What Cyber Insurers Now Require Before They'll Cover You 

Cyber insurance underwriting has changed considerably in recent years. Applications that once consisted of a brief questionnaire now involve detailed technical reviews, and insurers treat each answer as a warranty. An inaccurate response can result in a denied claim, even after years of premium payments. 

The shift is a direct response to the rising cost of ransomware claims. Insurers now underwrite based on demonstrated security controls: organizations that can verify specific safeguards qualify for coverage, while those that cannot may face declined applications, higher premiums, or exclusions on the coverage that matters most. 

The controls insurers assess 

Requirements vary by carrier, but Canadian insurers consistently evaluate the following: 

• Multi-factor authentication (MFA) on email, remote access, and administrator accounts. This requirement is now nearly universal, and many carriers will not issue a quote without it. 
• Endpoint detection and response (EDR) deployed on servers and workstations, rather than traditional antivirus alone. 
• Backups that are offline, offsite, or immutable, supported by evidence of regular restore testing. Insurers are aware that ransomware operators target accessible backups first. 
• Patch management, with critical security updates applied within a defined timeframe. 
• Security awareness training for staff, typically including phishing simulations. 
• A written incident response plan that assigns clear responsibilities for the initial hours of a security incident. 
• Email filtering and domain protections (SPF, DKIM, DMARC) to guard against spoofing and payment fraud. 
• Privileged access controls, including separate administrator accounts and offboarding procedures that remove access on an employee's departure date. 

Where applications commonly go wrong 

Inaccurate answers given in good faith. An application asks whether MFA is enforced on all email accounts, and the response is yes because MFA is enabled for most users. A breach then originates through service accounts that were excluded. Carriers have denied claims and rescinded policies on precisely this basis. In one widely cited US case, an insurer successfully petitioned to void a policy after a breach entered through a system the application described as protected. Every affirmative answer should be one the organization can substantiate. 

Answers that become outdated. An application reflects the environment as it existed at renewal. When a new remote access tool is introduced, a contractor is onboarded, or a server is migrated, the original answers may no longer be accurate. Security controls require an accountable owner who maintains them throughout the policy period, not only during renewal. 

An inability to produce evidence. Following an incident, the carrier's forensic team will request MFA enforcement reports, patching records, backup logs, and training completion records. Claims are supported by documentation, not by general assurances that controls were in place. 

How to prepare for your renewal 

1. Obtain the application early. Review every question with your IT team or provider before responding. Beginning sixty days ahead of the deadline allows time to address any gaps. 
2. Assess your environment against the requirements above. Any control you cannot currently verify should be treated as a project to complete before the application is signed. 
3. Prioritize the controls that carry the most weight. MFA, EDR, and protected backups are the most significant factors for underwriters, and they are also the controls that prevent the majority of attacks. Given the cost of a data breach in Canada, these investments are worthwhile independent of insurance considerations. 
4. Assemble an evidence file. Maintain enforcement reports, patch records, restore test results, training logs, and your incident response plan in one current location. This documentation streamlines underwriting today and supports any future claim. 
5. Have IT review the final answers. The signatory is warranting technical facts. The individual with direct knowledge of those facts should review the completed application before submission. 

The broader benefit 

Each item on an insurer's checklist represents sound security practice in its own right. An organization that can complete the application accurately is one that is difficult to breach, positioned to recover quickly when an incident occurs, and able to approach every renewal with verified answers rather than estimates. The documentation satisfies the insurer; the underlying resilience protects the business. 

Superion's managed cybersecurity services implement the controls insurers require, supported by the documentation to verify them. If your renewal is approaching, contact us to arrange a cyber risk assessment and complete your application with confidence.