Cyber insurance carriers now treat a short list of security controls as the price of admission: multi-factor authentication on everything (email, remote access, VPN, and administrator accounts), endpoint detection and response on every machine, backups that are offline or immutable and have been test-restored, email filtering, security awareness training, a documented patching cadence, and separated privileged accounts. If you cannot answer yes to those on the application, most carriers will decline, quote a much higher premium, or bind the policy with a sublimit that guts the part you were buying it for.
The harder truth is what happens next. The questionnaire you sign is part of the insurance contract, and if an answer turns out to have been wrong when the claim gets adjusted, the carrier has grounds to reduce or deny payment on the exact loss the policy was supposed to cover.
None of this is legal or insurance advice. Your policy language and your broker govern. This is the IT side: what the controls mean in practice, what has to be true before you sign, and what order to fix things in.
What do cyber insurance carriers require?
These show up on nearly every application and renewal questionnaire in the market. Treat them as table stakes, not a wish list.
Multi-factor authentication, everywhere. Not just email. Carriers ask separately about email, remote access and VPN, and administrative or privileged accounts, and increasingly about access to backup systems. A single unprotected remote access path is the most common reason a “yes, we have MFA” answer is quietly false. One legacy application, one service account, or one vendor VPN tunnel without MFA means you do not have MFA everywhere, and that is exactly what an adjuster looks for.
Endpoint detection and response (EDR). Signature-based antivirus is no longer enough for most carriers. Several now ask for coverage as a percentage of your asset count. The gap that hurts is unmanaged devices: the shop-floor PC, the personal laptop, the server nobody wants to touch.
Backups that are offline or immutable, and tested. Two halves to that question. Are the backups outside the reach of an attacker who owns your domain admin account (offline, air-gapped, immutable object storage, or a separately credentialed cloud tenant), and have you actually restored from them. A backup that has never been restored is a hypothesis, and “we have backups” does not answer how long it takes to get back. A dated restore test with a recorded start and finish time does.
Email filtering and anti-phishing controls, including the email authentication records. SPF, DKIM, and DMARC are now named line items on several applications.
Security awareness training, documented and recurring, with completion records. Most carriers want at least annual training, and many ask about simulated phishing and the click rate.
A documented patching cadence. Not “we patch regularly.” Carriers ask how fast critical vulnerabilities get remediated, and the common expected windows are days for critical items on internet-facing systems and weeks for the rest. You need the report that proves it, plus the exception list.
Privileged access controls. Admin accounts separated from daily-use accounts, no shared credentials, local administrator rights removed from standard users, and a periodic review of who has elevated access. Offboarding gets asked about too, because dormant accounts belonging to former employees are a recurring claim story.
Expect further questions on incident response planning, logging and retention, vendor access, encryption, and end-of-life systems. Unsupported Windows Server or an unsupported firewall on the perimeter is often a hard stop on its own.
What happens if a questionnaire answer turns out to be wrong at claim time?
The application and security questionnaire are typically incorporated into the policy as representations you made to obtain coverage, which makes the accuracy of your answers a contractual matter rather than a formality. When a claim is filed, the carrier’s forensic firm reconstructs the intrusion, and that reconstruction produces specific answers: which account was compromised, how the attacker got in, whether the endpoint agent was running on that machine, whether the backup was reachable from the compromised domain.
If the forensics show the attacker walked in through a remote access path with no MFA, and your questionnaire said MFA was enabled on all remote access, the carrier has a documented mismatch between what you represented and what was true. Depending on policy language and applicable law, outcomes range from a reduced payout or a coverage dispute to rescission. Carriers have litigated this, and the disputes are public.
The failure is almost never a lie. It is one of these four:
- Somebody answered for a system they do not administer. The form never made it to IT.
- The control was true when signed and drifted afterward. MFA was enforced, then an exception was granted for a vendor integration in March and never revisited.
- The answer was true for most of the environment, not all of it. Ninety-four percent EDR coverage is a good number and a false yes to “is EDR deployed on all endpoints.”
