Cyber Insurance Security Requirements Checklist for Small Businesses

Before you apply for or renew cyber insurance, make sure you can honestly say yes, and prove it, to the controls applications commonly ask about: multi-factor authentication (MFA), tested backups, endpoint protection such as EDR, patching, locked-down remote access and a written incident response plan. This checklist walks through each control, what CISA recommends, what evidence to collect and the typical gaps.

It is written for owners and IT managers at small US businesses who have been handed an application or a renewal questionnaire. By the end you will have a one-page evidence file that matches your answers. It does not replace advice from an insurance broker, and requirements differ between insurers. Your own application's questions are the ones that count.

For the wider picture of what cyber policies cover, see Cyber insurance for small business: security controls insurers ask for. This article focuses on the control-by-control checklist and the proof for each answer. For a broader baseline, the FTC cybersecurity basics guide is a useful companion.

Who this is for and what you will have at the end

You run a business with a few to a few hundred staff, with Microsoft 365, Google Workspace or similar, and a mix of laptops, servers and cloud apps. After working through the checklist you will have:

• A completed self-assessment against six control areas.
• A short list of gaps with an owner and a date.
• A folder of evidence (exports, screenshots, test records) to attach to or keep behind your answers.

Prerequisites

• Administrator access to your email and identity platform, backup tool, endpoint protection console and firewall or VPN.
• The actual application or renewal questionnaire, if you have it.
• A list of your systems: users, laptops, servers, cloud services and who administers each one.

How to use CISA guidance as a yardstick

Insurers do not publish one universal list, and this article does not claim they do. A neutral reference for what good looks like is CISA's #StopRansomware Guide, which sets out preventive practices. The sections below quote it directly where it addresses a control. CISA also publishes Cybersecurity Performance Goals (CPGs), described as a core set of practices with known risk-reduction value and broadly applicable across sectors. The CPG page is archived and says it has been superseded by CPGs 2.0, so check the current version if you cite goal numbers. The earlier version numbers goals such as 2.H for phishing-resistant MFA, 2.R for system backups, 1.A for asset inventory and 2.A for changing default passwords.

Control 1: Multi-factor authentication

CISA's ransomware guide says to "implement phishing-resistant MFA for all services" and to prioritize email, VPNs and accounts that access critical systems.

What to do:

1. List every place a user or admin signs in: email, VPN or remote access, cloud admin portals, accounting and payroll systems, password manager and remote management tools.
2. Check MFA is enforced, not merely available. In your identity platform's sign-in or authentication-methods report, confirm no user is exempt without a documented reason.
3. Check older and shared admin accounts. A frequent gap is MFA enabled for most staff but missing from a legacy administrator or service account.
4. Where you can, move administrators to phishing-resistant methods such as passkeys or security keys rather than SMS codes.

Evidence: a screenshot or export of the MFA enforcement setting, plus a list of any exceptions with the reason and compensating control.

CISA's MFA page notes that MFA requires two or more credentials so that a stolen password alone is not enough.

Control 2: Backups you have actually restored

CISA's guide says to "maintain offline, encrypted backups of critical data" and to "regularly test the availability and integrity of backups in a disaster recovery scenario." It explains that many ransomware variants look for and delete reachable backups, so keep at least one copy disconnected from the network.

What to do:

1. Identify critical data: accounting, customer records, shared files, line-of-business databases and email if you keep archives.
2. Confirm at least one backup copy is offline, or otherwise not reachable with the credentials used for daily administration.
3. Confirm backups are encrypted.
4. Run a restore test. Restore a file, a mailbox and one full server or database to a separate location, and record the date, what you restored and how long it took.

Evidence: backup job reports, a screenshot of the retention and immutability settings your tool shows, and the dated restore-test record.

Common gap: cloud-to-cloud copies that use the same admin account as production. If an attacker holds that account, they can reach both.

Control 3: Endpoint protection and EDR

CISA's guide says to "use application allowlisting and/or endpoint detection and response (EDR) solutions on all assets."

What to do:

1. Export the device list from your endpoint protection console and compare it with your asset list. Devices missing from the console are the gap.
2. Confirm every laptop, desktop and server is reporting recently, and that protection is not in a disabled or passive state.
3. Check who watches the alerts. An EDR nobody reads is a weak answer. Document who is notified and what they do.

