How to Prepare for a Cyber Insurance Audit: Small Business Checklist

The Shift That Changed Everything: From Questionnaire to Evidence

Three years ago, a cyber insurance application was a questionnaire. You checked boxes: yes, we have antivirus; yes, we have a backup; yes, we have a firewall. Nobody verified. Premiums were low because underwriters were competing for market share.

Then ransomware claims exploded. Insurers started paying out on policies where the stated controls weren’t actually in place. The response was swift: underwriters hired technical staff, applications got longer and more specific, and the standard of proof shifted from self-reported checkbox to verified evidence.

In 2026, a cyber insurance audit is closer to a technical inspection than a questionnaire. Insurers want screenshots, configuration exports, backup test logs, policy documents with revision dates, and training completion records — not your word for it.

The most significant consequence of this shift: over 40% of cyber insurance claims filed in 2024 were denied, most commonly because required security controls were missing or couldn’t be verified at the time of the incident. A business that checked “yes, we have MFA” and had MFA partially implemented found that partial implementation didn’t satisfy the policy condition — and the claim was denied.

This guide covers what insurers are actually checking in 2026, what evidence you need to produce, and the checklist that prevents claim denials.

What Insurers Are Checking: The Priority Controls

Underwriters price cyber insurance based on real-world claims data. The controls they scrutinise most heavily are the ones that appear most frequently in claims they’ve paid.

Coalition’s 2026 Cyber Claims Report found that business email compromise and funds transfer fraud together accounted for 58% of incidents. Ransomware demands surged 47% year-over-year. These two attack patterns — BEC/fraud and ransomware — drive most underwriting scrutiny. The controls that prevent them are what insurers weight most heavily.

1. Multi-Factor Authentication (MFA) — The Non-Negotiable

MFA on all accounts is the single highest-weighted control in cyber insurance underwriting. It is described by multiple insurers as “non-negotiable” — without it, most carriers will decline coverage, impose a ransomware sublimit, or increase premiums materially.

What insurers specifically check:

• MFA on all email accounts (not just administrators — all users)
• MFA on all cloud services (Microsoft 365, Google Workspace, accounting software, CRM, cloud storage)
• MFA on all remote access (VPN, RDP, remote management tools)
• MFA on all privileged/administrator accounts
• Evidence that MFA is enforced at the directory level — not just enabled optionally

The common gap: A business enables MFA on Microsoft 365 but leaves individual users able to disable it. Or MFA is enforced on email but not on the accounting software or CRM. Insurers ask whether MFA is enforced (not just available) across all systems. Partial MFA is treated as insufficient by most carriers.

What evidence to produce: Screenshot of MFA enforcement policy in your identity provider (Microsoft Entra ID, Google Admin, Okta). Screenshot of MFA settings in each major cloud service. Confirmation from IT provider that MFA is enforced, not just enabled.

2. Endpoint Detection and Response (EDR) — Beyond Basic Antivirus

Basic antivirus is no longer the accepted endpoint security standard for cyber insurance purposes. Most carriers in 2026 specifically ask whether EDR (not just antivirus) is deployed, and whether it is centrally managed.

What insurers specifically check:

• EDR solution name and vendor (not “we have antivirus” — which product)
• Whether EDR is deployed on all devices (not just some)
• Whether EDR is centrally managed (able to see device status from one console)
• Whether EDR is actively monitored (someone reviews alerts)

The common gap: Consumer antivirus (Windows Security without management, Avast Free in violation of its commercial EULA) where the question was about EDR. Or EDR installed on most devices but missing from remote employees’ personal machines used for work.

What evidence to produce: Screenshot of EDR management console showing all devices enrolled and active. Documentation of the EDR product name and tier.

3. Tested, Encrypted Backup — With Evidence of Restoration Testing

Backup is the ransomware recovery mechanism. Insurers don’t just ask whether you back up — they ask whether backups are tested (data actually recoverable), encrypted, stored off-network (ransomware-resistant), and recent.

What insurers specifically check:

• Backup frequency (daily is standard expectation)
• Off-site or cloud storage separate from primary systems
• Immutable or air-gapped backup copy (not reachable by ransomware that encrypts your main systems)
• Encryption of backup data
• Recovery testing — when was the last restoration test, and what was verified
• Recovery time objective — how long to restore from backup

The common gap: Backup processes exist but restoration has never been tested. Or backups are stored on a network drive that ransomware can reach and encrypt alongside the primary data. Or Microsoft 365 data isn’t backed up (relying on Microsoft retention alone).

What evidence to produce: Backup system screenshot showing recent backup status and schedule. Documentation of last restoration test with date and what was verified. Configuration evidence showing off-site or isolated backup location.

4. Privileged Access Management — Least Privilege and Admin Account Controls

How administrative access is managed is a consistent underwriting focus. Admin accounts have the most attack value — an attacker who compromises an admin account can do significantly more damage than one who compromises a standard user account.

What insurers specifically check:

• Separation of admin accounts from standard user accounts (admins don’t browse the web or read email with admin credentials)
• Minimum number of admin accounts (not everyone is an admin)
• MFA specifically on admin accounts (even if other MFA isn’t enforced everywhere)
• No shared admin credentials
• Just-in-time access for privileged operations (if applicable to your environment)

The common gap: Developers or IT staff who use their admin accounts for daily work including email and web browsing. Or every employee has local admin rights on their own machine.

What evidence to produce: Access control policy documenting admin account management. Screenshot of user account configuration showing standard and admin accounts are separate.

5. Security Awareness Training with Completion Records

Because business email compromise accounts for a disproportionate share of cyber claims, insurers specifically ask about phishing training. They no longer accept “we tell people to be careful with emails.”

What insurers specifically check:

• Named training platform or programme
• Training frequency (annual minimum; quarterly is better)
• Completion tracking — percentage of employees who have completed current training
• Phishing simulation history — whether simulations have been conducted
• Training content that reflects current threats (not a slide deck from 2019)

The common gap: Training conducted informally with no documentation. Or annual training completed but completion records not maintained. Or training exists for most staff but hasn’t been completed by new hires yet.

What evidence to produce: Training platform screenshot showing completion rate and dates. Completion records by employee. Phishing simulation campaign records if available.

6. Email Security Controls (SPF, DKIM, DMARC)

Because BEC and phishing are the most common claim triggers, email security is a specific focus area. Insurers ask about email authentication standards that reduce email impersonation.

What insurers specifically check:

• SPF record published and correctly configured
• DKIM signing active on outbound email
• DMARC policy published (ideally at p=reject or p=quarantine)
• Anti-phishing filtering active on inbound email
• Email security solution beyond basic ISP filtering

The common gap: SPF record exists but DMARC is missing or set to p=none (monitoring only, no enforcement). Or DMARC is published but with incorrect configuration that makes it ineffective.

What evidence to produce: DNS lookup results showing SPF, DKIM, and DMARC records. Screenshot of email security configuration in Microsoft 365, Google Workspace, or dedicated email security platform.

7. Patch Management — Timely Application of Critical Updates

Unpatched vulnerabilities in internet-facing systems (VPN concentrators, remote desktop gateways, firewalls) are the primary initial access vector for ransomware attacks in 2026. Insurers are very specific about patching.

What insurers specifically check:

• Patch management process or tool (not “IT applies patches when they remember”)
• Timeline for critical patches (14–30 days is the expected standard)
• Currency of operating systems (end-of-life systems are a major underwriting red flag)
• Currency of internet-facing systems particularly (VPN, firewall firmware, remote access tools)

The common gap: Devices with operating systems past their end-of-support date (Windows 10 after October 2025). VPN or firewall firmware not updated in over a year. Patch management process that exists in principle but isn’t tracked or documented.

What evidence to produce: Patch management console screenshot showing current status. Evidence of patch policy with defined timelines. Confirmation that no end-of-life operating systems are in use.

8. Incident Response Plan — Written and Tested

Insurers ask whether a written incident response plan exists because they know that businesses without one cost significantly more to assist when a claim is filed. A tested plan costs them less.

What insurers specifically check:

• Written IRP exists (not just described — documented)
• The plan has been reviewed in the past 12 months
• Tabletop or other testing has been conducted
• Breach notification obligations are addressed in the plan
• Contact list for response resources (IT, legal, breach coach, insurer hotline)

What evidence to produce: Written incident response plan document with revision date. Documentation of any tabletop exercise or testing conducted.

9. