Cybersecurity Insurance is Changing: 5 IT Requirements You Must Meet to Get Covered

You call your insurance broker to renew your cyber liability policy. The underwriter comes back with one of three responses that are becoming increasingly common: your premium has doubled, your application has been denied outright, or your coverage has been issued—but with a long list of exclusions that essentially voids the policy the moment you actually need it.

This is not a hypothetical scenario. It is happening to small and mid-sized businesses across the country right now, and the businesses it happens to are almost always caught completely off guard.

The rules of cyber insurance have fundamentally changed. Carriers have paid out enormous claims over the past four years—Colonial Pipeline, the Kaseya VSA attack, Change Healthcare—and they have recalibrated accordingly. The era of simply filling out a questionnaire and receiving coverage is over. Today, underwriters are asking specific, technical questions and verifying the answers. If your IT environment doesn't meet a growing list of baseline security controls, you either don't get covered or you pay dramatically more for far less protection.

Here is exactly what they are requiring—and what you need to do before your next renewal.

Why Cyber Insurers Changed Their Standards

The numbers tell the story.

• Cyber insurance premiums increased an average of 79% in 2021 alone, according to the Council of Insurance Agents and Brokers, followed by continued increases through 2023.
• Insurers paid out more in cyber claims in 2020–2022 than in all prior years combined.
• Ransomware attacks—the dominant driver of cyber claims—increased 105% in 2021 compared to the previous year, per FortiGuard Labs.

Carriers responded the way any rational business would: they tightened underwriting standards and began requiring proof of specific security controls before offering coverage. Many now conduct active technical scans of your external attack surface as part of the application process. They are not taking your word for it.

The result is a two-tier market: businesses with documented, verifiable security controls can still obtain reasonable coverage at reasonable rates. Businesses without them are either uninsurable or paying rates that make the coverage economically questionable.

The 5 Controls Underwriters Are Now Requiring

These are not aspirational best practices. These are the specific, checklist-level requirements that leading carriers—including Chubb, Coalition, Travelers, and AXA XL—are applying to applications. If you cannot document compliance with these five controls, expect problems at your next renewal.

1. Multi-Factor Authentication (MFA) on All Critical Systems

This is the single most scrutinized item on any cyber insurance application, and it is where the most claims have been denied post-incident.

MFA is no longer optional on any of the following systems:

• Microsoft 365 / Google Workspace — Your email and cloud productivity suite
• VPN and remote access tools — Any system that allows employees to connect remotely
• Administrative accounts — Domain admin, server admin, and cloud console access
• Financial and banking portals — ACH transfer systems, payroll platforms, accounting software

Underwriters are no longer just asking "Do you use MFA?" They are asking which systems it is applied to, whether it is enforced (not just available), and whether there are any admin bypass exceptions. If your answer is "yes, we have MFA, but our CEO has an exception because she finds it inconvenient," that exception is a material fact that can void a claim.

What you need: Enforced MFA with no exceptions across all remote access, email, and privileged accounts. In Microsoft 365, this means Conditional Access policies—not just enabling the MFA option and hoping users turn it on.

2. Endpoint Detection and Response (EDR) on All Endpoints

Traditional antivirus software—the kind that checks files against a database of known malware signatures—is no longer considered adequate by most underwriters. The signature-based approach has a fatal flaw: it only catches threats that have been seen before. Modern ransomware variants are updated continuously specifically to evade signature databases.

Endpoint Detection and Response (EDR) tools operate fundamentally differently. They monitor the behavior of processes running on your endpoints in real time. Rather than asking "does this file match a known threat?" they ask "is this process doing something that looks like ransomware?"—encrypting large numbers of files rapidly, attempting to delete shadow copies, reaching out to command-and-control servers.

Major underwriters now explicitly ask whether you have EDR deployed, which vendor's product you are using, and whether it is actively monitored or simply installed and forgotten.

The distinction between "installed" and "actively monitored" matters enormously. An EDR tool that generates an alert at 2:00 a.m. that nobody sees until 9:00 a.m. is providing false assurance. Managed EDR—where a security team receives and acts on alerts 24/7—is what carriers are increasingly looking for.

What you need: An enterprise-grade EDR solution such as SentinelOne, CrowdStrike Falcon, or Microsoft Defender for Endpoint deployed on every company-owned device, with active alert monitoring. At eSmith IT, SentinelOne with 24/7 managed alert response is included in our Managed IT plans.

3. Immutable, Tested Backups with Offline or Air-Gapped Copies

The backup requirement has become significantly more specific and more technical over the past two years. The days of checking "yes, we back up our data" and moving on are gone.

Underwriters now want to know:

• Are backups immutable? Ransomware specifically targets backup systems. An immutable backup is one that cannot be modified, overwritten, or deleted—even by someone with administrative credentials—for a defined retention period.
• Are backups stored offline or in a separate cloud tenant? If your backup system is connected to the same network as your production environment with the same credentials, ransomware can encrypt your backups alongside your primary data. This has happened to thousands of businesses who thought they were protected.
• Are backups tested regularly? A backup system that has never been tested is not a backup—it's an assumption. Underwriters want to see documented restore testing, ideally quarterly.
• What is the Recovery Time Objective (RTO)? How long would it actually take to restore operations from your backup? If the honest answer is "weeks," that represents an unquantified liability.