- Nobody defined the term the way the carrier does. “Offline backup” to you meant a second cloud copy. To the carrier it meant unreachable from a compromised administrator account.
The practical rule: nobody signs a cyber questionnaire without the person who administers the systems reviewing every technical answer in writing, and you keep the evidence that supported each answer on the date you signed. If an answer needs qualifying, qualify it on the form. Carriers handle qualified answers all day. What they do not forgive is a clean yes that turns out to be a no.
How do underwriters verify what you tell them?
Less than they used to take on faith, and more than most applicants expect.
External scanning. Most carriers run an outside-in scan of your public footprint before quoting. It picks up exposed remote desktop, open management ports, expired certificates, unsupported software versions visible in banners, weak or missing DMARC and SPF records, and known-vulnerable edge devices. Nobody tells you they did it. You just see the effect on the quote.
Breach and credential exposure data. Underwriters check whether your domain shows up in credential dumps, and how much.
Evidence requests. At larger limits, expect requests for the MFA policy, an EDR coverage report, or backup job logs, and sometimes a broker attestation on specific controls.
Renewal comparison. Underwriters read this year’s questionnaire against last year’s. An answer that flips gets attention.
The claim itself. The most rigorous verification any carrier performs happens after a loss, and it is retroactive. That is the one that matters.
What drives a premium up, and what gets an application declined?
Premium and retention drivers: prior claims history, a high loss ratio industry (healthcare, professional services holding sensitive records, manufacturing with operational technology exposure, municipalities), the volume and sensitivity of records you hold, revenue, partial control answers, unsupported operating systems, no tested recovery, and single points of failure such as one hypervisor with no offsite copy.
Common declination triggers: no MFA on email or remote access, no EDR, internet-exposed remote desktop, unsupported end-of-life systems on the perimeter, no offline or immutable backup, a recent ransomware event with no evidence of remediation, or refusal to answer the questionnaire in detail.
Watch for coverage narrowing instead of an outright no. Carriers increasingly bind with conditions: a ransomware sublimit well below the policy limit, coinsurance on cyber extortion, a warranty that MFA is in place (which conditions coverage on that control being true), or a longer waiting period before business interruption coverage starts. A policy that binds is not the same as a policy that pays. Have your broker walk the sublimits and any warranty language line by line, because that is where the money is.
What order should you close the gaps in?
Order the work by what a carrier weights heaviest and what an attacker exploits first. Same list, mostly.
- MFA on email and every remote access path, including admin accounts. Highest impact, fastest to implement, most common single point of failure on a claim. Inventory every way into the network first. The tunnel you forgot about is the one that matters.
- EDR on 100 percent of endpoints and servers, with a coverage report you can print. Find the unmanaged machines. They exist.
- An offline or immutable backup copy plus a dated restore test. If you only do three things, this is the third.
- Remove internet-exposed remote desktop and retire unsupported perimeter systems. These are what an external scan finds and an underwriter reacts to immediately.
- Privileged access cleanup. Separate admin accounts, remove standing local admin rights, review who holds elevated access, and fix offboarding so accounts get disabled the day someone leaves.
- Patch cadence with reporting. Define the window for critical items, then produce the monthly report that proves you met it and lists the exceptions.
- Email authentication and filtering. SPF, DKIM, and DMARC at enforcement, plus link and attachment protection.
- Security awareness training with records, and phishing simulation.
- A written incident response plan with named contacts, and one tabletop exercise a year. Put the carrier’s claim hotline in it.
- Logging and retention, enough history that a forensic firm can reconstruct an intrusion. Thirty days is thin.
Finish on a schedule that lands at least 60 days before renewal, not the week the questionnaire arrives. Controls implemented last Tuesday are hard to evidence, and a carrier that sees a scramble prices for it.
