Cyber Insurance Renewal Just Got Harder: What Underwriters Want Now
A few years ago, buying cyber insurance was almost an afterthought. You filled out a short form, answered a handful of yes-or-no questions, gave them a card, and you were covered. Nobody checked your work.
That era is over, and if your renewal is coming up, you are about to feel it. The questionnaire that used to be one page is now several, and it reads less like an application and more like a security audit. The questions are specific, technical, and pointed, and the carrier is going to verify the answers. Get them wrong and you are looking at one of three bad outcomes: they decline to cover you, they cover you at a premium several times what a prepared company pays, or they write the policy and then deny the claim later when they discover the controls you attested to were not actually in place.
I want to walk through what changed, what underwriters actually require now, and how a growing company gets ready without turning it into a year-long project. The short version: this is tractable, and the work you do to satisfy the underwriter is the same work that actually keeps you in business.
Why this changed
Carriers got burned. For years they priced cyber policies on thin data and paid out far more in ransomware and business-email-compromise claims than they collected in premiums. So they did what any business does when a product loses money: they raised the bar.
The bar is now a real security program. The carrier is no longer asking whether you care about security. They are asking you to prove that specific controls are turned on, and they are pricing your premium, and deciding whether to cover you at all, based on your answers. The questionnaire became the underwriting. If you cannot demonstrate the controls, you are either uninsurable or expensive, and the gap between the prepared company and the unprepared one has gotten wide.
What they actually require now
The exact checklist varies by carrier, but the core is remarkably consistent. These are the controls that show up on nearly every questionnaire, and the ones a denial usually traces back to.
Multi-factor authentication, everywhere. Not just on email. On remote access, on administrator accounts, on your cloud platforms, on anything that touches company data from outside the building. MFA is the single control underwriters care about most, because it stops the majority of account-takeover attacks cold. If you have it on email but not on your VPN or your admin accounts, that is a gap they will find.
Endpoint detection and response. Real protection on every laptop and server that can detect and stop ransomware as it tries to run, not just basic antivirus that checks against a list of known threats. Carriers distinguish between the two now, and they ask which one you have.
Backups that are tested and out of reach. Not just that you have backups, but that they are isolated from your main network so ransomware cannot encrypt them too, and that you have actually restored from them to confirm they work. An untested backup is a hope, not a control, and underwriters have learned to ask the follow-up question.
Email filtering and security. The majority of attacks still arrive by email, so carriers want to see that you filter for phishing, malicious links, and impersonation before those messages reach an inbox.
Documented identity and access control. Who has access to what, how access is granted and removed, and how fast a departing employee is shut off. The ninety-day-old login that still works is exactly the kind of thing that turns into a claim.
An incident response plan. A written, tested plan for what happens when something goes wrong: who gets called, who decides, how you contain it. Carriers want to know you will not be improvising in the worst hour of your year.
What it costs to fail the questionnaire
Failing is not a single outcome. It is three, and each one hurts differently.
The first is the decline. The carrier reads your answers, decides you are too much risk, and simply will not write the policy. You go looking for coverage in a harder, more expensive corner of the market, often right when you need to show a customer or investor that you have it.
The second is the premium. If you can get covered without the controls, you pay for the privilege, often multiples of what a prepared company in your industry pays for the same coverage. Year after year, that gap is real money, and it buys you nothing except the same policy your better-prepared competitor got cheap.
The third is the worst, because it hides until the day you need the policy most. You attest to controls you do not actually have, the carrier writes the policy, and then you have an incident. During the claim investigation they discover the MFA you swore was universal was not, or the backups you claimed were tested had never been restored. They deny the claim. You went through all of it, paid all the premiums, and at the moment of truth the policy does not pay. That is the outcome to fear, and it is entirely avoidable.
The good news: this is the work that actually protects you
Here is the part that should change how you feel about all of this. The controls the underwriter wants are not insurance theater. They are the exact same controls that keep your business running when someone takes a shot at it. You are not doing busywork to satisfy a form. You are building the thing that means a compromised laptop is a Tuesday annoyance instead of a company-ending event.
