What Cyber Insurance Requires in 2026

Cyber insurance used to be a short application and a check. That's no longer the case. As claims have climbed industry-wide, insurers have gotten far more specific about what a business needs to have in place before they'll write a policy — and many now audit for these controls at renewal, not just at signup.

Controls insurers commonly require

• Multifactor authentication (MFA) on email, remote access (VPN/RDP), and privileged accounts — this is the single most common requirement across carriers, and missing it is a frequent reason for denied claims.
• Endpoint detection and response (EDR), not just traditional antivirus, on all workstations and servers.
• Immutable or offline backups that ransomware can't reach or encrypt, along with evidence of regular test restores.
• A documented incident response plan, including who gets notified and how systems get isolated.
• Email security controls such as SPF/DKIM/DMARC and phishing-resistant filtering, given how many claims originate from business email compromise.
• Regular patching cadence for operating systems and critical software.
• Employee security awareness training, often required annually with documentation.
• Privileged access management — limiting who has administrative rights, and reviewing that list periodically.

Why this matters even if you already have a policy

A growing number of denied cyber insurance claims trace back to a gap between what a business told the insurer at application and what was actually in place at the time of the incident — most commonly, missing MFA. Renewal applications increasingly ask for evidence, not just a checkbox, so it's worth treating your policy's control requirements as a living checklist rather than a one-time form.

The gap between "we have cyber insurance" and "we meet our policy's actual requirements" is where a lot of businesses get an unpleasant surprise during a claim.

How to prepare before your next renewal

Pull your current policy's security requirements section and compare it line by line against what's actually deployed. Where there's a gap — most often MFA coverage, backup isolation, or documented training — that's the priority list. An outside infrastructure review can also produce documentation your broker can use directly in the renewal application.