What security controls do insurers expect before they will cover a small business?

What insurers are actually testing before they quote cyber cover

Insurers are not looking for perfection, they are looking for evidence that the business can absorb a common intrusion without immediate catastrophe. That usually means the company can show basic hygiene across identity, endpoint, backup, and monitoring controls, and that those controls are being used consistently rather than existing only on paper.

The practical test is whether the most likely loss path, phishing, credential theft, malware, or encrypted systems, can be contained quickly enough that claims severity stays bounded. A small business with weak baseline controls often looks like an expensive, repeat-loss prospect, even if it has never been breached.

Which controls tend to matter most

Multi-factor authentication is near the top of the list because many claims start with stolen credentials, and the insurer wants proof that logins are not protected by passwords alone. Patching matters because unremediated vulnerabilities turn a routine exploit into a systemic incident. Endpoint protection and central logging or monitoring matter because they increase the chance that compromise is detected before it spreads.

Backups matter when they are tested, isolated, and recoverable, not merely present. Insurers typically care less about the existence of a backup product than about whether the business can restore data and systems quickly after ransomware, deletion, or corruption. That is why backup testing and restore evidence often carry more weight than a generic backup policy.

Many applications and services also need access control discipline, because weak privilege management can undo otherwise solid perimeter controls. A small business that still has shared admin accounts, unmanaged service credentials, or stale access paths may fail underwriting even if it has strong tooling elsewhere. The same logic applies to Ultimate Guide to NHIs — Standards, where the issue is not just who can log in, but whether non-human access is constrained, rotated, and governed well enough to limit blast radius.

Why underwriting asks for more than a checklist

Underwriters are trying to estimate both likelihood and severity, so they look for control combinations that reduce the chance of a fast-moving incident. One weak control can be tolerable if compensating controls exist, but a cluster of gaps, such as no MFA, no patch cadence, and no usable backups, signals that a single phish or exploit could become a major loss.

That is also why insurers ask for operational proof, not just policy statements. A security policy may help explain intent, but what changes the underwriting view is evidence that the control is exercised, reviewed, and owned. For a small business, the difference between “we have a backup process” and “we restored from backup in a test last quarter” is often decisive.

Risk transfer is never a substitute for control maturity. The more the business relies on cyber insurance to absorb a loss, the more closely the insurer will inspect whether the business has already reduced the obvious attack paths. Resources such as the Risk Register Template and the Information Security Policy Template help turn that expectation into something auditable, with clear ownership, treatment, and review cadence.

What to prepare before you apply or renew

Small businesses should be ready to answer concrete questions about deployment, not general statements about being “secure.” Expect to show how MFA is enforced, how patching is tracked, how endpoints are protected, how backups are restored, and who receives alerts when suspicious activity appears. If the insurer asks for exceptions, they are usually looking for whether the exception is time-bound, approved, and compensated for by another control.

It helps to prepare the evidence in the same way you would prepare for an audit, with screenshots, policy excerpts, test results, and a short control summary. That does not mean turning the insurance application into a compliance project, but it does mean you should be able to demonstrate the controls quickly and consistently. If the business cannot do that, the control probably is not mature enough to reassure an underwriter.

Practitioner Guidance

What to prioritise: Start with the controls that most directly limit claim severity, MFA for remote and privileged access, patch discipline, and recoverable backups. If those are not demonstrable, insurers will usually discount more advanced tools and may price the policy as if the business is effectively exposed.

What to verify: Confirm that the insurer’s questions map to evidence you can produce today, not to future plans. If a control cannot be shown as enabled, tested, and owned, treat it as a gap rather than a paper control.

Common mistake: Treating insurance as a substitute for security investment is a costly error. Underwriting questionnaires increasingly reward operational proof, and the controls that reduce premium friction are the same controls that reduce the chance of a large incident.

Practitioner takeaway: The strongest insurance position is not the longest checklist, it is the shortest path from common attack to contained loss, backed by evidence that the business can prove its controls work.

Related resources from NHI Mgmt Group

• Why do insurers expect strong cyber hygiene before they offer better cover?
• How should security teams make NHI best practices usable across the business?
• Which AI security controls should organisations prioritise before scaling generative AI across the business?
• Why do authorization platforms need formal security controls before they can be trusted at scale?