say cyber insurance posture now features among the questions boards ask, and that boards penalize an approach where the broker handles everything without CISO or CFO involvement. Third-party risk is a recurring theme, too. For public companies, SEC rules require material incident disclosure on Form 8-K within four business days of a materiality determination, so insurance notice terms and incident reporting plans should align.

At this level, the practical task is packaging. Assemble one evidence set covering controls, exercises, vendor oversight, and recovery testing, and make sure the CISO, finance, legal, and the broker all give the underwriter a consistent account.

Cyber Insurance Requirements by Industry

Cyber insurance requirements vary by industry mainly in what insurers probe beyond the standard controls. Inquiries differ by sector: law and real estate firms are questioned on wire-fraud procedures; healthcare organisations on legacy systems and medical devices; financial and crypto firms on custody and fund-transfer controls; and government suppliers on contract-driven security compliance.

Law Firms (Client Data, Trust Accounts, Wire Fraud Exposure)

Law firms are underwritten on client data protection and, above all, trust account wire fraud. Applications now ask about trust account controls, wire transfer verification, and accounting workflow protections, and documented out-of-band verification with dual authorization is a common expectation.

The coverage gap makes these controls matter. Gallagher notes that wire fraud is a crime loss with cyber elements. Most cyber policies exclude or sublimit social engineering and funds transfer fraud because those events involve a human decision, not a system intrusion. Social engineering cover is usually added by endorsement. Cyber coverage is also often first-party, so it may not reach funds held in trust or escrow for clients, and an insurer may deny a claim if the firm skipped required steps such as verifying wire instructions by phone. A Canadian lawyers’ professional liability program shows the pattern: it caps social engineering claims at $250,000 unless firms follow specific steps. Many firms are still uninsured, too. The ABA’s 2023 technology report found only 40% of firms hold a cyber liability policy.

Healthcare (Patient Data and Regulatory Overlap)

Healthcare underwriting centers on proving controls are active today, which is a different test from HIPAA compliance. HIPAA reviews tend to focus on documentation, while insurers verify that controls such as MFA, monitored EDR, immutable backups, and a tested incident response plan are running in your environment. HIPAA does not require you to buy cyber insurance, and a policy does not make you HIPAA compliant.

Legacy clinical systems and medical devices draw particular attention because they are hard to patch and isolate. Where immediate patching is impossible, underwriters look for manufacturer MDS2 forms and Software Bill of Materials records. The February 2024 Change Healthcare attack, which began with stolen credentials on a legacy remote access portal lacking MFA, hardened expectations around remote access. Carriers also look for backups tested for EHR-specific restores and patch exception tracking for medical devices. The stakes are high: IBM’s 2025 report put healthcare breaches at $7.42 million on average and 279 days to identify and contain, five weeks longer than the global average.

Financial Services, Fintech, and Crypto

Most financial regulators require security programs, not insurance. New York’s financial cybersecurity rule, for example, requires a program but not the purchase of a policy. Dubai’s VARA is the notable exception: it requires licensed VASPs to hold professional indemnity, directors’ and officers’, and crime or hot-wallet cover with a regulated insurer. That is a regulatory insurance mandate, separate from a cyber policy.

For crypto firms, underwriters look at custody first. Self-custody versus third-party custody, the hot, warm, and cold wallet split, transaction velocity, and key-ceremony rigour often drive terms. Attention also falls on key management, hot-wallet limits, withdrawal governance, and segregation of duties. Weak withdrawal governance or large hot-wallet exposure can mean higher retentions, sublimits, or exclusions tied to voluntary transfers and social engineering. Because cyber policies usually address systems and data while crime cover addresses funds-transfer fraud and social engineering, crypto programs typically combine cyber, crime, and digital asset endorsements.

Real Estate and Government Suppliers

Real estate firms face wire-fraud scrutiny similar to law firms. The FBI’s IC3 attributed about $2.7 billion in 2024 losses to business email compromise, and real estate transactions are a frequent target because they involve large, time-sensitive wires. Errors and omissions insurance typically does not cover cyber events, and wire-fraud losses may sit under crime or cyber policies. Firms should check that social engineering cover exists and that limits match transaction values. Underwriters expect a written wire-verification protocol, including calling a phone number from the company’s website, not one in an email. Title companies and mortgage lenders that handle nonpublic personal information must also comply with the GLBA Safeguards Rule.

