What Cyber Insurance Requirements Really Mean for Your IT

For years, nobody checked whether smaller companies took security seriously. Regulators focused on large organisations, customers rarely asked, and the only real consequence of weak controls was the incident itself.

That changed quietly, and the auditor turned out to be your insurer. Cyber insurance requirements have become the most effective security standard in the mid-market, not because anyone legislated it, but because cover now depends on them.

Why insurers got strict

Early cyber policies were priced with very little data. Then ransomware turned into an industry, claims arrived in volume, and insurers discovered they were underwriting a risk they did not understand.

The response was predictable: premiums rose, cover narrowed, and the application form grew from half a page to something resembling an audit. Today the security questionnaire is where the real work happens, because your answers determine both the price and whether you are offered cover at all.

The cyber insurance requirements that come up every time

Wording varies between insurers, but the substance is remarkably consistent.

Multi-factor authentication, everywhere

This is the one that decides applications. Insurers want it on email, on remote access, on administrator accounts and on anything reachable from the internet. “Most users have it” is usually read as no, because attackers only need the exception.

Tested, separated backups

Not just that backups exist. That they are tested, that at least one copy cannot be reached or encrypted from your production network, and that you know how long a restore takes. Expect a question about when you last actually restored something.

Endpoint detection rather than antivirus

Traditional antivirus matches known threats. Insurers increasingly ask for endpoint detection and response tooling that spots suspicious behaviour, and some want to know whether anyone monitors the alerts outside office hours.

Patching with a timescale

The question is rarely “do you patch”. It is how quickly critical updates get applied, and whether that includes firewalls, VPN appliances and anything else exposed to the internet.

Access control and offboarding

Who has administrator rights, whether admin accounts are used for daily work, and how fast access is removed when someone leaves.

Training and an incident plan

Whether staff receive security awareness training, and whether you have a written incident response procedure. Some insurers now ask whether you have ever rehearsed it.

Why answering honestly is the only option

It is tempting to give the answer that gets the policy issued. Do not.

An insurance application is a declaration. If you state that multi-factor authentication is enabled everywhere and a claim later reveals the compromised account did not have it, you have handed the insurer a reason to reduce or refuse the payout. You will have paid premiums for years for cover that evaporates at the worst possible moment.

A conditional answer is far better than an optimistic one. Explaining that MFA covers all staff except three service accounts, with compensating controls in place, is a conversation. A false yes is a coverage problem waiting to happen.

Treat the questionnaire as free consultancy

Here is the useful reframe. Whatever you think of insurers, the cyber insurance requirements represent a decent security baseline distilled from millions of euros of claims data. They are not asking about exotic threats. They are asking about the handful of controls that actually stop real incidents.

So work through the form even if you are not buying a policy. Every question you cannot answer confidently is a gap worth knowing about, and every gap you close improves your position whether or not you ever claim.

The same document tends to reappear elsewhere, too. Larger customers increasingly send security questionnaires that cover much the same ground, and organisations in scope of NIS2 have to assess their suppliers. Meeting the cyber insurance requirements once prepares you for all of it.

What good preparation looks like

Before you fill anything in, gather the evidence rather than the impressions. A list of who has admin rights. The date of your last restore test. Your patching schedule. Which tools are actually deployed, on how many devices, versus which licences you bought.

That last distinction catches people out. Owning a licence for endpoint detection is not the same as having it installed and reporting on every machine, and an insurer asking after a claim will want the second.

Let us get you ready before you apply

Most companies fill in the questionnaire alone, guess at the technical questions and hope the answers hold. That is a bad position to be in, both at renewal and at claim time.

At EvolvingDesk we go through the cyber insurance requirements with you before you submit anything. We check what is genuinely in place, close the gaps that would otherwise force an awkward answer, and give you the evidence behind each response so you can sign the declaration knowing it is accurate. Where something cannot be fixed quickly, we help you describe it honestly along with the controls that compensate.

Better answers usually mean better terms. More importantly, they mean cover that still works on the day you need it.

Renewal coming up? Plan a call and send us the questionnaire. We will tell you which answers are currently a problem.

Read more

• The 3-2-1 backup rule explained
• What happens to your data when an employee leaves
• Managed IT services at EvolvingDesk

Further reading: the NCSC guidance on cyber insurance and the CISA cybersecurity performance goals.