The renewal questionnaire lands in your inbox with a two week deadline and forty questions written by someone who has never seen your environment. You answer yes to MFA because MFA is on. Nine months later a claim gets adjusted, someone pulls the sign-in logs, and it turns out four admin accounts were excluded the whole time.
Cyber insurance security requirements are the set of technical controls an underwriter treats as a precondition for coverage, and in 2026 the core five are phishing-resistant MFA on all remote and privileged access, EDR on every endpoint and server, immutable or offline backups with tested restores, a documented and exercised incident response plan, and current patching with no end-of-life systems. Answers are increasingly verified rather than trusted, through external scans at quote time and forensic review at claim time.
Why the Questionnaire Got Harder
Carriers spent 2020 to 2022 paying ransomware claims that ate their loss ratios, so they tightened the underlying controls and started checking. Most now run an external attack surface scan on your domains before quoting, and a growing number ask for artifacts rather than checkboxes: deployment reports, coverage percentages, restore test logs.
The application is also a legal document. Your answers become representations the policy relies on. Get one materially wrong and the carrier has grounds to reduce or deny at exactly the moment you need the money. That risk is bigger than the premium.
1. Multi-Factor Authentication Everywhere
The MFA requirement in cyber insurance has stopped being a yes or no question. Carriers now ask it in five parts: email, VPN, remote desktop, all administrator accounts, and privileged service accounts. A clean pass needs yes on all five.
Two things trip people up. First, executive exclusions: somebody exempted the CFO because push prompts annoyed them, and that exemption is still live. Nearly every 2026 form asks directly whether any VIP accounts are excluded. Second, SMS. Carriers now split the question into "is MFA enforced on admins" and "is it phishing-resistant," which means FIDO2 keys or certificate-based auth, not text messages. Token theft and MFA bypass is why they started asking.
Before you answer, pull the actual number, not the policy. In Entra ID that means checking Conditional Access coverage against sign-in logs, including legacy authentication paths and break-glass accounts, which need documented compensating controls rather than a silent exemption.
2. What Insurers Check and Why
| Control | What they verify | Why it drives the premium |
|---|---|---|
| Phishing-resistant MFA | Coverage percentage on email, VPN, RDP, admins | Credential theft starts most claims |
| EDR or MDR | Agent coverage across endpoints and servers, 24/7 monitoring | Determines whether ransomware is contained or total |
| Immutable backups | Object lock enabled, immutability window, tested restores | Decides if the ransom gets paid |
| Privileged access management | Count of standing admins, separation of backup credentials | Limits blast radius of one compromise |
| Patching and EOL systems | Time to patch critical CVEs, unsupported OS inventory | Predicts exploitable external exposure |
| Email security and training | Filtering, DMARC, phishing simulation results | Cheapest control with measurable loss reduction |
| Incident response plan | Date of last tabletop exercise | Shortens dwell time and claim cost |
3. Backups Are the Question That Sets Your Price
Underwriters care about backups more than anything except MFA, because backups decide whether a ransomware event is a bad week or an extinction event. The answer they want references object lock or write-once storage, an immutability window of at least 14 days with 30 preferred, backup credentials that are separate from production admin accounts, and a restore test performed in the last quarter.
That credential separation is the one most SMBs fail. If your domain admin can also delete backup snapshots, an attacker who owns that account owns your recovery too. Say so honestly if it is true, then fix it before renewal.
4. The Answers That Void Claims
Three patterns cause the most trouble. Answering for intent rather than reality, as in "we require MFA" when enforcement covers 87 percent of accounts. Answering once and never revalidating, so a true answer in January is false by September. And answering from a policy document instead of from the systems themselves.
The safe habit: date and store the evidence behind every answer you submit alongside the application. If a claim gets scrutinized, you want to show what was true on the day you signed, not reconstruct it under pressure.
5. Turning Posture Data into Application Answers
Most of what an insurer asks about lives in Azure, Microsoft 365, and AWS configuration, which means it can be measured rather than estimated. MFA enforcement, admin counts, storage immutability, logging retention, and public exposure are all queryable facts. SecValley's platform scans those environments and maps findings to carrier questionnaire items, so the number you write down comes from the tenant rather than from memory. That also gives you a dated record, which matters for the same reason SOC 2 evidence does.
Start with your last application. Take each yes and go find the control that proves it. The gaps you discover this week are cheaper than the ones your carrier discovers during a claim.
Frequently Asked Questions
What are the minimum cyber insurance security requirements in 2026?
Most carriers treat five controls as mandatory: MFA on email, remote access, and all privileged accounts, EDR or MDR across endpoints and servers, immutable or offline backups with tested restores, a documented incident response plan, and timely patching with no end-of-life systems in production. Falling short usually means sub-limits, a ransomware coinsurance clause, or declination rather than a higher price.
Can an insurer deny a claim over a wrong application answer?
Yes. Application answers are representations the policy relies on, so a material misstatement gives the carrier grounds to rescind or reduce payment. The common scenario is not deliberate lying, it is an answer that was optimistic when submitted and never revalidated. Keep dated evidence for each answer.
Does SMS-based MFA satisfy cyber insurance requirements?
For general users, often yes. For administrators, increasingly no. Carriers now ask separately about phishing-resistant methods on privileged accounts, meaning FIDO2 security keys, passkeys, or certificate-based authentication, because attacker-in-the-middle kits defeat SMS and push approval routinely.
How much can better security controls reduce cyber insurance premiums?
Brokers commonly report meaningful reductions for tightening MFA, EDR, and backup immutability, though the larger effect is usually on terms rather than price. Better controls remove ransomware sub-limits, lower retentions, and restore coverage that would otherwise be excluded. Ask your broker to quote the same limits under both scenarios so you can see what the controls actually buy.
