Cyber Insurance Requirements in 2026: What Carriers Actually Check Before They'll Cover You
Jeff Sowell · 2026-04-09 · Cyber Insurance
Cyber insurance applications have become security audits in disguise. Carriers now verify MFA, EDR, backups, and incident response plans before quoting. Here's exactly what they check and how to prove it.
The application is the audit now
Five years ago, getting cyber insurance meant filling out a questionnaire and writing a check. Today, carriers are denying renewals, raising premiums 50-100%, and requiring proof of specific controls before they'll even quote.
If you're a vCISO or MSP helping clients get covered, you already know this. The underwriting process has become a de facto security audit — and your clients are failing it.
The good news: the controls carriers want are the same controls you should be implementing anyway. The challenge is proving them quickly and consistently across multiple clients.
What carriers check in 2026
We've analyzed application requirements from major carriers (Coalition, At-Bay, Corvus, Chubb, Travelers, Hartford) and worked with dozens of MSPs through the underwriting process at BlueRadius Cyber. Here's what they consistently require:
Tier 1: Non-negotiable (instant denial without these)
Multi-Factor Authentication (MFA)
- Required on: email, VPN, RDP, privileged accounts, cloud admin consoles
- Carriers verify: enrollment percentage, not just "we have it available"
- What they want to see: IdP report showing 95%+ enforcement (Okta, Entra ID)
- Common failure: MFA enabled but not enforced — users can skip it
Endpoint Detection & Response (EDR)
- Required on: all endpoints, including servers
- Carriers verify: deployment coverage percentage, not just "we bought CrowdStrike"
- What they want to see: agent deployment report showing 95%+ coverage
- Common failure: EDR on workstations but not servers, or 60% deployment
Backup & Recovery
- Required: offline/immutable backups with tested recovery
- Carriers verify: backup frequency, retention, and whether you've actually tested a restore
- What they want to see: backup job reports + last restore test date
- Common failure: backups exist but haven't been tested in 12+ months
Tier 2: Strongly affects pricing
Email Security
- DMARC enforcement (p=reject or p=quarantine)
- Anti-phishing training with simulated campaigns
- Inbound email filtering beyond basic spam
- Carriers check DNS records directly — they'll look up your DMARC policy
Vulnerability Management
- Regular scanning (monthly minimum, weekly preferred)
- Defined SLAs for patching critical vulnerabilities
- Evidence of remediation, not just scan reports
- Mean time to remediate (MTTR) under 30 days for critical
Privileged Access Management
- Limited admin accounts (not everyone is a domain admin)
- Separate admin credentials from daily-use accounts
- Session recording or monitoring for privileged access
Tier 3: Differentiators that lower premiums
Incident Response Plan
- Written plan with defined roles, communication procedures, and escalation paths