What cyber insurance requires from a small business
The questionnaire has gotten longer every year. Here’s what’s on it, what each item means, and why a wrong answer can put your claim at risk.
Why the application matters
Cyber insurers lost money on ransomware and tightened up. Today most applications ask specific yes-or-no questions about your security controls, and the policy is written on your answers. If you say you have multi-factor authentication and an attacker gets in through an account that didn’t, many policies let the insurer reduce or deny the claim. Read your own policy’s terms or ask your agent. So the application isn’t paperwork; it’s a list of what you need to actually have.
What they ask for
- Multi-factor authentication (MFA) on email, remote access, and administrator accounts. This is the one almost every insurer now requires.
- Endpoint detection and response (EDR) on computers and servers. Not plain antivirus; a tool that watches behavior and alerts someone.
- Backups that are offline or immutable, meaning ransomware can’t encrypt them, and that are tested.
- Patching on a defined schedule, especially for anything facing the internet.
- Email filtering and protection against spoofing of your own domain.
- Security awareness training for staff, usually at least annually, often with phishing simulations.
- An incident response plan: who you call, in what order, written down.
- Access control: former employees removed promptly, administrator rights limited to people who need them.
- Encryption on laptops and mobile devices.
How to answer honestly and still get covered
Take the application to your IT provider before you fill it in. Every item above is something a managed IT provider can put in place in weeks, and most are included in a standard managed plan. The provider should also give you documentation: screenshots, policy settings, the date of the last backup test. Keep that with the policy. If you ever claim, it’s your evidence.
What it costs to comply
Less than people expect. MFA is usually free with your email service. EDR and email filtering are included for managed IT clients, and backup can be added to the plan. Training is a small per-user charge. The expensive part is a claim that’s reduced or denied because one of them was missing.
We set up and document every control on this list for clients across Central and Western Kansas. See our cybersecurity service, or start with the free security audit, which checks each of these.
Free download: cyber insurance readiness checklist
The nine security controls insurers ask small businesses about, as a two-page checklist you can fill in before your next renewal.
Sources
Common questions
Do we really need cyber insurance?
If you handle customer data, take payments, or would be hurt by a week without your systems, it’s worth getting quotes. Many customers and lenders now require it. The controls it demands are worth having either way.
Our agent said MFA is the main thing. Is that enough?
It’s the first thing. Insurers are adding EDR, tested backups, and training to the required list, and renewal questionnaires get stricter each year. Plan for the full list.
Can CK Technologies fill out the application for us?
We give you the technical answers and the documentation behind them. You sign it, because it’s your policy, but you won’t be guessing.
Want a straight answer for your office?
A free 15-minute call with a technician in Hays. No pitch.
Related: Cybersecurity · Free IT security audit · Banks and credit unions