International Control Services thought it had cyber insurance. On its application, the company stated that multi-factor authentication was required for all remote access and administrative accounts. When it filed a claim after an incident, the insurer discovered the truth: MFA had only ever been enabled on the company firewall. The claim was denied, not because the loss wasn’t real, but because the application wasn’t.
That case is one of the clearer examples of a pattern insurers are now actively underwriting against. Cybersecurity Dive has reported that cyber insurance policyholders are facing “heavier scrutiny in underwriting and claims” as carriers respond to years of ransomware-driven losses. The self-attestation model, where a business simply checks boxes on a questionnaire and hopes for the best, is giving way to verification: security scans, follow-up documentation requests, and claims investigations that check whether the controls a business claimed to have were actually in place and actually maintained.
For small and mid-sized businesses, this shift shows up in two ways: a harder path to getting approved for coverage in the first place, and a real risk of a claim being denied later if the controls described on the application weren’t kept current. Cottage Health learned this the second way, losing a claim not because it lacked security controls at the time of application, but because it failed to “continuously maintain” the minimum risk controls it had agreed to uphold as a condition of coverage.
If your organization is preparing for a cyber insurance application, renewal, or audit in 2026, the message from carriers is consistent: they are no longer asking whether you have a security program. They’re asking you to not only prove you have one but also to prove you’re keeping it up.
Why Cyber Insurance Requirements Got Stricter
2026 Cyber insurance requirements look meaningfully different from the questionnaires businesses filled out even three or four years ago. Underwriters have paid out enough ransomware and business email compromise claims to know which specific controls actually prevent losses, and they’ve converted that knowledge into binding conditions rather than suggestions. A missing or misrepresented control isn’t just a pricing factor anymore, it’s frequently the difference between a policy being issued at all, and the difference between a claim being paid or denied after the fact.
This is why a cyber insurance application denied outcome increasingly traces back to the same handful of gaps: authentication that doesn’t cover every entry point, endpoint protection that’s outdated by a decade of attacker tooling, backups that have never actually been tested, an incident response plan that exists only as a document nobody has rehearsed, and training records nobody kept.
The 2026 Cyber Insurance Checklist SMB Applicants Need to Pass
- Multi-factor authentication everywhere, not just at the front door. Carriers now expect phishing-resistant MFA (FIDO2 or hardware-key based, not just SMS codes) across every point of entry: email, remote and VPN access, and every privileged or administrative account, including the console that manages your backups. MFA on a single system, like ICS’s firewall-only implementation, is treated the same as no MFA at all if itdoesn’t match what was represented on the application.
- EDR, not antivirus. Traditional signature-based antivirus is no longer sufficient for most carriers’ baseline requirements. Insurers now expect endpoint detection and response (EDR) or managed detection and response (MDR): continuous monitoring across every workstation, laptop, and server that can detect and respond to active threats, not just known malware signatures. If your current protection can’t tell you what a compromised endpoint did after the initial infection, it won’t satisfy this requirement.
- Backups that are immutable, and tested, not just scheduled. A nightly backup job isn’t proof of resilience on its own. Insurers increasingly require immutable or offline backups following a 3-2-1 pattern (three copies, two media types, one offsite copy) specifically so ransomware that reaches your network can’t also encrypt or delete your recovery path. Just as important: documented restore tests with dated logs showing a successful recovery. An untested backup is functionally treated as no backup at all, because nobody actually knows if it would work when needed.
- A documented incident response plan that’s been exercised, not just written. Carriers want a dated IR plan, and increasingly, evidence that it was tested through a tabletop exercise within the last 12 months. A plan that sits in a shared drive untouched since it was written doesn’t demonstrate readiness. What underwriters want to see is a rehearsed plan with named roles, decision points, and a recent test date attached to it.
- Annual security awareness training, with proof of completion. Most claims involving human error, phishing, credential theft, social-engineered wire fraud, trace back to a gap in employee awareness. Insurers now commonly require documented training completion records covering the past 12 months, not just a policy stating that training happens. If you can’t produce a report showing who completed training and when, you can’t demonstrate the control exists.
Beyond the Checklist: Treat It as a Standing Program, Not a One-Time Form
The Cottage Health case is the detail worth sitting with longest: the business had the controls in place when it applied. The claim was still denied, because “continuously maintain” is a real contractual obligation, not a formality. A cyber insurance checklist SMB teams complete once a year, right before renewal, misses the actual requirement, which is that these controls stay in place and stay documented every month in between.
A few practical habits close that gap:
Run a gap analysis before you apply, not after you’re denied. A structured risk assessment against your specific carrier’s questionnaire, before submission, catches misrepresentation risk (like ICS’s MFA gap) while it’s still fixable.
Keep a standing evidence file. MFA enrollment reports, EDR deployment coverage, backup restore-test logs, IR tabletop dates, and training completion records should live somewhere your team can produce on short notice, not get reconstructed under deadline pressure during a renewal or, worse, during a claim.
Revisit the application annually, and after any material change. New offices, new remote staff, new vendors, or new systems can quietly create gaps between what your policy says is true and what’s actually running in production.
Get an outside read before your insurer does. A third-party risk assessment identifies the same gaps an underwriter’s post-incident investigation would, while there’s still time to close them.
How CyberClan Helps You Pass, and Stay Passing
This is precisely the work behind CyberClan’s Risk Management and Governance, Risk, and Compliance (GRC) services. Rather than a generic checklist, CyberClan’s cyber risk assessments give you a clear, prioritized view of your actual exposure, mapped against your business impact, so you know exactly which gaps, MFA coverage, backup immutability, IR plan freshness would show up on an underwriter’s radar before they show up on a denied claim. The GRC team then builds the policies, documentation, and audit-ready evidence trail, built on frameworks such as NIST CSF and ISO standards, that insurers, auditors, and your own leadership can all rely on.
Not sure your organization would pass its next cyber insurance assessment? Talk to CyberClan about a risk assessment that shows you exactly where you stand, before your carrier tells you.