And the fastest, most durable way to satisfy that checklist is not to bolt a dozen security products onto an aging setup. It is to move your business onto a cloud-first platform where these controls are built in. When your identity lives in a system that enforces multi-factor authentication by policy, your devices are centrally managed, your endpoints carry real detection, and your files live in cloud storage with versioning and recovery, you are checking the underwriter's boxes as a side effect of running a modern stack. The migration is the security investment. Buying more firewalls and more antivirus to harden an old on-premises setup is the slower, more expensive path that still leaves you explaining gaps on the questionnaire.
We wrote about why a single platform beats a pile of disconnected tools in Why Microsoft 365 Business Premium Is the SMB Operating System. The same bundle that simplifies your operations is the one that quietly answers most of the insurance questionnaire for you.
How to get ready in about 90 days
You do not need a year. A growing company that prioritizes this can be in good shape for renewal in roughly ninety days. The path is not complicated.
Start by getting your hands on the actual questionnaire, ideally the one your current or target carrier uses, and treat it as the to-do list it is. Turn on multi-factor authentication everywhere it is missing first, because it is the highest-impact, fastest control and the one they care about most. Get real endpoint detection onto every device. Confirm your backups are isolated and actually restore them once to prove it. Make sure email filtering is on and tuned. Write down who has access to what and tighten how fast you remove access when someone leaves. And put a simple, written incident response plan on paper, then walk your team through it once so it is not the first time anyone has read it during a real incident.
If that list feels like a lot, that is what a partner is for. It is the work we do for growing companies across Utah every day at Summit Technology, and the point is that every item on it is concrete and achievable. None of it requires you to become a security expert yourself.
Where this fits
Cyber insurance is one piece of a bigger picture: what your whole IT function should look like at your company size, and where security fits inside it. We lay all of that out in the operating manual for growth-stage companies. The insurance questionnaire is really just the underwriter asking whether you have built that function yet. The companies that have are the ones who renew without sweating it.
Your next move
If you want to know where you stand before the questionnaire lands on your desk, take the 10-minute IT Stack assessment. It scores you across the controls underwriters care about and shows you exactly where you are exposed, with a result you can take to your leadership team.
Or just talk to us. Bring your renewal questionnaire if you have it. We will help you see which boxes you can already check and which ones need work, so you walk into the renewal with the full context and no surprises. The goal is simple: a policy you can actually rely on, at a price that reflects a business that did the work.
Frequently Asked Questions
Why is cyber insurance so much harder to get now? Carriers paid out far more in ransomware and email-fraud claims than they expected, so they raised their standards. The application became an underwriting audit. Today they require specific security controls, verify your answers, and price your premium or decline coverage based on what you can actually prove is in place.
What security controls do cyber insurance underwriters require? The common core is multi-factor authentication everywhere, endpoint detection and response on all devices, backups that are isolated and tested, email filtering, documented identity and access control, and a written incident response plan. The exact list varies by carrier, but a denial almost always traces back to one of these being missing.
Can my cyber insurance claim be denied even if I have a policy? Yes. If you attested to controls you did not actually have, such as universal multi-factor authentication or tested backups, the carrier can deny the claim when the investigation reveals the gap. This is the most painful outcome because it surfaces only when you need the policy most. Accurate answers and real controls are the protection.
How long does it take to get ready for a cyber insurance renewal? A growing company that prioritizes it can be in good shape in about 90 days. Start with multi-factor authentication everywhere, then endpoint detection, tested and isolated backups, email filtering, access control, and a written incident response plan. Working from the carrier's actual questionnaire keeps the effort focused.
Does moving to Microsoft 365 help with cyber insurance requirements? Yes. A cloud-first platform like Microsoft 365 Business Premium builds in many of the controls underwriters check: enforced multi-factor authentication, managed devices, endpoint protection, and recoverable cloud file storage. Running a modern platform answers much of the questionnaire as a side effect, which is faster and cheaper than bolting security products onto an aging on-premises setup.