Resources · Cyber Insurance
The controls carriers ask about most, what “yes” really has to mean, and how to get ready before your renewal date.
Updated October 10, 2026 · About a 6-minute read
Who this guide is for
Business owners, office managers, and finance leads who receive the renewal questionnaire and have to answer it — often without an IT person who owns security.
| Control | What a solid “yes” looks like |
|---|---|
| Multi-factor authentication (MFA) | Enforced for email, remote access (VPN, remote desktop), cloud apps, administrator accounts, and backup consoles — for every user, not just most. |
| Endpoint detection and response (EDR) | EDR, not just antivirus, on every workstation and server, with someone watching and responding to alerts. |
| Backups | Regular backups of critical systems and Microsoft 365, kept separate from your network (offline or immutable), and restore-tested on a schedule. |
| Patching | Operating systems and key applications updated on a defined schedule, with critical fixes applied quickly and no unsupported systems left in place. |
| Email security | Filtering for phishing and malicious attachments, plus email authentication records (SPF, DKIM, DMARC) for your domain. |
| Security awareness training | Regular training and phishing simulations for all staff, with completion tracked. |
| Privileged access | Separate administrator accounts, used only for admin work, and a short list of who holds them. |
| Incident response plan | A written plan that names who does what and who to call — including your carrier’s breach hotline — tested at least annually. |
| Vendor access | Know which vendors can reach your systems, require MFA for them, and remove access you no longer need. |
Review
Pull last year’s application and compare each answer with how things work today.
Assess
Check MFA coverage, EDR, backups, patching, and email security against the table above.
Fix
Close the quick gaps — MFA on remaining accounts, backup isolation, admin account cleanup.
Document
Collect evidence and update your incident response plan with your carrier’s contacts.
Submit
Answer the questionnaire with your broker, with notes and dates for anything still in progress.
Pricing depends on many factors, but missing core controls such as MFA and EDR commonly lead to higher premiums, exclusions, or declined coverage.
Ask for a report showing which accounts and systems are covered. Gaps on remote access, admin, or backup accounts are common and are exactly what the questions ask about.
You sign the application, so the answers must be yours. We review your environment, gather the evidence, close gaps, and go through the questions with you and your broker.
Our Beacon program includes the controls most carriers ask about — EDR, hardened Microsoft 365 MFA and Conditional Access, extended backups, and security awareness training — and your monthly report gives you the evidence to answer with confidence. Facing a renewal sooner? Start with a Compliance Readiness Assessment.
Every carrier’s application is different. This guide is general information to help you prepare, not insurance or legal advice; your broker and policy wording govern your coverage.