What you need: Immutable cloud backup stored in a separate tenant from your production environment, with documented quarterly restore testing and a Recovery Point Objective (RPO) and RTO that your business can actually survive.

4. Privileged Access Management and Least-Privilege Principles

This requirement is newer to most small business applications but is now standard in underwriting questionnaires from sophisticated carriers.

The principle of least privilege means that every user account—human or automated—has access only to the specific systems and data it needs to perform its function, and nothing more. It sounds basic, but the reality in most small businesses is that a significant number of employees have domain administrator privileges or access to systems they haven't touched in years, simply because it was easier to grant broad access than to configure granular permissions.

Privileged Access Management (PAM) extends this further by controlling, monitoring, and auditing the use of administrative credentials specifically. Key controls include:

• No shared administrative accounts — Every admin action should be attributable to a specific named individual
• Just-in-time privilege elevation — Admin rights granted only when needed and automatically revoked after a defined period
• Privileged session monitoring — Recording and auditing what admins do with their elevated access
• Disabled or renamed default admin accounts — The built-in "Administrator" account on Windows is a constant brute-force target

What you need: A documented access management policy with least-privilege principles applied and evidence that you review and revoke unnecessary access on a regular basis (at minimum, annually, and immediately upon employee termination).

5. Security Awareness Training with Phishing Simulation

The human element remains the most exploited attack vector in cybersecurity. 91% of all cyberattacks begin with a phishing email, according to Deloitte. Underwriters know this, and they have responded by requiring evidence of ongoing employee training—not a one-time onboarding exercise.

The key word is ongoing. A training video shown to new employees during their first week does not satisfy this requirement. What underwriters are looking for:

• Recurring security awareness training delivered at least quarterly to all employees
• Simulated phishing campaigns — fake phishing emails sent to your employees to test their vigilance, with results tracked over time
• Measurable improvement — the ability to show that your click rate on phishing simulations has decreased over time as a result of training

The most effective programs combine automated training modules with simulated phishing attacks that mimic real-world lures—fake DocuSign requests, PayPal invoice alerts, CEO impersonation emails requesting wire transfers. When an employee clicks, they receive immediate remedial training. The result is a feedback loop that builds genuine behavioral change, not just checkbox compliance.

What you need: A documented, recurring security awareness training program with phishing simulation, run at minimum quarterly. Many managed IT providers—including eSmith IT—include this as part of a comprehensive managed security offering.

What Happens If You Can't Document These Controls

If your IT environment does not meet these requirements at renewal time, you face several outcomes, none of them good:

1. Policy denial — The carrier simply declines to offer coverage.
2. Coverage exclusions — You receive a policy, but ransomware events are explicitly excluded, which is precisely the claim you are most likely to ever file.
3. Premium surcharges — You receive coverage at a significantly elevated premium that reflects the carrier's view of your elevated risk.
4. Claim denial post-incident — You have a policy, an incident occurs, and the carrier denies the claim on the grounds that you represented your security posture inaccurately on the application—or that you failed to maintain the controls you claimed to have.

That last scenario is particularly devastating. Businesses that believed they were insured, paid premiums for years, suffered an attack, and then discovered that their claim would not be paid are left with both the recovery costs and the loss of the premiums they paid.

What to Do Before Your Next Renewal

If your cyber insurance renews in the next six to twelve months, the time to act is now—not the week before renewal.

Step 1: Conduct an honest audit. Go through each of the five controls above and assess your actual current state, not your aspirational state. Be specific: which systems have MFA enforced? Which endpoints have EDR installed? When was your last documented backup restore test?

Step 2: Close the gaps systematically. Prioritize MFA first—it is the single most impactful control and the one most likely to prevent an incident from occurring. Then address EDR, backups, and access management in parallel.

Step 3: Document everything. Underwriters want evidence, not assertions. Keep records of your security training completion rates, your backup test results, your MFA enforcement policies, and your EDR deployment. This documentation is what you present at renewal.

Step 4: Engage a managed security provider. If building and documenting these controls internally is beyond your team's current capacity, a managed IT provider that specializes in security can implement and document all five requirements on your behalf—often at a cost significantly lower than your next premium increase.

eSmith IT Helps Charlotte-Area Businesses Meet Insurance Requirements

We work with small and mid-sized businesses throughout the greater Charlotte area—from Huntersville and Cornelius to Gastonia and Concord—to build the documented security programs that cyber insurance underwriters are requiring.

Our managed plans include MFA enforcement, SentinelOne EDR with 24/7 monitoring, immutable backup with Axcient, recurring phishing simulation and security awareness training, and quarterly business reviews where we document your security posture in the format insurers are looking for.

If you have an upcoming renewal or have already received an unfavorable response from an underwriter, contact eSmith IT for a free cybersecurity assessment. We will walk through your current environment, identify gaps against current underwriting standards, and give you a clear roadmap to coverage.

Cyber insurance is still worth having—but only if you can actually collect when you need it.