Cyber Insurance Requirements: TX Experts Explain What Businesses Need to Qualify

Key Takeaways

• Insurers now expect proof, not promises, across seven core controls: MFA, endpoint detection and response, protected backups, patching, email security and training, privileged access, and a written incident response plan
• A control listed on an application but not actually running can cause real trouble if a claim is ever investigated and the gap comes to light
• Starting renewal prep about 90 days ahead leaves enough room to assess gaps, fix the highest-impact ones, and gather dated evidence before the questionnaire is due
• Falling short of what an insurer wants to see does not always mean a flat decline, it can also show up as a conditional quote, a lower payout for certain events, or a higher premium

Businesses applying for cyber insurance in 2026 are running into a shorter, sharper list of questions than they saw even a couple of years ago. The underlying controls have not changed all that much. What has changed is how closely insurers check that those controls are actually working, with dates attached and documents to back them up. Getting this right matters just as much at renewal as it does on a brand-new policy, since the same controls that win approval are the ones that keep a claim from falling apart later. Function-4's guide to cyber insurance requirements breaks down what underwriters are asking for right now and how businesses can close gaps before they show up on an application.

The Seven Controls Insurers Demand Now

Most cyber insurance applications, no matter which carrier issues them, circle back to the same seven areas. Multi-factor authentication tops the list, followed by endpoint detection and response, protected backups, patch management, email security paired with staff training, privileged access controls, and a written incident response plan. The exact wording varies from one application to the next. Some carriers use simple yes-or-no checkboxes while others want a short written explanation, but the substance underneath barely shifts.

What has shifted is the weight each of these carries. A few years ago, having a password policy and antivirus software checked most of the boxes an insurer cared about. Now, a single missing piece, like one unsupported server or a handful of accounts without MFA, can change the terms of an entire policy. Businesses that treat this list as a once-a-year chore tend to get caught off guard, while those that build these controls into daily operations tend to move through renewal season with far less stress.

Why Underwriters Stopped Taking Your Word

For a long time, insurers mostly trusted applicants to describe their own security setup honestly, and that worked fine until claims started getting more expensive. The 2026 Verizon Data Breach Investigations Report found ransomware in 48% of breaches, up from 44% a year earlier, and third parties involved in nearly half of all breaches, a 60% jump in one year. The same report found vulnerability exploitation overtook stolen credentials as the most common way attackers get in, the first time credentials lost the top spot in the report's 19-year history, and patching has slipped too: organizations took a median of 43 days to fully patch known exploited vulnerabilities, up from 32. Underwriters read those numbers and build their questions around the exact weak points attackers use most often, which means less trust placed in a simple checkbox and more demand for documentation behind every answer.

A useful way to think about this is the difference between a documented control and an implemented one, a distinction a 2026 guide from Cyber Advisors draws clearly. A documented control lives in a written policy somewhere, maybe a security handbook nobody has opened in a year. An implemented control is actually running, actively protecting systems, and leaving a trail of evidence behind it. Underwriters increasingly care only about the second kind. If an application claims MFA is active everywhere, expect a request for a coverage report pulled straight from the identity platform, rather than a written statement saying so.

The Checklist Every Application Shares

Four areas tend to generate the most back-and-forth between applicants and underwriters, since they are also the areas attackers exploit most often. Walking through each one separately makes it easier to spot where a business might already be falling short.

MFA on Every Account That Matters

Multifactor authentication usually gets more underwriting attention than anything else on the list. Insurers commonly expect it on email, VPN and remote access, cloud admin consoles, privileged accounts, and backup systems. "Most users" rarely satisfies an underwriter anymore. If a legacy login cannot support MFA, the stronger move is documenting a workaround along with a firm retirement date for that account.

• Email accounts, including shared inboxes and admin mailboxes
• Remote access tools such as VPN connections
• Cloud administration consoles
• Privileged or admin-level accounts
• Backup system logins, which attackers often target first

Endpoint Detection and Response Coverage

Basic antivirus software no longer satisfies most carriers. Insurers want endpoint detection and response, often shortened to EDR, running across workstations and servers, with someone actually reviewing the alerts it generates rather than letting them pile up unread. Many applications now ask directly whether monitoring happens around the clock, and whether that monitoring is handled in-house or through an outside provider.

Coverage gaps here tend to draw scrutiny fast. One 2026 underwriting guide notes that EDR coverage below roughly 95% often triggers conditions or sublimits. A business running EDR on most of its laptops but skipping a few older desktops or a forgotten server can still face pushback, since partial coverage leaves an opening that underwriters recognize as a real risk rather than a technicality.

Backups an Attacker Can't Reach

Ransomware groups go after backup systems first, since destroying or locking backups makes a ransom payment far more tempting for the victim. Insurers know this pattern well, so applications frequently ask whether backups sit offsite, whether they are immutable or kept offline, and whether they use credentials separate from the main network. A backup that shares login credentials with everyday business systems offers little real protection if an attacker already has a foothold.