Evidence: a device coverage report showing total devices versus protected devices and the date it was generated.

Ask your broker whether the application specifically requires EDR or accepts other endpoint protection, because wording differs between insurers.

Control 4: Patching and unsupported software

CISA recommends that you "regularly patch and update software and operating systems to the latest available versions," starting with internet-facing systems.

What to do:

1. List internet-facing systems: firewalls, VPN appliances, web servers, remote access gateways.
2. Check their firmware and software versions against the vendor's current releases.
3. Find software and operating systems the vendor no longer supports and plan replacement or isolation.
4. Set a patch routine and write down the schedule.

Evidence: a patch compliance report from your update tool and a list of any exceptions with the reason.

Control 5: Remote access and administrator accounts

CISA says "do not expose services, such as remote desktop protocol, on the web," and, where RDP is required, to audit for RDP systems, close unused ports, enforce account lockouts, apply MFA and log login attempts. It also says to apply least privilege, separate administrator accounts from user accounts and not use root access accounts for day-to-day work.

What to do:

1. Check your firewall rules for inbound remote desktop or other management ports open to the internet. Close them or put them behind a VPN with MFA.
2. Give each administrator a separate admin account from their daily email account.
3. Review who holds administrator roles and remove those who no longer need them.
4. Change default passwords on devices such as routers, printers and cameras.

Evidence: a firewall rule export (with sensitive details redacted), and a list of administrator accounts with owners.

Control 6: Incident response plan

CISA's guide says to "create, maintain, and regularly exercise a basic cyber incident response plan," to keep hard and offline copies, and to have the plan approved in writing by leadership. It also lists where to report a ransomware incident: CISA (cisa.gov/report), your local FBI field office, and the FBI's Internet Crime Complaint Center (ic3.gov).

A basic plan fits on two pages:

• Who makes decisions and who to call, including your insurer's breach hotline if the policy has one.
• How to isolate affected devices.
• Where backups are and who can restore them.
• Who to notify (customers, regulators, law enforcement) and who drafts the message.

Evidence: the plan itself, with a date, an approver and a record of a tabletop exercise.

Also consider email filtering. CISA recommends gateway filters, attachment filters, flagging external email and implementing DMARC.

A scorecard to keep

Do not round "partly" up to "yes." If a control covers 80% of devices, say so, name the plan for the rest and ask the broker how to present it.

Check what the policy covers

Meeting security requirements does not tell you what a claim pays. The FTC suggests asking whether the policy covers data breaches, attacks on data held by vendors or other third parties, and network breaches. It also suggests asking whether the insurer has a "duty to defend" you in a lawsuit or regulatory investigation, and whether there is a breach hotline open at all hours. Distinguish first-party coverage (your own costs, such as forensic investigation, data recovery, notification and business interruption) from third-party coverage (claims others bring against you).

Troubleshooting

The questionnaire uses terms you do not recognize

Ask the broker to define them in writing. "Immutable backup," "privileged access management" and "EDR" are used loosely, and a wrong assumption can make an answer inaccurate.

You cannot meet a requirement before renewal

Tell the broker early, describe what is in place and what you are doing, and ask whether partial controls or a timeline are acceptable. Do not mark the control as in place.

MFA breaks a legacy application

Some old applications cannot use modern sign-in. Put them behind a VPN or gateway with MFA, restrict who can reach them, and document the compensating control.

You rely on an outside IT provider

Ask the provider for the evidence in this checklist. Your answers are still your answers, so keep copies of what they send.

Checklist

• Obtain the actual application and answer from evidence.
• Enforce MFA on email, remote access and all administrator accounts.
• Keep one offline, encrypted backup and record a restore test.
• Cover every device with endpoint protection and name who watches alerts.
• Patch internet-facing systems and plan around unsupported software.
• Close exposed remote desktop and separate admin accounts.
• Write and approve a two-page incident response plan.
• Review coverage with the FTC's questions before you sign.

References

• CISA: #StopRansomware Guide
• CISA: Multifactor Authentication
• CISA: Cybersecurity Performance Goals
• FTC: Cyber Insurance