Cyber Insurance Requirements: What Underwriters Check

Cyber insurance requirements are the security controls a carrier asks about before it binds or renews a policy. They vary by carrier, company size, and market, but the same questions recur in 2026: multi-factor authentication (MFA), endpoint detection and response (EDR), 24/7 monitoring, tested backups, and an exercised incident response plan. Underwriters increasingly want evidence of how each control operates, and an application answer that overstates a control can put coverage at risk after a claim, depending on the policy and the misstatement.

The security team sits at the center of a process often run by brokers and finance. The renewal questionnaire reads like a set of yes-or-no boxes, but each answer becomes a representation the carrier can test later, when a forensic firm reconstructs which accounts had MFA and which endpoints had an agent. Check how your own carrier's form phrases each question, since the examples below come from several insurance markets.

TL;DR:

• Carrier forms keep asking about the same core controls, and softer pricing hasn't changed that.
• Underwriters ask how far each control reaches: which accounts MFA covers, what share of endpoints run EDR, and who can act on an alert at night.
• Some carriers offer credits or shorter waiting periods tied to specific or qualifying managed detection and response services.
• Application answers can decide a claim, which is why the people who verify each control should own those answers.

Common Cyber Insurance Requirements in 2026

Cyber pricing has softened, but underwriters remain prudent on critical controls, according to Aon's Q3 2026 market report. Carriers don't share a single mandatory list, yet the same controls come up on form after form.

1. MFA, Scoped and Enforced

MFA is usually the first control an underwriter checks, and on its own it no longer meets insurers' minimum standards, according to a 2024 Lockton briefing for law firms.

Beazley's 2023 application asks separately about MFA for remote access, web-based email, and privileged Azure Active Directory accounts, plus how domain administrator accounts are protected. Chubb's proposal form spells out what doesn't count as a second factor: "a shared secret key, an IP or MAC address, a VPN."

Remote access is where many ransomware attacks begin. In At-Bay's 2025 data, 73% of ransomware attacks began with a VPN.

In Resilience's manufacturing portfolio, misconfigured MFA was behind about 26% of incurred losses, compared with roughly 8% for no MFA at all. The share includes the portfolio's single most expensive event, so read it as where losses landed rather than as risk to any one company.

2. EDR Coverage and Configuration

Some forms now measure EDR coverage as a share of the fleet. Chubb's form asks for the percentage of endpoints covered by EDR, managed detection and response (MDR), or extended detection and response (XDR), and whether the tool automatically isolates or blocks activity. Check that setting before you answer, and list any devices that can't run an agent, such as legacy servers or operational technology, along with the controls that cover them.

In Marsh McLennan's August 2025 research, each 25% increase in EDR deployment across workstations and laptops correlated with a further 10% drop in breach likelihood.

3. 24/7 Monitoring With Response Authority

Carriers often assess 24/7 monitoring through form questions and incentives. Coalition offers a premium credit of up to 12.5% with its own automated detection and response product, and a separate credit that customers of other MDR services may qualify for. Chubb describes a loss control discount of up to 10% that may be available through one preferred MDR provider program.

On the forms, coverage hours and response authority are separate questions. Beazley's 2023 application asks whether your security operations center (SOC) runs working hours only or 24/7, and its 2022 ransomware supplemental asked whether the SOC has the "authority and ability to remediate security events," such as isolating endpoints remotely. If an MDR provider covers your nights and weekends, pull the contract language that defines which actions it can take without asking you first, and keep it with your application. Answer the hours question for the coverage you have today, since a service you plan to buy before renewal doesn't count yet.

4. Offline Backups and Tested Restores

Backup questions focus on separation and restoration. Chubb's form asks about offline or air-gapped copies, annual full-restore tests, and whether the restore plan covers ransomware. Beazley asks how often you test a restore, from never to quarterly or more. When you answer, say which systems the last test covered and whether it was a full restore or a sample of files.

Aon's 2025 Cyber Risk Report found that MFA and phishing education mostly affect event frequency, while backup and recovery controls more often affect severity. In At-Bay's 2023 claims analysis, effective backups cut ransomware claim severity by 41%.

5. A Documented, Exercised Incident Response Plan

Organizations that regularly run tabletop exercises were 13% less likely to have a material cyber event in Marsh McLennan's 2025 research.

Use the exercise to check vendors too. Chubb, for example, requires non-panel providers to be listed on the policy before any incident or claim, so confirm that the firms named in your incident response plan are approved or listed.

6. PAM, Patching, Email, and Segmentation

Privileged access management (PAM), patch cadence, email authentication, and segmentation of end-of-support systems also appear on carrier forms. Beazley's 2023 application, for example, asks whether end-of-life software is on the network and whether it is segregated. How much weight each carrier gives them varies. Where a form asks about segregation, describe how: a separate network segment, blocked internet access, and restricted admin accounts tell an underwriter more than a single yes.

How Controls Affect Cyber Insurance Premiums and Claims

Strong controls can improve your position on price, retentions, and coverage terms, though outcomes vary by carrier and risk profile. In Marsh's Q3 2026 index, global cyber rates fell 4% and US rates were flat, and many buyers used the added capacity to broaden coverage and lower retentions. Buyers with weaker controls may still see upward pricing pressure and tighter sublimits, Lockton warned in July 2026.