What this looks like for a small or mid-market business in the Chicago area
A 40-person manufacturer in the Chicago suburbs and a 200-person professional services firm in downtown Chicago get the same questionnaire a Fortune 500 gets. The controls are not scaled to headcount. That is the whole problem at this size: enterprise requirements, and the person holding the form is a CFO, an owner, or an office manager who also runs payroll.
Patterns that repeat here:
- Legacy line-of-business applications. Chicago-area manufacturing, distribution, and professional services firms run older ERP, accounting, and shop-floor systems never designed for modern authentication. That is usually where the MFA gap lives, and those systems need a compensating control (segmentation, a jump host with MFA in front of it, restricted access) plus an honest note on the questionnaire.
- Multi-site and hybrid access. A suburban headquarters, a second location, remote staff, and a vendor tunnel or two adds up to more remote access paths than anyone has written down.
- The one server nobody wants to touch. There is almost always an unsupported box running something critical. It is both a declination risk and a ransomware entry point.
- Renewal timing. Questionnaires arrive 30 to 60 days out, land on a full finance calendar, and get answered fast. That is the exact condition that produces a wrong answer.
The workable approach for a small or mid-market business in Chicago or the Chicago suburbs is to treat the questionnaire as an annual IT project with a deadline, not a form. Pull last year’s questionnaire now. Have whoever administers your systems mark each answer green, yellow, or red against what is true today. Fix the reds in the order above, then answer this year’s form from evidence instead of memory.
RJ2 Technologies has worked with Chicago-area businesses since 1998 and is headquartered in Deer Park, Illinois. Engineers working downtown use a drop-in space at 333 S. Wabash Ave., Suite 2700, which is a working space rather than a staffed office. RJ2 supports clients through the questionnaire by providing the information and suggestions behind each technical answer. We do not fill out or sign the form, and we work alongside Chicago-area brokers. If you want a second set of eyes before you sign, start with an assessment: call 847-303-1194 or email sales@rj2t.com. Where policy language is at issue, your attorney should review it.
Frequently asked questions
Does cyber insurance require MFA on everything, or just email?
Most carriers now ask about email, remote access and VPN, and administrative or privileged accounts as separate questions, and increasingly about access to backup systems. Answering yes to the email question does not answer the others. If any remote access path into your network lacks MFA, you cannot honestly claim MFA everywhere, and that gap is the most common finding in post-claim forensic reports.
Can a cyber insurance claim be denied because of a wrong questionnaire answer?
Yes. The application and security questionnaire are typically incorporated into the policy as representations made to obtain coverage. If a forensic investigation shows a control you attested to was not in place, the carrier may have grounds to reduce payment, dispute coverage, or in some circumstances rescind the policy. How that plays out depends on your specific policy language and applicable law, which is a question for your broker and your attorney, not your IT provider.
What is an immutable backup, and why do carriers ask about it?
An immutable backup cannot be modified or deleted for a defined retention period, even by an account with administrative rights. Carriers ask because modern ransomware operators specifically hunt for and destroy backups before encrypting anything. A backup that a compromised domain administrator account can reach is not protection against the loss the policy is meant to cover.
How far in advance should we prepare for a cyber insurance renewal?
Start 60 to 90 days out. Questionnaires generally arrive 30 to 60 days before renewal, and controls like full EDR coverage, MFA on legacy systems, or a tested restore take weeks to implement and document. Preparing early also gives your broker time to market the account to more than one carrier.
Do carriers actually check what we put on the form?
Before binding, many run external scans of your public-facing footprint and check your domain against breach and credential exposure data, and at higher limits they request evidence such as coverage reports or screenshots. After a loss, verification is thorough and retroactive, because the forensic investigation establishes exactly how the attacker got in.
Will fixing these controls lower our premium?
It can, and more importantly it changes what you are offered: better terms, higher sublimits for ransomware and cyber extortion, and fewer control-related warranties. Pricing depends on your industry, revenue, claims history, and the carrier’s own appetite, so ask your broker to model it. Nobody in IT can quote you a premium.