Government suppliers are driven more by contract than by insurers. The verified federal requirements I found concern security controls: DFARS clause 252.204-7012 requires contractors handling controlled unclassified information to meet the 110 NIST SP 800-171 requirements and flow them down to subcontractors, and CMMC Level 2 aligns with the same set. Contractors also cannot award certain subcontracts unless the subcontractor has completed a Basic NIST 800-171 assessment within the last three years. Any cyber insurance minimum comes from the individual contract or prime agreement, so read your clauses. In the Gulf, security frameworks play a similar role: the UAE’s IA standards apply to government and critical sector organisations, and Saudi Arabia’s NCA framework is described as mandatory for government suppliers.

When a Contract Requires Cyber Insurance

A contract requires cyber insurance when a customer, lender, or partner makes coverage a condition of doing business. These clauses usually set a minimum limit, demand proof of coverage, and require notice if the policy changes or lapses. Unlike underwriting standards or laws, contract terms are negotiated, so expectations on coverage, limits, and scope vary widely and you have to read the clause itself.

What Customer and Vendor Agreements Typically Specify

Limits are the first term. Morgan Lewis reports that small-to-medium vendors commonly face limits in the $2–5 million range, while larger vendors or those in high-risk sectors may see demands of $10 million or more. Public-sector templates show the same pattern at the lower end: one university requires $2 million per claim and in the aggregate, and a state agency template sets a $1 million per-occurrence minimum. In practice, enterprise customers and key partners often set your effective floor, regardless of what your risk assessment suggests.

Proof of coverage typically means a certificate of insurance delivered before work begins, often with a copy of the policy declarations and endorsement page, which one public-sector exhibit strongly recommends making a contract requirement. Agreements may also name the buyer as an additional insured, require a minimum insurer rating such as A.M. Best A- VIII or better, and apply the same requirements to subcontractors.

Notification and continuity terms matter more than they look. Cancellation notice periods range from 10 days in some templates to 30 days in others, often with a shorter window for non-payment of premium. Claims-made policies draw extra conditions: the retroactive date must precede the contract date, and if coverage lapses, the vendor must buy extended reporting (“tail”) coverage. Examples include three years and five years after the work ends.

Precision helps both sides. Counsel advise against vague wording such as “maintain cyber insurance,” because cyber policies bundle third-party liability and first-party coverages in different formats. Better clauses name the required coverage types, such as privacy liability, network security liability, and regulatory defence, along with limits and retention.

Vendor Insurance Requirements: What to Ask For and How to Verify

Ask for the specific coverages the vendor’s access to your data justifies, then verify the policy, not just a certificate. Sizing starts with a risk assessment: how much sensitive data the vendor touches, how critical the service is, and what industry norms apply. Marsh notes that requiring cyber coverage may also increase the chance a vendor has been through insurer due diligence, meaning underwriters have evaluated its risks and risk management maturity. That is a helpful signal, not a substitute for your own security review.

A certificate of insurance is not the coverage. The standard ACORD 25 states that it is issued for information only, confers no rights on the certificate holder, and reflects coverage as of the issue date, so policies can lapse or change afterwards. Additional insured status in particular requires a policy endorsement. A statement on the certificate does not create additional insured status. Counsel recommend requesting additional insured endorsements with every certificate, and warn that companies often fail to follow up until a problem arises.

A practical verification routine covers five checks:

1. Collect the certificate, declarations, and endorsement pages.

2. Confirm each coverage line’s policy period separately.

3. Check the retroactive date and tail terms on claims-made policies.

4. Compare limits and retentions against the contract.

5. Diary renewals so proof is refreshed annually.

Finally, don't rely on a vendor’s policy alone. You can require that their coverage respond first, but you should not substitute it for your own.

Backup Requirements and Disaster Recovery Planning

Cyber insurers now expect backups attackers cannot reach and a disaster recovery plan with defined, tested recovery targets. That pushes organisations past “we back up nightly” toward proving how fast they recover, from which copy, and with what evidence. In practice this means isolated or immutable copies, documented recovery time objectives for critical systems, and dated restore tests.

How Insurer Demands Reshape Recovery Objectives and Testing

Ransomware has changed what disaster recovery must assume. Traditional plans assumed hardware failure or accidental deletion, while ransomware assumes a deliberate attempt to destroy your recovery options, especially backups. The data supports the concern: Veeam’s 2025 ransomware report found that 89% of organizations said their backup repositories were attacked, and its 2024 report put the share of attacks targeting repositories at 96%. CISA’s #StopRansomware Guide says to maintain offline, encrypted backups of critical data and regularly test their availability and integrity in a disaster recovery scenario, because many ransomware variants try to find and delete or encrypt accessible backups.

