Cyber-insurance requirements for small business in 2026.

A few years ago, a cyber-insurance application was a short form and a signature. That era is over. After a wave of ransomware and email-fraud claims, underwriters got strict — and small businesses are now held to many of the same security standards as large ones. The application has become a security questionnaire, and the answers you give shape both whether you get covered and whether a future claim gets paid.

None of this is meant to scare you off coverage — cyber insurance is more valuable than ever. The point is that the policy now assumes you're running a baseline of modern controls. Below is what insurers commonly ask for, in plain English, and why each one is on the list.

What insurers now commonly require

Every carrier is different, and the exact wording on your application will vary. But across the market, a fairly consistent baseline has emerged. These are the controls that show up again and again on questionnaires for issuing a policy, renewing it, and validating a claim.

Multi-factor authentication (MFA)

A second proof of identity — a code or app prompt — on top of a password, especially for email, VPN, and remote access. Why insurers want it: stolen and reused passwords are behind a huge share of breaches. MFA is cheap and stops most of them, so it's become close to non-negotiable. If you attest to having MFA and it isn't actually turned on, a claim can be reduced or denied.

Endpoint protection / EDR

Modern security software on every computer and server — endpoint detection and response (EDR) — that watches behavior, catches what traditional antivirus misses, and can isolate a device that's under attack. Why insurers want it: it shortens the window between an infection starting and something stopping it, which directly limits the size of a claim.

Managed detection & response (MDR)

EDR generates alerts; MDR puts a human team behind those alerts, watching around the clock and responding on your behalf. Why insurers want it: attacks don't keep business hours. Someone actively watching at 2 a.m. is the difference between an isolated laptop and an encrypted network.

Tested backups & disaster recovery

Regular, secured backups — ideally with copies kept offline or otherwise out of an attacker's reach — plus a plan to actually restore from them. The key word is tested. Why insurers want it: reliable backups are what let you recover without paying a ransom, which is the cheapest possible outcome for everyone. A backup nobody has ever restored from doesn't count.

Security-awareness training & phishing testing

Short, regular training for staff, usually paired with simulated phishing emails to see who clicks. Why insurers want it: most breaches start with a person, not a server. A trained team that pauses before clicking is one of the most cost-effective controls there is.

Patch & vulnerability management

Keeping operating systems, software, and firmware updated on a routine schedule, and knowing where the gaps are. Why insurers want it: attackers lean on known holes that already have fixes available. Timely patching closes the doors before someone walks through them.

An incident-response plan

A written plan for what happens when something goes wrong — who to call, how to contain it, how to notify the right people, and how to get back to work. Why insurers want it: a calm, practiced response limits damage and cost. A scramble makes everything worse, and slower.

The "are you covered?" checklist

Run through this honestly. If you can't confidently say yes to each, that's exactly where to start.

• MFA — is it actually on for email, VPN, and remote access, for everyone?
• EDR — does every computer and server have modern endpoint protection, not just old antivirus?
• MDR — is someone (or some service) watching and responding to alerts around the clock?
• Backups — are they running, secured against attackers, and have you actually tested a restore?
• Training — does your team get regular awareness training and phishing tests?
• Patching — are updates applied on a routine schedule across all your systems?
• Incident-response plan — is there a written plan, and does the team know it exists?
• The application itself — are your questionnaire answers accurate and current?

How an MSP gets you compliant

Here's the encouraging part: the controls insurers want are the same controls a good managed service provider deploys as a matter of course. There's no separate "insurance-compliance" project — it's just good security, done properly.

If you work with an MSP or security provider, ask them to map their plan against the list above and to sit with you when the renewal questionnaire lands — your answers need to match what's actually running, or a future claim can be disputed on a technicality. (A note on us: CornerBeacon isn't an MSP — we're an AI-native app development company that designs, builds, and runs custom apps and automation. For the businesses we build for, we keep the essential IT foundation solid: a security baseline of MFA, patching, and email protection, plus backups. See IT foundation.)

And because the same controls underpin other frameworks, getting insurance-ready usually moves you toward HIPAA, CMMC, and similar requirements at the same time — useful if you're in healthcare, defense supply chains, or any regulated corner of New England. One set of controls, several boxes checked.

You don't need to become a security expert. You need a partner who already runs these controls every day, and who can sit beside you when the application lands on your desk.