Key Takeaways
- Cyber insurance underwriting shifted from questionnaire-based to evidence-based in 2026, meaning insurers now require documented proof of controls instead of a self-reported checklist.
- Missing baseline controls like MFA or EDR can add 25% to 50% to a renewal quote or get an application declined outright.
- The four controls underwriters weigh most heavily are phishing-resistant MFA, EDR on every endpoint and server, tested immutable backups, and a written, recently updated incident response plan.
- Backups now need to follow the 3-2-1 standard, three copies, two types of media, one copy offsite, with quarterly restore tests documented.
- A business that treats renewal prep as a once-a-year scramble is more likely to see a denial than one that keeps evidence current year-round.
Cyber insurance requirements for small business changed in 2026, and a lot of owners are finding that out the hard way at renewal time. Insurers used to take your word for it. Now they want proof, and a policy that renewed easily last year can get flagged, re-priced, or denied outright this year over gaps that didn't matter before.
What Changed in Cyber Insurance Underwriting for 2026?
Cyber insurance underwriting has moved from a questionnaire-based model to an evidence-based one. In 2024, checking a box that said "we have MFA" was often enough to bind a policy. In 2026, the underwriter wants documentation: screenshots, admin console exports, signed policies, and dated test logs that prove the control is actually in place and actually working.
This shift tracks the claims data. Business email compromise losses reported to the FBI's Internet Crime Complaint Center reached $3.05 billion in 2025, up from $2.77 billion the year before, and a large share of those claims trace back to accounts that had no multi-factor authentication at all. Insurers are pricing that risk directly instead of taking a business's word that it's handled.
What Do Cyber Insurance Underwriters Actually Verify Now?
Underwriters focus on a small set of controls that correlate most strongly with whether a claim happens and how expensive it gets. Missing any one of these can add 25% to 50% to a quote, or disqualify an application entirely.
- Multi-factor authentication on every account that touches business data. Email, VPN, remote desktop, cloud admin consoles, banking, and any line-of-business software. The Cybersecurity and Infrastructure Security Agency (CISA) recommends phishing-resistant MFA as the strongest option, and insurers increasingly reject SMS-based codes as proof for privileged accounts.
- Endpoint detection and response (EDR) on every device. Legacy antivirus no longer satisfies most carriers. EDR needs to be deployed on servers and workstations alike, ideally with 24/7 monitoring behind it.
- Immutable, tested backups. Insurers want the 3-2-1 standard, three copies of data, on two different types of media, with one copy offsite or immutable, and they want proof of a recent restore test, not just proof that backups run.
- A written, current incident response plan. A plan that hasn't been reviewed or tabletop-tested in the last twelve months is treated close to having no plan at all.
- Email authentication (SPF, DKIM, DMARC). This blocks domain spoofing, one of the most common entry points for the wire fraud and payment redirection scams that drive a large share of small business claims.
Why Are Cyber Insurance Renewals Getting Denied in 2026?
Renewals get denied, or re-priced sharply upward, when a business can't produce evidence for the controls above on demand. A business owner who genuinely has MFA turned on but can't quickly export proof from their admin console is, from the underwriter's perspective, in the same position as one that never enabled it at all. The gap usually isn't that the control is missing, it's that nobody kept the documentation current.
| Underwriting era | What was accepted | What's required now |
|---|---|---|
| Pre-2026 (questionnaire-based) | Self-reported yes/no answers on an application form | Exported evidence: admin console screenshots, policy documents, test logs |
| 2026 (evidence-based) | N/A | Dated proof of MFA enforcement, EDR deployment, backup restore tests, and a reviewed incident response plan |
How Should a Small Business Prepare for a Cyber Insurance Renewal?
Treat renewal prep as an ongoing habit rather than a once-a-year scramble. A few practical steps make the biggest difference:
- Pull your current control evidence before the renewal application goes out, not after the underwriter asks a follow-up question. Export MFA enforcement reports, EDR deployment status, and your most recent backup restore test date.
- Review and re-sign your incident response plan annually, even if nothing in it changed. Insurers specifically look at the last review date.
- Patch on a documented schedule. A written patch management policy with a 14-day service level agreement for workstations, and faster for anything internet-facing, is now a common underwriting expectation.
- Train employees and document it. Security awareness training with completion records is a small lift that carriers weight more heavily than most owners expect.
Businesses without an internal IT or security team often lean on a managed provider specifically for this evidence trail, since keeping MFA enforcement, EDR coverage, and backup logs current takes ongoing attention, not a single setup project. If your team is already stretched thin, it may be one of the signs it's time to bring in a managed IT provider.
Is Cyber Insurance the Same as Compliance?
No, and this is a common point of confusion. Cyber insurance requirements overlap with compliance frameworks like HIPAA, PCI-DSS, and CMMC in places, MFA and documented backups show up in nearly all of them, but they aren't interchangeable. A business can be fully compliant with an industry framework and still fail a cyber insurance underwriting review, or vice versa. If you're untangling which of these actually applies to your business, our plain-English guide to IT compliance breaks down HIPAA, CMMC, and PCI-DSS side by side.
Get Ahead of Your Next Renewal
Cyber insurance requirements for small business are only getting stricter, and the businesses that treat evidence collection as routine are the ones that renew smoothly and avoid the 25 to 50 percent premium penalty for missing controls. If you're not confident you could produce proof of MFA, EDR, and tested backups today, that's worth finding out before your renewal date, not during it. Request a free IT risk assessment and we'll show you exactly where the gaps are.