Insurers turn that guidance into questions about recovery targets. A ransomware supplemental from Tata AIG asks applicants whether they prioritize “vital assets” by importance to operations, what the recovery time objective is for those assets, and whether the backup strategy includes offsite, regular backups. A UK broker’s market update lists recovery of all critical data and systems in no more than 10 days as a minimum risk requirement for larger insureds, alongside cold storage completely isolated from the network. That document is undated and UK-specific, so use it as an illustration, not a benchmark.

These expectations affect the plan itself. Shorter recovery time objectives generally require more expensive solutions, such as hot standby or real-time replication, and business interruption waiting periods should align with your RTOs so you don't create a coverage gap. Testing then becomes the proof. Most carriers ask for the date of your last successful restore test, and many also ask whether you exercised the incident response plan in the past 12 months. A written RTO is only credible if it survives a real test: one practitioner notes that a plan can claim a two-hour RTO on paper while the true recovery, covering locating a clean backup, provisioning infrastructure, restoring, and validating, takes six.

Common DR Gaps That Surface During Underwriting

The most common gap is backups that sit too close to production. At renewal, insurers ask whether backups could survive a compromise of the production environment. If they are reachable from the production network or use the same credentials, an attacker with domain admin access can turn them into one more thing to encrypt. Keep backup credentials separate and keep at least one copy offline or isolated.

Unverified recovery is the second gap. Backups that run but are never restored, and jobs that silently fail for weeks, are common failure modes. A restore test also needs to cover cleanliness, because ransomware operators may compromise backup infrastructure during the quiet period before encryption, so a restore point can carry the attacker’s tooling back into production. Scanning restore points for malware before recovery addresses that.

Coverage gaps are the third. Environments change, new workloads get missed, and teams assume the cloud provider handles all recovery. SaaS providers such as Microsoft operate on a shared responsibility model, backing up their infrastructure to maintain uptime, not to restore your data on your timeline. Providers of SaaS backup tools say insurers increasingly ask whether SaaS data is protected independently, though that claim comes from vendors.

Finally, many organizations have no defined priorities. Without a list of vital assets and a stated RTO for each, a recovery plan cannot answer the underwriter’s first question, and the incident response plan often exists on paper without an exercise or after-action report behind it.

Struggling to Meet Patching or Other Requirements?

If you cannot fully meet an insurer’s patching or other requirements, you generally have three honest options: close the gap before you apply, wrap documented compensating controls around what you cannot fix, or disclose the gap with a remediation plan and let the carrier decide. A shortfall does not always mean a decline. You may still qualify with higher premiums, lower limits, or exclusions for certain breach types, and some carriers will bind coverage with a remediation commitment attached as a policy condition.

Compensating Controls Insurers May Accept

The most widely used compensating control is segmentation. A cyber hygiene checklist from broker Brown & Brown lists protecting unpatchable and end-of-life systems, for example through segmentation, among its recommended practices. The logic is simple: patching asks whether the flaw is closed, while segmentation asks what the device can reach if the flaw stays open.

Other controls commonly paired with it include allow-listed access, EDR monitoring, increased logging on the affected server, and virtual patching when no vendor patch exists. Virtual patching reduces risk immediately while a patch cycle is scheduled, and it works on end-of-life systems. The same approach applies to other gaps. Legacy systems often cannot support modern MFA, logging, or patching, so restricting who can reach them and recording privileged activity becomes the practical substitute. For partial EDR coverage, state the percentage of endpoints covered along with your remediation plan. A written plan is not a deployed control, but it shows intent and reduces underwriter uncertainty.

Two cautions apply. First, acceptance is carrier-specific, and I found no insurer-published list of approved compensating controls. A specialist broker can tell you which gaps to remediate before submission and which are acceptable with honest disclosure. Second, compensating controls are temporary by design. They are a bridge to replacement or remediation, not a permanent substitute for patching systems that can be patched.

Documenting Exceptions Honestly

Describe the gap as it is. Overstating a control can cost you the policy, as the Travellers case showed when an insured claimed MFA for privileged access but had it only on its firewall. Having the person who manages the system verify each response, identify its scope and exceptions, and disclose any remediation plan is a better approach than presenting a partial rollout as complete. Hiding a legacy server that lacks MFA is a risky shortcut, since cyber insurance rests on utmost good faith.

