Cyber Insurance Requirements: A Small Business Checklist

Cyber insurance used to be a short form and a signature. After several years of ransomware claims, insurers tightened their underwriting. Today the application is effectively a security questionnaire, and the answers change whether you get covered, what you pay, and whether a future claim is honored.

If your business has 10 to 75 employees and runs on Microsoft 365 or Google Workspace, the controls below are the ones carriers ask about most often. Use this as a checklist before your next renewal.

The controls almost every application asks about

• Multi-factor authentication (MFA): on email, remote access, and administrator accounts at a minimum. This is the single most common requirement.
• Endpoint detection and response (EDR): modern protection on laptops and servers, not just consumer antivirus.
• Tested backups: backups that are recent, stored separately, and actually restored on a schedule. Insurers increasingly ask whether you have tested a restore.
• Email security: SPF, DKIM, and DMARC for your domain, plus phishing protection. See our DMARC and email security work for detail.
• Access control: least-privilege access, prompt removal of departing employees, and limited use of administrator accounts. Our offboarding security page covers the leaver side.
• Patching: a routine for keeping operating systems and key applications up to date.
• Security awareness: basic training so staff can recognize phishing and payment fraud.
• Incident response plan: a written, basic plan for who does what if something goes wrong.

What insurers mean by evidence

Answering yes is not enough if you cannot show it. Evidence usually means a screenshot of a setting, a short written policy, or a report from a tool. The goal is to answer the questionnaire accurately and to have something on file if the carrier asks. Organizing that evidence ahead of time is most of the work, and it is exactly what a Tecnico Ready security review produces.

Common reasons coverage is declined or priced higher

• MFA is missing on email or administrator accounts, or it is inconsistent across the company.
• Backups exist but have never been tested with a real restore.
• Consumer antivirus is in place instead of endpoint detection and response.
• Former employees still have active accounts or mailbox access.
• The questionnaire is answered optimistically rather than accurately, which can create problems at claim time.

How Tecnico Desk helps

Tecnico Desk is a security-first IT and cloud security partner. We help you put the required controls in place, then organize the evidence so you can answer a cyber insurance questionnaire accurately. We do not provide legal or insurance advice, and we cannot guarantee approval or pricing, because the carrier makes that call. What we can do is close the gaps that cause most denials. Start with cyber insurance readiness or a Tecnico Ready review.