New Jersey · New York · Pennsylvania
GBTech.ai

Resources

What cyber insurers expect from your IT in 2026: a checklist for small businesses

The security controls cyber insurance carriers commonly ask about on applications and renewals in 2026, what a good answer looks like, and how small businesses in New Jersey, New York and Pennsylvania can prepare.

By GBTech.ai · Published · Last reviewed

The short answer

Cyber insurers don't all use the same application, but most ask about the same core controls:

  • multi-factor authentication (MFA)
  • endpoint detection and response (EDR)
  • backups
  • patching
  • email security
  • security training
  • admin access
  • unsupported software
  • an incident response plan

The questions get more detailed as policy limits go up.

The most important rule is to answer accurately. Application answers are signed statements. Insurers have voided policies and refused claims when the answers turned out not to match what was actually in place.

The checklist

Each item below lists what insurers commonly ask, what a good setup looks like, and what evidence to keep. Wording and thresholds vary by carrier, company size and policy limit, so check your own application form.

1. Multi-factor authentication (MFA)

What insurers ask. Whether MFA is enforced on all email access, on all remote access including VPNs, and on admin accounts. Some forms also ask about the following (Travelers' MFA supplement asks about both):

  • contractors and outside providers who have remote access
  • admin access to backups, network equipment and servers

In 2025, the broker Aon wrote that MFA "is still an underwriting requirement."

What good looks like.

  • MFA on every email account, with no exceptions for executives or shared mailboxes.
  • MFA on every way into your network from outside, including vendor access.
  • MFA on every admin account.
  • Old email sign-in methods that skip MFA turned off. Beazley's ransomware form asks about these legacy protocols.

Why partial MFA is risky. In Travelers v. International Control Services (2022), the business had said MFA protected admin and remote access. After a ransomware attack, Travelers alleged that MFA was only on the firewall, not on the server that was attacked. By agreed order, the $1 million policy was rescinded and declared void from the start. In 2025, CP24 reported that the City of Hamilton, Ontario's insurer had refused to cover C$18.3 million in recovery costs from a 2024 ransomware attack because MFA "had not been fully implemented."

Evidence to keep. A report showing MFA enforcement for every account, and a list of any exceptions with the reason for each. Ideally there are none.

2. Endpoint detection and response (EDR)

What insurers ask. Which EDR product you use, and who watches it. At-Bay's application, for example, asks whether alerts are monitored 24/7 by a third party, in-house, only during business hours or not at all.

What good looks like. EDR on every laptop, desktop and server, with someone responsible for responding to alerts. Many businesses use a managed detection and response (MDR) service for round-the-clock monitoring. In its 2026 InsurSec report, At-Bay (which sells MDR) found that 60% of victims of one major ransomware group had a leading EDR product and were still compromised. Only firms whose EDR was backed by 24/7 MDR avoided full encryption.

Evidence to keep. A device coverage report, and your monitoring arrangement in writing.

3. Backups

What insurers ask. Common questions:

  • Are backups kept offline or in the cloud?
  • Are critical backups immutable (they can't be changed or deleted, even by an admin)?
  • Are they encrypted?
  • Do you test restores?
  • Is MFA required to manage the backup system?

What good looks like.

  • At least one copy of your critical data that is offline or immutable.
  • Encrypted backups.
  • Separate admin credentials for the backup system, protected with MFA.
  • Restore tests on a regular schedule, with results written down. We suggest at least quarterly.

CISA, the federal cybersecurity agency, recommends offline, encrypted, tested backups as a basic ransomware defense.

Evidence to keep. Backup job reports and a log of restore tests.

4. Patching

What insurers ask. How quickly you install critical security updates. There's no single standard deadline:

  • Beazley's ransomware form asks for your average time to fix critical vulnerabilities, with answers ranging from under 48 hours to more than two weeks.
  • Chubb may add a "Neglected Software Exploit Endorsement" for businesses without strong patching. After a 45-day grace period from when a vulnerability is published, more of the loss shifts to the policyholder at 45, 90, 180 and 365 days.

Why it matters. In Marsh McLennan's 2023 research (based on 2020–21 claims), patching high-severity flaws within seven days roughly halved the likelihood of a cyber event. Only 24% of firms did it.

What good looks like. Critical updates for internet-facing equipment (firewalls, VPNs, remote access tools) installed within days. Everything else updated on a regular monthly cycle. A report that shows what's up to date.

Evidence to keep. Patch status reports.

5. Remote access

What insurers ask. Whether remote desktop (RDP) is exposed to the internet, how your VPN or remote access works, and whether it requires MFA.

Why it matters. Recent claims data points to remote access as a common way in:

  • Coalition found that 58% of its 2024 ransomware claims began with a compromised VPN or firewall, and 18% with remote desktop products.
  • At-Bay found that VPNs were the entry point for 73% of 2025 ransomware attacks (87% counting remote desktop).
  • Coalition also reported that more than 65% of businesses had a login page exposed to the internet when they applied for insurance.

What good looks like.

  • No remote desktop open to the internet.
  • VPNs and firewalls kept patched and protected with MFA.
  • Old remote access devices replaced. Zero-trust access services are one way to replace a traditional VPN.

6. Email security

What insurers ask. Which inbound email security product you use. Some forms also ask about SPF, DKIM and DMARC (email authentication records for your domain).

Why it matters. In Coalition's 2026 claims report, business email compromise and funds transfer fraud made up 58% of 2025 incidents. Speed matters too. At-Bay found that fraud victims who reported within three days recovered their funds 70% of the time, compared with 27% for those who waited 30 days or more.

What good looks like.

  • Inbound filtering for phishing and malware.
  • SPF, DKIM and DMARC set up for your domain.
  • A rule that any change to payment details is confirmed by phone, using a number you already have on file.

7. Security awareness training

What insurers ask. Whether staff get security training, and whether you run phishing simulations.

What good looks like. Training when people join and at least once a year, plus regular simulated phishing tests. Keep the records.

8. Admin accounts

What insurers ask. How you control privileged (admin) access. Some forms ask about privileged access management tools.

What good looks like.

  • Separate admin accounts that aren't used for everyday email and browsing.
  • MFA on every admin account.
  • As few admin accounts as possible.
  • A regular review of who has admin access.

9. Unsupported software

What insurers ask. Whether you run software or systems that no longer get security updates, and how you isolate them.

Why it matters. Coalition's 2023 claims report found that businesses running end-of-life software were three times more likely to have an incident.

What good looks like. An inventory of anything unsupported, with a plan to replace it or keep it isolated from the rest of the network.

10. Incident response plan and logs

What insurers ask. Whether you have a written incident response plan and whether you test it. Aon wrote in 2025 that "a tested IR plan" is still an underwriting requirement. Beazley's form asks about ransomware tabletop exercises. Some carriers also ask about logging and monitoring.

What good looks like.

  • A short written plan that says who to call first, including the insurer's breach hotline from your policy.
  • A tabletop exercise at least once a year.
  • Logs from Microsoft 365, firewalls and servers kept in one place. CISA suggests keeping logs for critical systems for at least a year where possible.

Answering the application

  • Fill it out with whoever runs your IT. Travelers' MFA supplement asks whether the executive who signs it completed it with the person in charge of IT security.
  • Answer what is true today, not what you plan to do. If something is partly in place, say so and explain.
  • Tell your broker if something changes during the policy period, such as a gap in MFA or a backup system you retire.
  • Keep the evidence listed above, so you can back up your answers quickly at renewal or after an incident.

Rules that already require some of these controls

  • New York (NYDFS Part 500). This covers businesses licensed by New York's Department of Financial Services, including insurance agencies and brokers. Since November 1, 2025, they must use MFA for anyone accessing any of their information systems, unless their CISO approves equivalent controls in writing. Smaller firms that qualify for the limited exemption still need MFA for remote access, for third-party and cloud apps that hold nonpublic information, and for privileged accounts. The exemption covers firms with fewer than 20 staff (including contractors), less than $7.5 million in revenue in each of the last three years, or less than $15 million in assets.
  • FTC Safeguards Rule. This covers non-bank financial businesses such as tax preparation firms. It requires MFA for anyone accessing any information system. The rule's exemption for firms with fewer than 5,000 consumers doesn't cover MFA.
  • HIPAA. A proposed update to the HIPAA Security Rule, published January 6, 2025, would require MFA. As of October 2026, we could not find a final rule.

Will these controls lower your premium?

We couldn't find any verified figures for specific discounts, so be wary of anyone who promises one. Strong controls mainly affect whether you can get coverage, and on what terms.

For context, Marsh reported that US cyber insurance rates fell 2% in the second quarter of 2026, continuing a decline that began in 2023. Aon wrote in October 2026 that insurers look at how well controls actually work. They want security programs that are "actively managed and continuously improved, not simply documented."

How GBTech can help

GBTech's managed IT covers several items on this list. It includes:

  • endpoint security
  • backups run and checked by our team
  • Microsoft 365 hardening with Conditional Access and MFA
  • patching
  • a help desk

If you already have an IT person, our co-managed service adds those tools around them. GBTech is also an authorized reseller for Cloudflare, whose zero-trust access tools can replace a traditional VPN.

If you're preparing for a cyber insurance application or renewal, talk to an advisor about which of these controls you already have and what's missing.

Frequently asked questions

Which accounts need MFA for a cyber insurance application?

Usually every email account, every form of remote access (VPN, remote desktop tools and vendor access) and every admin account. Some forms also ask about admin access to backups, network equipment and servers.

Is antivirus enough, or do we need EDR?

Many applications ask specifically about EDR and who monitors it. Traditional antivirus on its own may not satisfy those questions. Check the wording on your form.

What backups will an insurer accept?

Insurers commonly ask whether backups are offline or immutable, whether they're encrypted and whether you test restores. A tested, offline or immutable copy of your critical data is the safest answer.

Is there a standard deadline for installing critical patches?

No. One carrier's form asks for your average time in bands from under 48 hours to over two weeks. Another uses a 45-day grace period before more of the risk shifts to the policyholder. Faster is safer, especially for firewalls, VPNs and other internet-facing equipment.

What happens if an answer on our application turns out to be wrong?

The insurer may refuse a claim or rescind the policy, as in the Travelers case above. If you find a mistake or something changes, tell your broker right away.

Will stronger controls lower our premium?

There's no verified figure for how much, and rates vary by carrier. Strong controls mainly affect whether you can get coverage and on what terms.

Do insurers check our answers?

Some carriers look at applicants' internet-facing systems. Coalition, for example, reported that more than 65% of businesses had a login page exposed to the internet when they applied. After an incident, investigators will see exactly what was in place, which is how gaps like partial MFA come to light.

Does our VPN or remote access setup affect coverage?

It can. Carriers ask about remote access, and recent claims data from Coalition and At-Bay links many ransomware attacks to VPNs, firewalls and remote desktop.

Sources

Carrier and broker forms and guidance:

Cases:

Claims and market data:

Regulations:

Questions about your setup? Talk to an advisor.

Talk to an advisorSee what our managed IT covers →