A usable exception record has seven parts: the affected asset, the exact vulnerability, the business justification, a named risk owner, the compensating control, the approval authority, and an explicit expiry date. A “won’t fix” tag in a spreadsheet is not a process. Risk acceptance is a business decision, not a security team decision, so the system’s business owner and an executive sponsor should sign off, and the acceptance should expire and trigger re-evaluation. Track all such systems in a dedicated register, along with their compensating controls, acceptance status, and replacement timeline. Verify that each compensating control is actually active and not assumed. Findings tied to a vulnerability on CISA’s Known Exploited Vulnerabilities list, on a critical asset, deserve immediate escalation instead of a routine exception.

Keep the evidence an underwriter may ask for: dated vulnerability scan reports, your patch management policy and SLA, and a remediation tracking log. Log unresolved gaps with owners and dates before the underwriting call, and update your broker if a material answer changes mid-term. Underwriters respond better to a security leader who explains a gap and its fix in plain terms than to a broker reading answers off a form.

Cyber Insurance Readiness Checklist

To prepare for cyber insurance underwriting, assign an owner, verify each control with evidence, close or document every gap, and submit accurate answers through a specialist broker. One advisory guide suggests building a prioritised gap list about 90 days before renewal, running a remediation sprint 60 to 30 days out, and assembling an evidence package for each control before submission.

1. Assign an owner and treat the application as an audit. Name one person to run the process, gather evidence for every answer, and have the people who operate each control validate the responses. Log any unresolved gaps in your risk register with owners and remediation dates before the underwriting call.

2. Get the questionnaire and your contract requirements early. Ask your broker for the current application so you can see the questions before the deadline. Also review customer and vendor contracts, since many mandate specific cyber liability levels, notice terms, and proof of coverage.

3. Verify MFA is enforced, not just available. Log into each remote access system, cloud console, and privileged account interface and confirm enforcement. Cover email, VPN or RDP, admin consoles, and service accounts, and list any exceptions. Partial deployment is the most common source of inaccurate answers.

4. Confirm EDR coverage and response. Measure what share of endpoints and servers actually run EDR, and be ready to say who responds to alerts and how fast. If coverage is below 100%, state the percentage and your remediation plan.

5. Prove your backups. Confirm at least one copy is offline or immutable and unreachable with production credentials. Run a restore test, record the date and result, and document recovery time objectives for your most critical systems.

6. Define your patching cadence. State the timeframe in which you apply critical patches, keep dated scan reports and a remediation log, and maintain a register of unsupported systems with compensating controls such as segmentation.

7. See what the underwriter will see. Run your own external scan or attack surface management before renewal. Carriers increasingly pre-screen applicants against external data, and problems are easier to fix before they appear in a quote.

8. Test your response plan and training. Keep a written incident response plan with assigned roles, run an exercise such as a tabletop within the last 12 months, and name contacts for your response retainer and breach counsel. Keep training completion records and phishing simulation results.

9. Close or document each gap. Fix what you can before submitting. For anything you cannot, record an exception with an owner, compensating control, and expiry date, and disclose it with a remediation plan instead of presenting a partial rollout as complete.

10. Validate, sign, and stay current. Have control operators confirm each answer against evidence such as exports and console screenshots. Signatories should understand what they attest to, as the Travellers case showed. Submit through a broker who specializes in cyber, and update the broker if a material answer changes mid-term.

Common Mistakes That Cause Denials, Higher Premiums, or Rejected Claims

The most common cyber insurance mistakes are overstating controls on the application, assuming a policy covers wire fraud or client funds, and relying on backups or patching processes that were never verified. Most come down to a gap between what the application says and what is actually deployed. Insurers look for that gap after a claim, which is when denials, rescission, and disputes tend to happen.

Overstating a control that is only partly deployed. This is the classic failure. In Travelers v. International Control Services, the insurer alleged the applicant claimed MFA for privileged access when it protected only its firewall, and the policy was rescinded by agreement. A close cousin is MFA on cloud email but not on VPN or RDP, which one IT provider calls the most common gap found in post-claim audits.

Leaving questions blank or answering loosely. Unanswered questions can be treated as misrepresentation. In one federal case, a court let an insurer pursue rescission where the insured had not answered a question at all. Have the person who operates each system verify the answer, define its scope and exceptions, and disclose any remediation plan.

