Cyber Insurance Requirements: What Insurers Ask For in 2026

To buy cyber insurance, a small business is commonly asked to show it has multi-factor authentication, tested backups, up-to-date software, endpoint protection, and staff training. Requirements differ by insurer, and your answers on the application become part of the policy.

The short version:

Multi-factor authentication (MFA) on email and remote access is the control insurers ask about most.
Missing controls can mean a higher price, a lower limit, or a declined application.
Answer accurately. A wrong answer can give the insurer grounds to deny a claim later.
Most of these controls are low-cost and worth having with or without insurance.

This is general information, not insurance advice. Each carrier sets its own requirements, so ask a broker what the insurers you are considering want.

Blue Ethernet cables plugged into a network switch

Why insurers ask at all

An insurer prices the chance that you will have a loss. The controls below are the ones that stop the most common attacks, phishing, stolen passwords, and ransomware, or that limit the damage. A business without them is a worse risk, so the insurer charges more, offers less, or declines.

The application is also a legal document. What you state on it is what the insurer relied on in agreeing to cover you.

The controls insurers commonly ask about

Control	What it means	Why insurers care
Multi-factor authentication	A second step, such as an app code, on top of a password	Stops most attacks that rely on stolen passwords
Backups	Regular copies of your data, with one kept offline or unchangeable, and tested	Lets you recover from ransomware without paying
Patching	Installing security updates promptly, especially on internet-facing systems	Closes the holes attackers scan for
Endpoint protection	Modern antivirus or EDR on every company device	Detects and blocks malware
Email security	Filtering for phishing and malicious attachments	Phishing is how most incidents start
Staff training	Teaching employees to recognise phishing and report it	People are the usual way in
Incident response plan	A written plan for who does what in a breach	Faster response means a smaller loss
Access control	Limiting admin rights and removing accounts of people who leave	Limits how far an attacker can get

For MFA, insurers usually want it on email, on remote access such as VPN, and on administrator accounts. Having it on some accounts and not others is a common reason for a problem at claim time.

What happens if you do not meet them

It depends on the insurer and on which control is missing. Possible outcomes:

the application is declined;
cover is offered at a higher premium;
a specific coverage, often ransomware, is capped with a low sublimit or excluded;
cover is offered on condition that you put the control in place within a set period.

A broker can tell you which carriers are stricter and which controls matter most for a business like yours.

Answer the application accurately

This is the most important point in the guide. If you state that MFA is enforced for every user and an investigation after a breach shows it was not, the insurer may have grounds to deny the claim or rescind the policy.

Have the person who actually manages your IT answer the technical questions.
If a control is partly in place, say so. Do not round up.
Keep evidence: screenshots of settings, backup test results, training records.
Tell the insurer if something material changes during the policy.

What a policy should cover

Meeting the requirements gets you a policy; it does not tell you whether the policy is good. The Federal Trade Commission suggests checking that a policy covers data breaches, attacks on your data held by vendors, and attacks anywhere in the world, and whether the insurer will defend you in a lawsuit or regulatory investigation. Our guide to what cyber insurance covers goes through coverages, exclusions, and sublimits.

If you are starting from nothing

A sensible order, cheapest and most effective first:

Turn on MFA for email and any remote access.
Set up automatic backups, keep one copy offline, and test a restore.
Turn on automatic updates everywhere.
Install endpoint protection on every device.
Run a short phishing awareness session and write a one-page incident plan.

The federal StopRansomware site has free guidance for small organisations.

Frequently asked questions

Is MFA required for cyber insurance?

Many insurers require it, at least on email and remote access, and nearly all ask about it. Without it you may be declined or offered reduced cover.

Can I get cyber insurance without these controls?

Sometimes, usually at a higher price, with lower limits, or with ransomware cover restricted. It varies by carrier.

Will meeting the requirements lower my premium?

Often. Insurers price on risk, and strong controls are a rating factor with many carriers. Ask your broker which improvements would change your quote.

What if I answer an application question wrongly by mistake?

An honest mistake is treated differently from a deliberate one, but a material inaccuracy can still affect a claim. Correct it with the insurer as soon as you find it.

Do these requirements apply to very small businesses?

Yes. Applications for small businesses are shorter, but they ask about the same core controls.

Where to go from here

Read the main guide to cyber insurance for small business and the cyber insurance coverage checklist, or see all the business insurance guides. Arhox is an independent publication, not an insurer or broker; our editorial policy and disclaimer explain how these guides are prepared.