# Cyber Insurance for Small Business: Security Controls Insurers Ask For

> Before you apply for cyber insurance, get these controls in place: MFA, EDR, tested backups, patching, training and an incident plan. Includes a readiness checklist and policy questions.

Source: https://www.epifive.com/blog/small-business-cyber-insurance-requirements · Published 2026-10-29 · EpiFive

## Key takeaways

- Insurers commonly look for MFA, tested backups, endpoint detection and response, patching, staff training and an incident response plan.
- Controls need to be deployed and provable, because applications are statements you may later have to support.
- The FTC says a good policy should cover attacks on your network, third-party data and attacks from inside and outside the US.
- Ask about duty to defend, excess coverage and a 24-hour breach hotline before you buy.
- The NAIC says insurers typically require notice before any ransom payment, and failing to notify may mean a denied claim.

Cyber insurers commonly ask small businesses to show multi-factor authentication, tested backups, endpoint detection and response (EDR), a patching routine, staff security training and a written incident response plan before they offer coverage. The exact list differs by insurer, so your carrier's questionnaire is the final authority, but getting these controls in place and documented is the best preparation for an application.

This guide is for owners and IT leads at small US businesses who have a cyber insurance application or renewal coming. By the end you will have a readiness checklist, a list of evidence to gather, and questions to ask about the policy itself. Policy coverage points come from FTC and NAIC guidance. The list of commonly requested controls comes from vendor guidance, which is an industry description rather than a regulation. Both were read on October 29, 2026. This article is general information and not insurance or legal advice.

## What cyber insurance covers

The FTC's small business guidance splits cyber insurance into two kinds of cover.

| Type | Protects | Examples listed by the FTC |
|---|---|---|
| First-party | Your own data and operations | Legal counsel on notification and regulatory duties, recovering lost data, customer notification and call center services, lost income from interruption, crisis management and public relations, cyber extortion and fraud, forensic investigation, fees, fines and penalties |
| Third-party | Claims made against you | Payments to affected consumers, claims and settlement expenses, defamation and copyright or trademark infringement, litigation costs and regulatory inquiries, settlements, damages and judgments |

The FTC says a policy should cover data breaches including theft of personal information, attacks on data held by vendors and third parties, attacks on your network, attacks occurring anywhere in the world and terrorist acts. It recommends talking to your insurance agent about whether you need first-party coverage, third-party coverage or both.

## Controls insurers commonly ask for

Vendor guidance on cyber insurance requirements (for example, Duo's overview) lists the following as common application topics. Treat the list as typical, not universal.

### Multi-factor authentication

MFA is described as a baseline condition on most applications. Expect questions about where it is enforced: email, remote access such as VPN or remote desktop, administrator accounts, and increasingly backup consoles and financial systems. Some vendor guidance says partial coverage may be treated as no coverage, so verify with your carrier's wording. If MFA is not complete yet, follow [a small business MFA rollout checklist](https://www.epifive.com/blog/small-business-mfa-rollout-staff-checklist) first.

The FTC's guidance also says to require multi-factor authentication for anyone accessing sensitive information or your network.

### Tested backups

Insurers want backups that survive ransomware: ideally an isolated or offline copy and periodic restore tests. The FTC recommends keeping offline backups and a continuity plan as ransomware defenses. If you use Microsoft 365, see [Microsoft 365 backup options for small business](https://www.epifive.com/blog/microsoft-365-backup-small-business-options). Test a restore, write down the date and the result, and keep that record.

### Endpoint detection and response

EDR continuously monitors laptops, servers and phones, and can isolate a compromised device. Applications often ask whether EDR is deployed on every endpoint and server and who watches the alerts. If you are deciding between built-in and paid tools, read [free vs paid antivirus for small business](https://www.epifive.com/blog/free-vs-paid-antivirus-windows-defender-small-business).

### Patching and vulnerability management

A documented routine for updating operating systems, applications, routers and firewalls shows that you fix known weaknesses. The FTC advises scheduling software and OS updates and turning on automatic updates. Keep router firmware current too; the related guide on [router firmware and default passwords](https://www.epifive.com/blog/router-firmware-update-change-default-password-office) walks through that.

### Incident response plan

A written plan explains who investigates a breach, who talks to customers, and who meets notification obligations. The FTC's NIST-based guidance under Respond says to maintain and regularly test incident response, disaster recovery and business continuity plans. See the [IT disaster recovery plan template](https://www.epifive.com/blog/small-business-it-disaster-recovery-plan-template) for a starting structure.

### Access control

Restrict who can reach which data based on role, keep administrator rights to a minimum, and remove accounts when people leave.

### Security awareness training

Insurers often ask whether staff receive phishing and security training on a regular schedule. The FTC says to train employees on a regular schedule and to provide a way to report suspicious email.

## Gather evidence before you apply

Applications are statements you will need to support if you make a claim. Vendor guidance warns that policies may carry exclusions where an application misrepresented security controls. Collect the following.

| Control | Evidence to keep |
|---|---|
| MFA | Screenshot or export of the policy showing which users and apps require it |
| Backups | Last successful job report and a dated restore-test record |
| EDR | Console report showing devices covered and agent status |
| Patching | Update policy and a recent patch compliance report |
| Incident response plan | The document, version date and who has a copy |
| Training | Attendance or completion records with dates |
| Inventory | A list of devices, accounts and where sensitive data lives |

Do not tick a box on the basis of intent. If MFA covers email but not remote access, say so, and fix the gap rather than rounding up.

## Questions to ask about the policy

The FTC lists questions worth asking your provider.

- Will the insurer defend you in a lawsuit or regulatory investigation? Look for duty-to-defend wording.
- Will the coverage sit in excess of other insurance you hold?
- Is there a breach hotline available at all times, every day of the year?
- Does it cover attacks on your network and on data held by vendors, wherever in the world the attack occurs?
- Does it cover data recovery, notification, business interruption, forensics, legal costs and fines?
- Does it help pay ransom demands, and what limits apply?

On ransomware, the NAIC says many policies cover ransom payments, extortion expenses and repair costs, that insurers typically require notice before any payment is made, and that failing to notify may lead to a denied claim. It also says insurers increasingly require strong security controls and may limit ransom coverage. Law enforcement does not recommend paying, per the FTC. Put the insurer's notification contact in your incident plan so it is the first call, not an afterthought.

## A two-week readiness plan

1. **Days 1 to 2:** Inventory devices, users, admin accounts and where sensitive data lives.
2. **Days 3 to 5:** Turn on MFA for email, remote access, administrators, backup consoles and finance tools. Record the settings.
3. **Days 6 to 8:** Confirm EDR on every endpoint and server and assign someone to review alerts.
4. **Days 9 to 10:** Run a backup restore test and keep an offline or immutable copy.
5. **Days 11 to 12:** Write or update the incident response plan, including the insurer's contact and a rule about notifying before paying any ransom.
6. **Days 13 to 14:** Schedule training, finish patching and compile the evidence folder.

## Troubleshooting common problems

- **Not every device supports the EDR agent.** List exceptions and the compensating control, such as network isolation. Tell the broker rather than hiding them.
- **Legacy systems cannot use MFA.** Document the system, restrict network access to it, and plan its replacement.
- **The renewal questionnaire is stricter than last year.** The NAIC says insurers increasingly mandate stronger controls, so start earlier and ask your agent what changed.
- **Premium quotes vary widely.** Compare coverage terms as well as price: exclusions, sub-limits and the waiting period for business interruption matter.

## Checklist

- MFA enforced on email, remote access, admin accounts and critical systems.
- Backups tested, with one copy offline or immutable.
- EDR on every endpoint and server, with someone watching it.
- Updates automatic or scheduled, with router and firewall firmware included.
- Written incident response plan including the insurer's contact.
- Regular staff training and a way to report suspicious email.
- Evidence folder prepared and answers on the application accurate.
- Policy reviewed for duty to defend, excess coverage, hotline, ransomware terms and exclusions.

## References

- [FTC: Cyber Insurance (Cybersecurity for Small Business)](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance)
- [FTC: Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity)
- [NAIC: Ransomware](https://content.naic.org/insurance-topics/ransomware)
- [Duo: Cyber insurance requirements](https://duo.com/learn/cyber-insurance-requirements)

## Frequently asked questions

### What security controls do cyber insurers require?

Insurer guidance commonly lists multi-factor authentication, tested backups, endpoint detection and response, patching, employee training and a documented incident response plan. Requirements differ by insurer and company size, so the questionnaire from your own carrier is the only definitive list.

### Is cyber insurance required by law for small businesses?

The FTC and NAIC guidance describes cyber insurance as something to discuss with your insurance agent, not a general legal requirement. A customer or vendor contract may still require you to carry it, so check your agreements.

### Does cyber insurance pay a ransom?

It can. The NAIC says many policies cover ransom payments, extortion expenses and repair costs, but insurers typically require notice before any payment is made, and failing to notify them may lead to a denied claim. Law enforcement does not recommend paying.

### What happens if I answer the application inaccurately?

Vendor guidance warns that a claim can be affected if the application overstated your controls, so answer from what is actually deployed and keep evidence such as screenshots and dates. Ask your agent how your policy treats misstatements.