The application is a security audit with a deadline.
What do cyber insurance requirements typically include? Most applications now require multi-factor authentication on email, remote access, and administrative accounts; endpoint detection and response on every device; backups that are separated from the network and tested; a written incident response plan; timely patching; email security controls; and some form of security awareness training. Answering "no" to the wrong one can mean a higher premium, an exclusion, or no policy. Answering "yes" inaccurately can mean a denied claim.
Why the questions got harder.
Insurers lost money on ransomware and email fraud. The application is how they price that risk, and the controls they ask about are the ones that stop the losses they pay for.
Email scams now drive more cyber insurance claims than anything else. At one large cyber insurer, business email compromise and funds transfer fraud together made up most of the claims filed with it. Ransomware is the other weight: Verizon's 2025 Data Breach Investigations Report found it in 88% of breaches at smaller organizations, compared with 39% at larger ones.
So carriers ask for proof, not intent. A "yes" on multi-factor sign-in has to cover every account the question names. A "yes" on backups has to mean a backup that was restored in a test. Missing controls can mean a higher premium, lower limits or an exclusion at renewal, and an inaccurate answer can undo the policy when you need it.
| What applications ask about | What a defensible "yes" looks like |
|---|---|
| Multi-factor authentication | On email, remote access and every administrative account, with no shared logins left out. |
| Endpoint detection and response | On every laptop, desktop and server, monitored by someone who will act on an alert. |
| Backups | Separated from the network, protected from deletion, and restored in a test, with the date written down. |
| Patching | A defined window for critical updates, and a way to show it is being met. |
| Privileged access | Admin rights limited to the people who need them, on separate accounts. |
| Email and payment controls | Filtering, SPF, DKIM and DMARC on the domain, and a call-back rule before anyone changes bank details or sends a wire. |
| Incident response | A written plan with names and phone numbers, reviewed in the last year. |
| Training | Phishing awareness for everyone with an inbox, on a schedule. |
| AI | Newer questions about which AI tools are in use and what data goes into them. |
Score your readiness before the insurer does.
Sixty-four checks across the eight areas current applications ask about: MFA, endpoint detection, email and payment controls, backups, patching, privileged access, incident response, and AI. Section scores update as you go, and you get a written read of where to start.
Answer honestly, then close the gaps. An accurate "not yet" with a dated plan is worth more than a "yes" the insurer can later dispute. Most gaps can be closed inside a renewal window without replacing anything, and often with the provider you already have.
In Massachusetts, the application and the law overlap.
Any business that holds personal information about a Massachusetts resident, including its own payroll records, needs a written information security program under 201 CMR 17.00.
The regulation and the insurance application ask for many of the same things: multi-factor sign-in, encryption on laptops and on data sent over public networks, access limited to the people who need it, monitoring, and oversight of the vendors who handle your data. A current program answers a good part of the application, and the work for one usually counts toward the other.
Read the plain guide to 201 CMR 17.00, or check your email controls with the free Domain Check.
Or send us the application itself.
The Cyber Insurance Application Pre-Check. Send us the application, or the renewal questionnaire. We go through it line by line, tell you which answers are solid, which are exposed, and what closes each gap by the deadline, with options that involve your current provider and options that pay us nothing.
Is MFA required for cyber insurance?
In nearly every application now, on email, remote access, and administrative accounts at minimum.
What happens if I answer inaccurately?
A claim can be denied on the basis of the application. Accuracy is worth more than a clean-looking form.
Can I meet the requirements without replacing my systems?
Usually. Most items are configuration, process, and a tested backup, not new platforms.
Do insurers ask about email authentication?
Many do. Applications increasingly ask about email filtering and about SPF, DKIM and DMARC, because forged email sits behind so many fraud claims. You can see where your domain stands with the free Domain Check.
How early should we start before renewal?
Sixty to ninety days gives room to close most gaps. Some items, such as moving DMARC to enforcement or proving a backup restores, take a few weeks to do safely, so the earlier the better.
Does the application overlap with Massachusetts 201 CMR 17.00?
Heavily. Multi-factor sign-in, encryption on laptops, access control, monitoring and vendor oversight show up in both. A current written information security program usually answers a good part of the application.
Answer the application accurately, on time.
The Digital Presence & Technology Review is the fastest way to see how we work, and it costs nothing. If the situation is already clear, start a conversation instead.
