The cyber insurance security controls insurers now expect

Your renewal application arrived, and it is longer than last year's. The questions about cyber insurance security controls have moved from "do you have antivirus" to "is MFA enforced on administrative access to your backup environment, including for third-party providers." Somebody on your team has to answer each one, and an officer of the company has to sign that the answers are true.

That signature is the part people underestimate. The Travelers MFA attestation form states that the carrier may rely on the answers as the basis for providing insurance, and that any "No" answer needs an explanation. An application answered from memory is a liability at claim time, when the adjuster asks for proof of what you said was in place.

What underwriters are actually asking for

Across the carrier and broker material we reviewed, the same control categories keep appearing. Marsh McLennan's 2023 analysis names twelve, and the list reads like a modern SMB security program: MFA, encrypted and tested backups, endpoint detection and response (EDR), privileged access management, email filtering and web security, incident response planning, patch and vulnerability management, awareness training, hardening (including RDP mitigation), retirement of end-of-life systems, logging and monitoring, and vendor risk management. Marsh's own guidance for security leaders adds that EDR on servers and laptops is now the baseline, and that underwriters have been paying particular attention to patching and privileged accounts.

The questions are also getting more specific about scope. The Travelers form does not ask whether you "use MFA." It asks separately about web email for all employees, all remote network access by employees, contractors, and vendors, and then administrative access, both internal and remote, to directory services, backup environments, network infrastructure (firewalls, routers, switches), and endpoints and servers.

Coalition's published guidance describes the same pattern on backups: on-site and off-site copies, at least one kept fully separate from the production network, and tested by performing a full recovery rather than checking that a job completed.

How to tell whether this includes you

If you answered any of the following with a "Yes" that you could not prove in an afternoon, it includes you.

• MFA is enforced for VPN, but administrators still reach the firewall, core switches, or hypervisor with a username and password.
• EDR is "on every machine," but nobody has reconciled the EDR console's device count against Active Directory, Intune, or the asset list.
• Backups go offsite, but the backup server itself is domain-joined, reachable from user VLANs, and administered with the same credentials attackers would steal first.
• A restore was tested, but it was a single file, not a full server or a domain controller.
• Patching runs on Patch Tuesday, but no one checks firewall firmware, hypervisors, or the applications that sit outside Windows Update.
• Domain administrators use the same account to read email and to log in to servers.
• Logs exist on each device, but nothing central would notice if a log source went quiet.

Each of these is a gap between the attestation and the environment, and each is what a forensic firm will find after an incident, when the carrier reads your application again.

What it costs when the answers do not hold up

Three outcomes are realistic for a business with a lean IT team.

The first is a declined or conditional application. Marsh states plainly that certain controls are now a minimum requirement and that insurability depends on them. The second is a worse quote: higher premium, higher retention, or a sublimit on ransomware and business interruption. The third, and the expensive one, is a dispute after a loss, when the carrier compares what the application said with what the incident responders found. A "Yes" on MFA for remote access that did not cover the vendor's support account is the kind of discrepancy that turns a claim into a negotiation.

None of this requires a bad actor on your side. It requires only that someone answered a form in good faith without checking.

Build the evidence file before the form arrives

Treat the renewal as an audit with a known question set. For each control, produce a dated artifact that a stranger could read, and keep it in a folder you refresh quarterly. This is the order we recommend.

1. MFA, with scope. Export the conditional access or authentication policy that enforces MFA for email and remote access. Then list every administrative interface in the business, including firewalls, switches, the hypervisor, the backup console, and the identity tenant, and record how each one authenticates. Anything on local accounts goes on a remediation list with a date. CISA's Cross-Sector Cybersecurity Performance Goals (CPG 2.K) recommend the strongest available method, starting with hardware-based, phishing-resistant MFA, so note which method you use for administrators. In CIS Controls terms, this is Control 6, Access Control Management.

2. EDR coverage, reconciled. Pull the device list from the EDR console and the device list from your directory or MDM, and diff them. The result is a count, a list of exceptions, and a reason for each exception. Keep the policy export that shows tamper protection is on and that alerts route to someone who responds around the clock. Marsh's analysis found that advanced endpoint security was among the strongest individual signals associated with fewer incidents, which is why carriers ask about it first. This maps to CIS Control 10, Malware Defenses, and CPG 3.A, detecting relevant threats.

3. Backups that are immutable, isolated, and restored on a schedule. Screenshot the immutability or retention-lock setting, the credential separation for the backup administrator, and the network path that keeps the repository off the user network. Then run a restore of a full server, record the start time, the finish time, and what did not come back, and sign it. CPG 2.R calls for backups stored separately and restores tested at least annually; we recommend quarterly for the systems the business cannot run without. CIS Control 11, Data Recovery, covers the same ground. If the restore test has never been done, our backup and disaster recovery work usually starts there.

4. Patch cadence with proof of outcome. A patch policy is a promise. A vulnerability scan report dated after the patch window is evidence. Keep the scanner report and the exception list, and cross-check internet-facing systems against CISA's Known Exploited Vulnerabilities catalog, since CPG 1.E focuses on exactly those. Marsh's data found that patching high-severity vulnerabilities within seven days was the least-implemented control it studied, which tells you where underwriters expect to find weakness.

5. Privileged access separated. Export the members of Domain Admins, Enterprise Admins, and the Global Administrator role, and show that each person on the list has a separate daily-use account. Show how local administrator passwords are managed on workstations. CPG 2.E and CIS Control 5 both describe this.

6. Email security that is verifiable from outside. Publish SPF, DKIM, and DMARC with a reject policy, as CPG 2.O recommends, and keep the DNS records and the DMARC aggregate reports. These are the easiest controls to verify because anyone can query them.

7. Logging that notices silence. Keep an inventory of log sources feeding your central collector, the retention period, and the alert that fires when a critical source stops sending. CPG 2.T names that last item specifically, and it is the one most environments lack.

When it is time to talk to us

If the EDR reconciliation in step 2 turns up machines nobody can account for, or there is no one watching the console after hours, that is the gap carriers price first and the one we close with Managed EDR. Bring the application with you and we will walk through the questions together in a 30-minute intro call at padlocktech.com/#contact.