Dated evidence matters as much as the backup setup itself. Underwriters may ask for a backup schedule, the date of the most recent successful backup, and records showing a restore test actually worked. Some insurance organizations ask applicants to confirm that a server or data restoration succeeded within the last six months. A backup plan nobody has tested is a guess dressed up as a safety net.

Patching, Email Security, Access, and Response Plans

The remaining pieces of the checklist round out the picture underwriters build of a business's overall discipline. Patch management asks two simple questions: how quickly critical patches get applied, and whether anything unsupported is still running somewhere on the network. A single outdated server can undermine an otherwise strong application.

Email security and training address the most common way attackers still get in the door.

• Advanced email filtering paired with authentication records like SPF, DKIM, and DMARC, which confirm that outgoing mail is genuinely coming from the business
• Regular staff training along with phishing simulations that test whether lessons actually stuck
• Privileged access controls, including separate admin accounts, least-privilege permissions, and periodic reviews that clear out old or unused accounts
• A written incident response plan with named roles, a tabletop exercise completed within the past year, and logging detailed enough to support an investigation if the worst happens

How Underwriters Verify What You Claim

Filling out the application is only the first step. Underwriters increasingly follow up with requests for proof, and businesses that cannot produce it quickly risk delays or worse terms. Evidence requests tend to map directly onto the claims made in the application itself.

• A claim that MFA is enforced typically draws a request for an MFA coverage report straight from the identity provider
• A claim that EDR is deployed usually calls for a device coverage report generated by the EDR console
• A claim that backups are protected often needs backup configuration details alongside dated restore-test records
• A claim that patching is current may require a patch compliance report
• A claim of incident readiness usually means producing the written incident response plan along with notes from the most recent tabletop exercise

Honesty tends to serve businesses far better than a flawless-looking application that cannot hold up to scrutiny. Underwriters generally react worse to a surprise gap discovered later than to a known gap paired with a clear remediation date. A disclosed weakness with a fix already scheduled can sometimes turn what would have been a decline into a conditional quote instead.

What Happens When Coverage Gaps Show

Falling short of what an insurer expects rarely ends the conversation outright, though it does change the terms on the table. Understanding the range of possible outcomes helps business owners set realistic expectations heading into an application or renewal.

Conditional Quotes, Sublimits, and Declines

Several outcomes are possible when gaps surface during underwriting.

• A conditional quote offers coverage, but only once specific gaps close by an agreed date
• A sublimit reduces how much the policy pays for certain types of events, with ransomware being the most common target for this kind of limit
• Higher premiums or deductibles reflect the added risk that weak controls represent to the insurer
• A decline ends the application entirely, which tends to happen when a major gap exists, such as no MFA on email or remote access

When Answers Don't Match Your Real Environment

The most expensive version of this problem tends to surface after a breach rather than during underwriting. If an application lists a control that a forensic investigation later shows was never actually in place, the insurer may push back hard on paying the claim. Keeping every attested control running consistently throughout the policy period, rather than just in the weeks before renewal, offers the strongest protection against this kind of dispute.

Building a 90-Day Renewal Timeline

Renewal season goes far more smoothly with a plan that starts well before the deadline rather than scrambling in the final weeks. A 90-day runway gives a business enough room to assess where it stands, fix what needs fixing, and gather the paperwork an underwriter will likely request.

1. Pull last year's application and reread every answer to confirm it still reflects reality
2. Get a risk assessment that maps current controls against what carriers are actually asking about this year
3. Prioritize the highest-impact gaps first, typically MFA, EDR, and backup protection
4. Gather dated evidence, including coverage reports, patch reports, and restore-test records
5. Run a dark web scan to check whether employee login credentials are already circulating
6. Update the incident response plan and run a tabletop exercise if the last one happened more than a year ago

Businesses starting from scratch should plan on roughly two to three months just to deploy the necessary tools and complete backup testing, which makes the 90-day window less of a suggestion and more of a practical minimum. Businesses that already have MFA and EDR in place generally need only a few weeks to pull together the supporting evidence.

Accurate Evidence Is the Real Requirement

Every piece of this process points back to one underlying idea: insurers want application answers that match what is actually running inside a business, backed by evidence with real dates attached. A control that looks good on paper but was never deployed does nothing to protect a business and can actively hurt it if a claim ever gets investigated. The businesses that fare best treat their security controls as daily operational habits rather than a once-a-year scramble before a renewal deadline.

For an easy starting point, consider a cybersecurity assessment that maps existing controls against what today's insurers actually require.

Function-4
City: Sugar Land
Address: 13025 Stiles Ln Suite 100
Website: https://function-4.com/