Carriers rarely publish what a single control is worth in premium, so product terms are the better guide. Coalition's enhanced business recovery endorsement, launched in April 2026 for US and Canadian policies outside Quebec, shortens the business interruption waiting period when a qualifying MDR provider is in place.

In 2022, Travelers sued to rescind the policy of International Control Services (ICS), alleging the company had said MFA protected administrative or privileged access while using it only on its firewall. In August 2022, the two sides agreed to rescind the policy and dismiss the case, so no court ruled on the allegations.

Coverage counsel at Shumaker wrote in September 2026 that a single unimplemented control can support a coverage denial, a policy limitation, or, where the representation was materially inaccurate, rescission.

Underwriters Now Ask for Evidence Behind the Answers

Underwriters increasingly want proof that a security program is actively managed and continuously improved, according to Aon's October 2026 report on professional services firms.

Many carriers also scan applicants' internet-facing systems, and Travelers described its own scan and cyber score as central to underwriting in 2025. The rest of the proof comes from artifacts a checkbox can't provide.

Build an evidence pack before the questionnaire arrives. For each core control, keep one current artifact: an MFA enforcement report from your identity provider, an EDR console export that shows covered and uncovered devices, the latest restore test with its date and duration, and the after-action notes from your most recent tabletop. Date each one, note who produced it, and refresh it each quarter, so the answers on renewal day match what your tools show.

How to Meet Cyber Insurance Requirements Before Renewal

Fix each gap below before the application goes out, since every one maps to a question the carrier is likely to ask:

• If MFA has exceptions for users, privileged accounts, legacy authentication, or VPN appliances, close those before buying anything new. For non-interactive service accounts that can't use MFA, document the compensating controls, and disclose any exceptions that remain.
• If EDR covers less than the full fleet or only logs, fix coverage and blocking before the next application, then report the real percentage.
• If nobody can act on alerts outside business hours, evaluate managed monitoring with explicit remediation authority. Coalition and Chubb, for example, offer credits or discounts that can apply to MDR services.
• If you have never run a timed full restore, run one on your most critical systems and record the result against your recovery time objective. A single restore log answers several application questions at once.
• If your incident response plan names vendors the carrier hasn't approved, reconcile them with the policy before binding. An MDR provider's containment and a panel firm's forensic work are separate incident response services, so confirm who handles each step.
• If the security team doesn't review the final application, add that review to the signing process.

Keep the evidence from each fix with the application file, since carriers may ask for it.

Why EDR Needs Someone Watching It

MDR is EDR plus someone watching it full time, as Coalition's VP of security research put it in 2024. At-Bay's 2026 InsurSec Report covered the SonicWall-linked Akira ransomware attacks of 2025. In those attacks, 60% of victims had a leading EDR product in place, and the only businesses that avoided full encryption had EDR backed by 24/7 MDR monitoring. The finding doesn't show that monitoring prevents encryption every time.

Before renewal, confirm who investigates an alert at 3 a.m. and whether they can isolate an affected host, the remediation authority Beazley's supplemental asks about. MDR combines 24/7 monitoring, investigation, and response where the contract allows, which addresses that question directly. Daylight offers AI-native MDR that pairs 24/7 investigation with response actions taken under the customer's contract.

Frequently Asked Questions About Cyber Insurance Requirements

Does an Outsourced MDR Satisfy the Monitoring Question the Same Way an In-House SOC Does?

Forms ask about the operating model directly, so describe yours precisely. Chubb's Singapore proposal form lists MDR and a SOC as separate options, and its UK form asks whether a SOC is internal, external, or hybrid. Hybrid fits a co-managed setup, where a provider covers some hours or functions and internal staff cover the rest.

Are Underwriters Asking for Phishing-Resistant MFA Yet?

Not as a separate answer on the Chubb and Beazley forms; Chubb's, for example, counts a text message as a second factor. Microsoft is already moving Entra ID toward phishing-resistant MFA, which is a good reason to adopt it before the forms ask. It began auto-enabling passkeys in September 2026 for users on SMS or voice, and it will stop delivering those codes itself from February 2027 for most users, though a third-party telephony provider can keep them running.

Do Requirements Differ for Small Businesses?

In some markets, yes, mostly in how much the carrier asks. Beazley maintains a separate application for companies above $250 million in revenue. Coalition went further in June 2026. For eligible small and midsize enterprises in Australia, control questions became optional for a quote, with Coalition relying on its own outside-in assessment. The program covers businesses under AUD 25 million in revenue, and positive answers to the optional questions can lower the premium.

Who Should Sign the Application, and Does It Matter?

It matters, because the signer represents that the answers are accurate. Axis's ransomware supplemental lists eligible signers including the CEO, CIO, CTO, chief security officer, CFO, general counsel, and risk manager, or their functional equivalents. In the Travelers case, the application was reportedly signed by the CEO and the person responsible for network security.

Will AI Questions Appear on Our Cyber Application?

Probably, depending on carrier and sector. Gallagher's Q1 2026 financial institutions update describes underwriters asking more pointed questions about AI governance and use, and questions still vary by carrier. Document your AI usage policy and approved tools before the broker asks.