Your cyber insurance renewal is coming up. And if you haven’t looked at this policy closely in the last 12–18 months, you’re in for a surprise.
The cyber insurance market has fundamentally changed. What used to be a 15-minute questionnaire with vague security questions has become a structured technical audit — one with real consequences. Carriers are denying claims and non-renewing policies based on security gaps that never would have tripped you up a few years ago.
This isn’t about scaring you. It’s about making sure you walk into your renewal fully prepared, not blindsided.
Why Cyber Insurance Got So Much Harder
Carriers got burned. Years of paying claims on incidents that should have been preventable — ransomware hitting companies with no MFA, breaches where no one detected the attacker for weeks — pushed insurers to get specific.
Today, the questions on your application aren’t just informational. They’re contractual. If you answer “yes” to having multi-factor authentication enforced and a claim investigator finds out you didn’t, that misrepresentation can void your coverage entirely — regardless of whether the gap was related to the incident.
According to industry reports, formal claim denials tied to security control misrepresentation have increased significantly year over year. The conversation has shifted from “do you have a firewall?” to “prove to us that MFA is enforced on every admin account.”
That shift changes everything about how you need to prepare.
The Six Controls Insurers Commonly Require — And Will Verify
These aren’t optional suggestions. These are the baseline requirements that appear across virtually every major carrier’s underwriting questionnaire. If you can’t demonstrate all six, expect hard conversations at renewal — or worse, at claim time.
1. Multi-Factor Authentication (MFA) on All Accounts
This is the single most scrutinized control in cyber insurance underwriting. Insurers commonly require MFA on:
- All email accounts (Microsoft 365, Google Workspace)
- All remote access — VPN, RDP, remote desktop tools
- All administrative and privileged accounts
- Any system that touches client data or financial functions
“We have MFA available” isn’t enough. Carriers want enforcement — meaning users cannot bypass it. And increasingly, for higher coverage limits, standard app-based MFA is being supplemented with stronger options like hardware security keys for your most sensitive accounts.
What you need to show: Conditional access policies, screenshots of enforcement settings, or admin console records demonstrating MFA is required — not just enabled.
2. Endpoint Detection and Response (EDR) on All Endpoints
Traditional antivirus is no longer accepted by most carriers. Full stop.
Insurers commonly require EDR — or a managed equivalent (MDR) — running on all servers and workstations. The distinction matters: EDR monitors behavioral activity in real time, can detect threats that bypass signature-based scanning, and provides containment capabilities. Antivirus scans for known bad files. They are not the same thing.
What you need to show: Deployment records showing coverage across your environment, not just a license agreement. Carriers want to see that every endpoint is actually protected.
3. Tested Backup and Recovery Plan
Backups alone don’t satisfy underwriters anymore. The questions have gotten more specific:
- Are backups immutable (can’t be encrypted or deleted by ransomware)?
- Are they stored offsite or in a separate environment from your primary network?
- When did you last test a full recovery — not just confirm the backup ran?
A backup that hasn’t been tested is just an assumption. Carriers know this, and they’ll ask about it. An untested backup strategy is a significant red flag.
What you need to show: Documentation of your backup architecture and a record of your last recovery test — ideally within the past 6–12 months.
4. Security Awareness Training (Documented)
Phishing is still the leading cause of initial access in cyber incidents. Carriers want to see that your employees aren’t your biggest vulnerability.
Insurers commonly require ongoing, documented security awareness training — not a one-time video from three years ago. Many carriers specifically ask about phishing simulation programs, where you test employees with fake phishing emails and track who clicks.
What you need to show: Training completion records with dates, and documentation of your phishing simulation program if you have one.
5. Written and Tested Incident Response Plan
When something goes wrong, what happens in the first 24 hours? Who gets called? Who makes decisions? Where do your backups live? Who is your breach counsel?
Insurers commonly require a written incident response plan (IRP) — and increasingly, evidence that it’s been tested through a tabletop exercise or similar drill. A plan that lives in someone’s head or a document no one has looked at since it was created doesn’t demonstrate readiness.
What you need to show: A current written IRP and a record of your last tabletop exercise or review.
6. Privileged Access Management (PAM)
This is one of the newer requirements moving into standard underwriting. Insurers want to know that your most powerful accounts — domain admins, cloud admins, financial system admins — have controls beyond just a password and MFA.
PAM means those accounts are being used only when needed, actions are logged, and there are controls around who can elevate privileges and when. The goal is limiting blast radius if credentials are compromised.
What you need to show: Evidence that privileged accounts are inventoried, access is restricted by role, and activity is logged.
How Carriers Actually Verify Your Controls
Here’s what many business owners don’t realize: carriers don’t just take your word for it at renewal, and they definitely don’t at claim time.
Before you’re covered: Insurers commonly run external scans of your internet-facing infrastructure — looking for open ports, unpatched systems, misconfigured email security records. You may never know this scan happened. If they find problems, you’ll get questions or higher premiums.
When you file a claim: Investigators will review your actual systems — not your application answers. If your application said MFA was enforced everywhere and they find an admin account that wasn’t protected, that’s a misrepresentation. Depending on the policy language, it could void your coverage.
At renewal: Your renewal questionnaire is increasingly detailed, and carriers may compare your answers year over year. New gaps — or gaps that were always there but are now being asked about specifically — can change your premium significantly or trigger non-renewal.
What This Means for Minnesota Businesses
For small and mid-sized businesses in Minnesota — including healthcare providers, financial services firms, and professional services companies — the stakes are real. Regulated industries face additional pressure from carriers who know a breach in your environment could mean regulatory fines on top of recovery costs.
If you’re an MSP client, your cyber insurance coverage is only as strong as the security controls your provider has helped you implement and document. This is exactly where K&E Consulting focuses: not just putting controls in place, but making sure they’re properly documented and defensible when it matters.
Before Your Next Renewal: What to Do
1. Pull your current policy application and review what you attested to. Has anything changed since you last renewed?
2. Audit your six core controls — MFA, EDR, backups, training, IRP, PAM — against current requirements.
3. Gather your documentation — don’t wait until a carrier asks. Have it ready.
4. Talk to your broker about what’s changed in your specific coverage tier.
5. Get a gap assessment before you renew — not after a claim is denied.
K&E Consulting Can Help You Get Renewal-Ready
We work with Minnesota businesses to prepare for cyber insurance renewals before they become a crisis. That means gap assessments against current carrier requirements, documentation support, and implementation guidance for the controls that move the needle on insurability and premium cost.
We’ve seen what happens when businesses walk into a renewal unprepared — or worse, file a claim only to discover a coverage gap they didn’t know existed. That’s a situation we can help you avoid.
Get Your Free Cyber Insurance Readiness Checklist
We put together a plain-language checklist covering all six core controls — what carriers are looking for, what documentation to gather, and what questions to ask your broker before renewal.
Download the Free Cyber Insurance Readiness Checklist
No fluff. No sales pitch inside the checklist. Just the framework you need to walk into your next renewal prepared.
K&E Consulting is a Minnesota-based managed IT services provider specializing in cybersecurity, compliance, and infrastructure for small and mid-sized businesses. Questions about your cyber insurance posture? Reach out to our team.