Assuming wire fraud is covered. Most cyber policies exclude or sublimit social engineering and funds transfer fraud because those events involve a human decision, not an intrusion. Cyber coverage is also often first-party, so it may not reach client funds held in trust or escrow. If your policy requires verification steps, such as calling to confirm wire instructions, skipping them can give the insurer grounds to deny the claim.

Claiming backups you have not proven. If you attest to immutable backups but implemented them improperly, a ransomware claim may be challenged or denied. Backups also fail quietly when jobs never get verified, or when copies sit on the same credentials as production. Run and record a restore test.

Letting unsupported or unpatched systems linger. Patch speed is a direct premium lever, and some policies now use endorsements that tie coverage to how quickly you remediate known vulnerabilities. Coalition’s 2023 claims report found that organizations running end-of-life software were three times more likely to suffer an incident. If you cannot patch, document compensating controls and an exception instead of staying silent.

Delaying notice after an incident. Law firms should report suspected wire fraud, breaches, or phishing incidents immediately to preserve coverage. Check your policy’s notice terms and your contract’s notification clauses before you need them.

Leaving the application to the broker, and the renewal to the last week. Brokers cannot verify what is deployed. Underwriters respond better to a security leader who explains a gap and its fix than to second-hand answers, and businesses that review their posture before renewal are better positioned to negotiate premium and cover. Update your broker too when a material answer changes mid-term.

Buying on premium alone. Coverage terms differ significantly between carriers, so the cheapest quote can come with narrower sublimits, exclusions, or retroactive dates. Compare terms side by side.

Conclusion

Cyber insurance requirements are not one rule set. Your insurer decides whether you are insurable, regulators and contracts decide what you must carry. The application is a statement of fact you will be held to after a loss. So start with the controls you can prove, such as MFA, EDR, isolated and tested backups, and a patching process you can describe. Close the gaps you can, document the ones you cannot, and answer every question accurately. If your next renewal or a customer contract is the deadline, run the readiness checklist now, while you still have time to fix what it finds.

Frequently Asked Questions (FAQs)

Does law require cyber insurance?

In most places, no. No U.S. state requires general businesses to carry cyber liability insurance, and HIPAA does not require covered entities to buy it. The exceptions are narrow: Dubai’s VARA requires licensed virtual asset firms to hold specified insurance, and customer or vendor contracts often require coverage even when the law does not.

What are the minimum requirements for a small business?

No universal minimum exists, because carriers set their own. Small business applications typically verify a short list of controls: MFA on email, remote access, and admin accounts, EDR on every endpoint, and immutable offsite backups with a documented, tested restore. Underwriters often start with yes/no attestations, so keep evidence ready. Contracts frequently set limits. Morgan Lewis reports that small-to-medium vendors commonly face $2–5 million requirements from customers.

What if we don’t have EDR?

You may still get coverage, but expect friction. Basic antivirus typically answers “no” to an EDR question, and a business that cannot meet all requirements may still qualify with higher premiums, lower limits, or exclusions for certain breach types. Some carriers go further and cite missing MFA and EDR as reasons to refuse coverage. If EDR covers only part of your environment, state the percentage and your remediation plan, and ask a cyber-specialist broker whether a carrier will bind coverage with a remediation commitment. If you don't have an in-house team to monitor alerts, an MDR service can answer the “who responds” question.

Does a penetration test help with cyber insurance?

It can improve your position, but it doesn't guarantee a discount. No law requires a penetration test to buy cyber insurance, yet carriers do ask. Corvus asks whether you test at least annually, and AXIS asks about testing frequency and whether it is in-house or outsourced. Underwriters read for scope, recency, and whether findings were closed. A mismatch, such as an application describing a SaaS platform while the test covers only the marketing site, raises questions. No standard premium reduction exists, and claims of fixed discounts mostly come from testing vendors.

Does coverage lapse if my controls lapse during the policy period?

It can create a coverage problem. Some cyber forms require insureds to maintain the controls they represented during underwriting, so a control later disabled, bypassed, or allowed to lapse can create a separate issue. This matters especially when you change your IT environment mid-term. In the Columbia Casualty v. Cottage Health dispute, the insurer sought reimbursement of a $4.125 million settlement, alleging the insured failed to continuously implement the controls it described in its application. Read your policy for “failure to maintain” or “minimum required practices” language, ask your broker to narrow it, and tell your broker when a material answer changes.