Cyber insurance requirements: the controls insurers now ask about

Why cyber insurance requirements have changed

A few years ago, getting cyber insurance was easy. You answered a few simple questions and got a policy. Today, the landscape is different. Because of the rise in ransomware and data breaches, insurance companies are paying out huge claims. To stay profitable, they have raised the bar. Now, to get coverage, you must meet strict cyber insurance requirements. If you don't have certain controls in place, you might be denied coverage entirely.

Insurance companies are no longer willing to take on the risk of businesses that ignore basic security. They see themselves as partners in your defense. By requiring these controls, they help you reduce the chance of a claim, which benefits everyone. Understanding these requirements is the first step to securing your policy and your business.

The 'Big Three' requirements

While every insurer is different, there are three requirements that appear on almost every application today. If you are missing any of these, you should expect to be rejected or to pay a very high premium.

• Multi-Factor Authentication (MFA): This must be enabled for all remote access (like VPNs) and for all administrator accounts.
• Secure Backups: You must have backups that are stored separately from your main network, ideally in a way that hackers cannot delete or encrypt them.
• Endpoint Detection and Response (EDR): Traditional antivirus is often not enough anymore; insurers want to see tools that can actively spot and stop a hacker in real-time.

Managing remote access and email security

Email is the most common way hackers get into a business. Insurers will check if you use email filtering to block malicious links and attachments. They also want to see that you are using secure methods for remote work. If your employees use a 'Remote Desktop' (RDP) connection that is open to the internet without a VPN or MFA, it is a major red flag for any insurance company.

The importance of incident response planning

Insurance companies want to know that you have a plan for when things go wrong. They will often ask to see a written Incident Response Plan (IRP). This plan should outline what you will do if you get hit by ransomware or if a staff member loses a laptop. An IRP shows the insurer that you can act quickly to minimize the damage, which reduces the potential size of a claim.

Vendor and supply chain risk

Insurers are also starting to ask about the companies you work with. If you use a cloud provider or an IT service, the insurance company wants to know if you have checked their security. A breach at one of your vendors can quickly become a problem for you, especially if you share data with them. Having a process for 'Vendor Risk Management' is becoming a common part of cyber insurance requirements.

How to prepare for your next renewal

Do not wait until the week before your policy expires to look at your security. Start at least 90 days in advance. Review a sample application and see where you fall short. Implementing things like MFA or EDR can take time, and you want to have them fully working before you sign the application. Being proactive can save you thousands of dollars in premiums and prevent a stressful rejection.