Cyber Insurance Requirements Checklist for Small Businesses
MFA, EDR, isolated backups, patching, training and an incident plan are common underwriting questions. Evidence matters as much as checking yes.
- Expect questions about MFA, EDR, backups, patching, email security, training and incident response.
- A “yes” must match the actual technical scope and evidence.
- Do not guess on the application; a false answer can become a coverage dispute.
Cyber insurance underwriting has become a security-control review. The carrier wants to know whether common ransomware and business-email-compromise paths are reduced, and whether the company can recover without an open-ended loss.
The core readiness checklist
| Control | Evidence to prepare |
|---|---|
| MFA | Policy and identity-provider export showing covered users |
| Endpoint protection/EDR | Device inventory and active-agent report |
| Backups | Frequency, isolation, retention and last restore result |
| Patching | Policy plus current overdue-vulnerability report |
| Email security | SPF, DKIM, DMARC and anti-phishing controls |
| Training | Completion report and phishing-test record |
| Incident response | Named contacts, insurer hotline and tabletop date |
| Privileged access | Admin list, MFA and separate admin accounts |
MFA scope is the first trap
“We use MFA” can mean only the owner uses it. Applications may ask about remote access, email, cloud administration, privileged accounts and backup systems separately. Export the actual enrollment state and close dormant accounts before answering.
A backup must survive the same incident
An attached backup writable by the same administrator may be encrypted or deleted with production. Record which copy is offline or immutable, which account can delete it and when a complete restore was last timed.
EDR is not the same as installed antivirus
Underwriters may ask specifically for EDR and sometimes managed response. Provide the product name, device coverage and monitoring owner. An inactive agent on half the fleet is not a defensible yes.
Build an application evidence folder
- Current network, device and user inventory
- MFA and endpoint coverage exports
- Backup and restore report
- Patch and vulnerability summary
- Incident response plan and vendor contacts
- Training completion report
- Previous incidents and remediation records
The decision
Treat the insurance form as an attestation, not a sales questionnaire. Assign every yes to an owner and evidence file. Ask the broker or carrier to clarify ambiguous scope in writing before submission.