Cyber Insurance Requirements for Small Business

Cyber insurance requirements for small business

Insurers now expect MFA, email filtering, tested backups, EDR, patching and a handful of other controls before they will write a policy. The insurance broker Marsh says the adoption of certain controls "has now become a minimum requirement of insurers" and lists twelve ¹:

1. MFA for remote and privileged access
2. Email filtering and web security
3. Secured, encrypted and tested backups
4. Privileged access management
5. Endpoint detection and response
6. Patch and vulnerability management
7. Incident response planning and testing
8. Cybersecurity awareness training and phishing testing
9. Hardening of remote desktop (RDP) access
10. Logging and monitoring
11. Replacing or protecting end-of-life systems
12. Digital supply chain risk management

The first six carry the most weight on small business applications, because they line up with how claims start. In Coalition's 2025 claims data, business email compromise and funds transfer fraud made up 58% of incidents ⁴. At-Bay found email was the entry point for 43% of its insureds' incidents in 2024, and 80% of ransomware attacks against its insureds came through a remote access tool ⁵. MFA, email filtering and locked-down remote access address those directly.

Clear IT Pricing does not sell insurance. We help businesses get these security controls in place through IT and security providers; for coverage, limits and policy wording, talk to a licensed insurance broker.

What cyber insurance costs

Insureon reports that small businesses buying through its platform pay a median of $129 a month, or $1,552 a year, with limits usually between $1 million and $5 million ². Your price depends on revenue, industry, the data you hold, claims history, the limit and deductible you choose, and the controls you can show.

Claims data shows why insurers care about controls. Coalition's 2026 Cyber Claims Report, based on more than 100,000 policyholders, found the average claim fell 19% to $116,000 in 2025 ⁴. Ransomware was the most costly claim type, at an average loss of $269,000; initial ransom demands rose 47%, and a record 86% of businesses refused to pay ⁴. Businesses with over $100 million in revenue had claims five times as often as smaller ones ⁴.

The market is large and growing. US insurers wrote about $9.14 billion in direct cyber premium in 2024, with 4,368,614 policies in force, and nearly 50,000 claims reported, up almost 40% from the year before, according to the National Association of Insurance Commissioners ³.

What a policy typically pays for, per the FTC:

• First-party coverage protects your own business: legal counsel, data recovery, customer notification, business interruption and forensics ⁶.
• Third-party coverage protects you when others bring claims: settlements, litigation and regulatory response ⁶.

The FTC also suggests asking whether the policy has a breach hotline that is available at all times, whether it includes a duty to defend, and whether it covers attacks on data held by your vendors ⁶. Those questions are for your broker. The controls in this guide are what make the premium and the answers better.

Cyber insurance application questions, and what they mean

Cyber insurance applications ask yes or no questions about specific controls, and each answer needs to be true across your whole business, not just part of it. Common questions, translated:

• "Do you require MFA for all remote access and email?" Every user, every mailbox, every VPN or remote desktop tool, and every cloud admin portal. Shared mailboxes and service accounts often get missed.
• "Is MFA required for privileged or administrator accounts?" Including your IT provider's accounts on your systems.
• "Do you use EDR on all endpoints? Is it monitored 24/7?" Basic antivirus is not EDR. If nobody watches alerts at night, answer accordingly or add managed detection and response.
• "Are backups kept offline or immutable, and tested?" A sync to a cloud drive does not count. See our backup and disaster recovery guide.
• "How quickly are critical patches applied? Do you run unsupported software?" Windows 10 left support October 14, 2025 unless you pay for Extended Security Updates ¹².
• "Do staff receive security awareness and phishing training?" Annual training plus simulated phishing is the usual expectation.
• "Do you verify payment changes out of band?" A call-back rule to a known number, not the one in the email.

If an answer is "partly," say so and describe the plan to finish. Brokers can often work with a dated plan; they cannot work with an answer that turns out to be wrong.

What happens if the application overstates your controls

Misstating controls on the application can put the whole policy at risk. In Travelers v. International Control Services, filed in federal court in Illinois in July 2022, Travelers sought to rescind a $1 million cyber policy after a ransomware attack, alleging the business had said it used MFA on its servers when MFA protected only its firewall ¹³. Our source reports the complaint, not a court decision, but the case shows how insurers test application answers after a claim.

How to avoid that position:

• Have your IT provider review the application before anyone signs it, question by question.
• Keep evidence: MFA enrollment reports, EDR console screenshots, backup test reports, training completion records.
• Re-check answers at every renewal. Staff turnover and new systems change the truth.
• If a control is missing, fix it before binding or disclose it.

The controls also matter after a claim. Coalition reports 64% of the claims it closed were resolved with no out-of-pocket loss to the policyholder, and it recovered $21.8 million in stolen funds for policyholders in 2025 ⁴. A business that can show it did what it said is in a far better position when it needs that help.

How to prepare for a cyber insurance application

Start about two to three months before your renewal or first application, so there is time to close gaps before you answer the questions.

1. Get the application early. Ask your broker for the insurer's actual questionnaire, not a summary.
2. Map each question to evidence. Your IT provider or a cybersecurity risk assessment can do this quickly.
3. Close the cheap gaps first. MFA is often already licensed; Microsoft's research found it cuts the risk of account compromise by 99.22% ¹⁴. Email filtering lists at $2 to $5 per user per month ⁸⁹, and training at $1.50 to $4 ¹¹¹⁵.
4. Add 24/7 detection if you lack it. MDR runs about $8 to $25 per endpoint per month ¹⁰.
5. Fix backups. Add an immutable or offline copy and run a restore test you can document.
6. Write a one-page incident response plan with the insurer's hotline number. Our incident response guide lists what to include.
7. Review the final answers with IT before signing.

Our cybersecurity for small business guide explains each control in more depth. Regulated firms often need the same controls anyway. The FTC Safeguards Rule requires MFA for anyone accessing a covered firm's information systems unless its Qualified Individual approves equivalent controls in writing ¹⁶; see our WISP guide.