A cyber insurance application can expose weaknesses that have been sitting quietly in your IT environment for years. An unmanaged administrator account, unpatched server or untested backup may not disrupt the working day – until an insurer asks whether it is controlled. This business cyber insurance requirements guide explains what insurers commonly expect, how to prepare properly and where businesses most often fall short.
Cyber insurance is not a replacement for cyber security. It is a financial safety net for the costs that follow an incident, such as specialist response, legal advice, business interruption, data recovery and extortion demands. Insurers want evidence that your business has taken reasonable steps to reduce the likelihood and impact of a claim.
Why cyber insurance requirements are getting tighter
Ransomware, supply-chain compromises and email fraud have made cyber claims more frequent and more expensive. As a result, insurers are asking more detailed questions before offering cover, renewing a policy or agreeing a premium.
For business leaders, the practical message is clear: security controls are now part of commercial readiness. Weak controls can lead to higher excesses, exclusions, reduced limits or no cover at all. Worse, inaccurate answers on an application can create problems when you need to make a claim.
Requirements vary by insurer, sector, turnover and the type of data you hold. A small professional services firm will not be assessed in exactly the same way as a manufacturer, retailer or organisation supporting critical infrastructure. However, several controls have become a common baseline.
The baseline controls insurers commonly expect
Insurers do not normally expect every business to operate like a large enterprise security operations centre. They do expect disciplined, proportionate controls that protect the systems your organisation depends on.
Multi-factor authentication
Multi-factor authentication, or MFA, is one of the most significant requirements. It should protect remote access, cloud email, privileged accounts and key business systems wherever it is technically possible. A password alone is not adequate protection against phishing, credential theft or password reuse.
Be precise when reviewing this control. MFA enabled for some users is not the same as MFA enforced for all users, especially administrators. If legacy systems cannot support MFA, document the limitation and put compensating controls in place, such as restricted access, network segmentation and enhanced monitoring.
Managed patching and supported systems
Insurers want to know that operating systems, applications, firewalls and network devices are supported and patched within a sensible timeframe. Critical vulnerabilities should not be left open while a routine maintenance window approaches.
This is where ageing infrastructure becomes a business risk. An unsupported server may still run a vital application, but it can undermine insurance eligibility and create an expensive single point of failure. A clear replacement plan, backed by risk controls while migration is under way, is far more defensible than hoping it remains stable.
Secure, tested backups
Backups must be more than a scheduled job with a green status message. Insurers increasingly look for backup arrangements that are separate from the main network, protected from unauthorised deletion and tested through recovery exercises.
The key question is not whether data is backed up. It is whether you can restore the systems needed to trade within an acceptable period after a ransomware incident. Document recovery time objectives for critical services, test them and retain the results.
Endpoint protection and monitoring
Managed endpoint detection and response, anti-malware protection and central monitoring help identify suspicious activity before it becomes a major incident. Insurers may ask whether security alerts are monitored outside office hours, who responds to them and how quickly containment can begin.
A tool without ownership is not a control. Someone must be accountable for reviewing alerts, isolating affected devices and escalating serious threats. For many mid-market businesses, a managed security service provides the practical coverage that an internal team cannot sustain alone.
Email, access and payment controls
Email remains a common route for phishing, malware and invoice fraud. Appropriate filtering, domain protection and user reporting procedures reduce this exposure. So do clear approval processes for changes to supplier bank details, especially where finance teams act quickly under pressure.
Insurers may also ask about least-privilege access. Staff should have only the access required for their role, while administrator permissions should be tightly controlled, reviewed and removed when no longer needed. Joiner, mover and leaver processes matter here. A former employee account is both a security gap and an avoidable question on a proposal form.
Turning the business cyber insurance requirements guide into an action plan
The fastest way to prepare is to treat the insurer questionnaire as a gap assessment, not a form to complete at the last minute. Bring together your IT lead, finance owner, operations lead and any external technology partners. Each team will hold part of the answer.
Start by identifying your critical services: email, finance platforms, customer data, production systems, remote access, telephony and cloud applications. Then establish who owns each system, where the data sits and what happens if it is unavailable for a day, a week or longer.
Next, compare your current environment with the controls requested by the insurer. Avoid assumptions. Verify whether MFA is enforced, whether backups have been restored successfully, whether patches are current and whether incident response contacts are available. This process often reveals gaps between a policy written on paper and the systems people use every day.
Where a control is incomplete, record the risk, owner and target completion date. Not every issue can be fixed immediately, particularly where legacy applications or site infrastructure are involved. What matters is that the business understands the exposure, makes a realistic investment decision and can demonstrate active management.
Keep evidence before you need it
A strong answer on an application should be supported by evidence. Insurers may request it before binding cover, at renewal or after a claim. Keeping this information organised reduces delays and avoids rushed decisions when an incident is already affecting operations.
Useful evidence includes:
- MFA and access-control policies, with confirmation of coverage for privileged and remote users.
- Patch reports, vulnerability management records and an inventory of supported hardware and software.
- Backup configurations, restoration test results and documented recovery objectives.
- Security awareness training records, phishing exercises and finance approval procedures.
- An incident response plan with current contacts for management, IT, legal, communications and insurance notification.
The incident response plan deserves particular attention. It should state who can authorise emergency technical work, how affected systems are isolated and when the insurer or its appointed response team must be notified. Some policies require early notification, so engaging the wrong supplier or negotiating directly with an attacker before calling the insurer could complicate cover.
Review the policy, not only the questionnaire
Meeting technical requirements does not mean every cyber loss will be covered. Review limits, sub-limits, excesses, territorial restrictions and exclusions with the same care you apply to the security controls.
Ask how the policy treats business interruption, system failure, social engineering, regulatory costs, third-party claims and data restoration. Consider your dependence on cloud providers and outsourced systems too. Cover for a breach at your business may differ from cover for an outage at a supplier.
The right level of cover depends on your revenue, contractual obligations, data exposure and recovery capability. A lower premium can look attractive until a sub-limit leaves a serious portion of incident costs with the business. Align the policy with a realistic disruption scenario, not the best-case one.
Make cyber readiness part of normal operations
Cyber insurance requirements should not become a yearly compliance exercise that disappears after renewal. Access changes, new cloud tools, office moves, acquisitions and infrastructure upgrades can all alter your risk profile.
Build review points into normal IT governance. Reassess controls after major changes, test recovery at least annually and update your insurer when material risks change. The result is more than a cleaner renewal process: it is a business that can respond faster when systems, people and customer trust are under pressure.
WestTech helps businesses bring security, infrastructure and operational ownership into one accountable service model. The most useful next step is simple: test whether your stated controls work in practice before an insurer – or an attacker – tests them for you.
