Question 1

What are the minimum controls insurers require for a cyber policy today?

Accepted Answer

Five controls show up in nearly every major carrier's application: enforced multi-factor authentication across email, remote access, and privileged accounts; endpoint detection and response (EDR) or managed detection and response (MDR) on every endpoint; immutable backups with regularly tested restores; a written incident response plan that's been through a recent tabletop exercise; and a documented patch management program. Missing any one of these is now a commonly cited reason for denial or non-renewal.

Question 2

Is antivirus software enough to satisfy the endpoint protection requirement?

Accepted Answer

No. Traditional signature-based antivirus does not qualify with most carriers anymore — insurers specifically require real-time threat detection and automated response, which is what EDR and MDR tools provide and legacy antivirus does not. If your current endpoint protection hasn't been evaluated against this standard recently, it's worth confirming before your next renewal, not during a claim dispute.

Question 3

Why has cyber insurance underwriting gotten so much stricter?

Accepted Answer

Insurers have absorbed years of costly ransomware and business email compromise claims and responded by shifting from trust-based questionnaires to verification. Roughly three out of four carriers now run external attack surface scans during underwriting, checking for exposed services, missing MFA, and other gaps directly rather than relying solely on what an applicant reports on a form.

Question 4

How much does cyber insurance cost for a small business?

Accepted Answer

Costs vary significantly by industry, revenue, and existing controls, generally running from roughly $1,000 to $7,500 annually. Professional services firms with strong controls in place tend to fall on the lower end (around $1,500-$3,000), while healthcare practices often pay $3,000-$7,500 due to HIPAA-related risk, and retailers handling card payments often pay $2,000-$5,000 tied to PCI-DSS exposure. Documented, verifiable controls can swing premiums 20-40% in either direction at renewal.

Question 5

Can missing controls get an existing policy cancelled, not just denied at application?

Accepted Answer

Yes — insurers have explicitly cited missing MFA and missing EDR as reasons to decline renewal or even void coverage after the fact if an application misrepresented controls that weren't actually in place. This is why it matters to have controls genuinely implemented and documented, not just checked off on an application form under time pressure.

Question 6

Does a written incident response plan actually need to be tested?

Accepted Answer

Increasingly, yes — carriers are asking specifically whether a plan has been exercised through a tabletop exercise recently, not just whether a document exists. A plan that's never been walked through with the actual team responsible for executing it tends to fall apart under real incident pressure; see our incident response planning guide for how to build and test one properly.

Question 7

What counts as an 'immutable' backup, and why do insurers care?

Accepted Answer

An immutable backup is one that cannot be altered, encrypted, or deleted once written — even by someone with administrative access to the system — for a defined retention period. Insurers require this specifically because ransomware attacks increasingly target backup systems first, on the assumption that a business with no clean recovery option is far more likely to pay a ransom. A backup that ransomware can encrypt alongside your production data isn't a real safety net.

Question 8

How does a documented patch management program factor into underwriting?

Accepted Answer

Unpatched software with known, publicly documented vulnerabilities remains one of the most common entry points for successful attacks, and carriers now expect to see a defined process — not an ad hoc habit — for applying security updates on a regular cadence across servers, workstations, and network equipment. 'We update things when we remember to' does not satisfy this requirement in a formal application.

Question 9

Should a small business work with a broker or apply directly for cyber insurance?

Accepted Answer

A broker experienced specifically in cyber coverage is generally worth the relationship, since policy language, exclusions, and sub-limits vary significantly between carriers in ways that matter enormously at claim time — a policy that looks similar on price can differ dramatically in what it actually covers after a real incident. Pairing a knowledgeable broker with a managed IT provider that can document your actual controls tends to produce both better coverage and better pricing.

Question 10

How does CelereTech help a business prepare for a cyber insurance application or renewal?

Accepted Answer

CelereTech implements and documents the five baseline controls carriers now expect — MFA, EDR/MDR, immutable tested backups, a written and tabletop-tested incident response plan, and a documented patch management program — and provides the documentation businesses need to complete applications accurately rather than guessing. Going into a renewal with verifiable, real controls in place is the single biggest lever a business has over its premium.

Question 11

What happens if a business experiences an incident and its actual controls didn't match what was on the insurance application?

Accepted Answer

This is one of the most common reasons cyber insurance claims get denied or contested — a misrepresentation on the application, even an unintentional one, gives the carrier grounds to deny the claim entirely. This is exactly why it matters to have a managed IT provider verify and document actual controls before signing an application, rather than checking boxes based on assumptions about what's in place.

Cyber Insurance Requirements for Small Businesses

Frequently Asked Questions