Not long ago, renewing a cyber insurance policy meant checking a few boxes on a questionnaire and signing at the bottom. That era is ending. Carriers have paid enough ransomware and email fraud claims to know which controls actually reduce losses, and they increasingly want to see proof that those controls are in place, not just a “yes” on a form.
For manufacturers and nonprofits across Northeast Ohio, that changes who owns the renewal. It is no longer only a conversation between the CFO and the broker. It is a technology readiness exercise, and the organizations that treat it that way tend to have smoother renewals and fewer surprises when they file a claim.
We covered how an IT service provider can assist with cyber insurance a few years ago, and later looked at cyber insurance for manufacturing specifically. This post goes one level deeper: the specific cyber insurance requirements underwriters ask about, and the evidence leaders should have ready before the application arrives.
1. What Are Cyber Insurance Requirements Today?
Cyber insurance requirements are the security controls a carrier expects you to have before it will offer coverage, or before it will offer coverage at a reasonable price. Every carrier words its application differently, but the same core controls show up again and again:
- Multi-factor authentication (MFA), especially for email, remote access and administrator accounts
- Endpoint detection and response (EDR) on computers and servers, ideally with someone watching the alerts
- Backups that are separated from the main network, protected from deletion and actually tested
- Timely patching of operating systems and internet-facing systems
- Security awareness training and phishing simulations for employees
- A written incident response plan
- Controls around money movement, such as call-back verification for payment changes
None of these are exotic. They line up closely with the baseline in CISA’s Cyber Essentials and the NIST Cybersecurity Framework. What has changed is how carefully underwriters check them.
2. Why Self-Attestation Is No Longer Enough
The biggest shift is from “tell us” to “show us.” Many applications now ask detailed follow-up questions: Is MFA enforced on every account, or only some? Are backups immutable? Who monitors EDR alerts after hours? Some carriers also run outside-in scans of your internet-facing systems before quoting.
The risk here is not only a higher premium. If an application says a control is in place and a claim investigation later shows it was not, coverage can be disputed. An honest, accurate application is worth more than an optimistic one.
3. The Controls Behind a Smooth Renewal
MFA That Resists Phishing
Underwriters started by asking whether you use MFA. Now they ask where and what kind. Text-message codes and push approvals are far better than nothing, but CISA calls phishing-resistant MFA the gold standard. Start with administrators, finance staff and remote access. Our recent post on passkeys for business explains one practical path.
Monitored Endpoints
Traditional antivirus is rarely enough on its own. Carriers want EDR on every computer and server, and they want to know that a person, internal or outsourced, responds to alerts around the clock. Ransomware often starts at night or over a weekend.
Backups You Have Actually Restored
“We back up nightly” is the start of the answer. Underwriters want to know whether backups are offline or immutable, whether Microsoft 365 data is included, and when you last tested a full restore. CISA’s #StopRansomware Guide recommends offline, encrypted backups that are tested regularly. A solid disaster recovery and backup plan answers this question with dates and results.
Patching and End-of-Life Systems
Expect questions on how quickly critical patches are applied and whether any unsupported systems are still running. For manufacturers, the honest answer often includes a few older machines tied to production equipment. That is acceptable to many carriers if those systems are isolated and documented.
Training and Payment Controls
Business email compromise remains one of the most common claim types. Regular training, phishing simulations and a firm rule that bank detail changes are verified by phone using a known number all reduce that risk, and they are easy to document.
An Incident Response Plan You Have Rehearsed
A written plan should name who makes decisions, who calls the carrier’s breach hotline, which outside firms you will use and how you will keep operating. CISA offers free tabletop exercise packages that make a first rehearsal straightforward.
4. What This Means for Northeast Ohio Manufacturers and Nonprofits
Manufacturers usually have the hardest questions on segmentation and legacy systems. Underwriters want to know whether a compromised office PC could reach the plant floor. A simple network diagram and a list of isolated machines go a long way.
Nonprofits are often asked about donor and client data, volunteer accounts and shared mailboxes. The common gap is accounts nobody owns: former volunteers, shared logins and board members using personal email. Cleaning these up before renewal makes the MFA question much easier to answer truthfully.
In both cases, lean internal teams carry the burden. That is where a partner relationship, whether fully managed or co-managed IT, helps: someone else maintains the evidence year-round so the renewal is a review rather than a scramble.
5. How to Prepare 90 Days Before Renewal
- Get last year’s application now. Note every “yes” and confirm it is still true.
- Build an evidence folder. Include MFA enrollment reports, EDR coverage, backup restore test results, training completion and the incident response plan.
- Close the easy gaps first. Enforce MFA on remaining accounts, retire unused ones and test a restore.
- Write down exceptions. If a legacy system cannot be patched, document how it is isolated.
- Bring IT to the broker meeting. Technical questions answered accurately the first time save weeks of back and forth.
Frequently Asked Questions
What are the most common cyber insurance requirements?
Most carriers ask about multi-factor authentication, endpoint detection and response, protected and tested backups, patching, employee security training, an incident response plan and payment verification controls. The exact wording varies, but these controls appear on nearly every application.
Can a claim be denied if our application was inaccurate?
It can be disputed. Applications are part of the policy, so if you state a control was in place and an investigation shows it was not, the carrier may challenge coverage. Review each answer with IT before signing, and talk with your broker about any gaps.
Does a small organization really need an incident response plan?
Yes. Carriers increasingly ask for one regardless of size, and a short, practical plan is far better than none. It should name decision-makers, the insurer’s breach hotline, outside contacts and how you will keep operating. A one-hour tabletop exercise is enough to test it.
The Bottom Line
Cyber insurance requirements are really a description of good security hygiene. The controls carriers ask about are the same ones that keep a ransomware attack from becoming a week of downtime. For leaders across Cleveland, Akron and Canton, the smoothest renewals come from treating these controls as ongoing operations, documented all year, rather than a once-a-year paperwork exercise.
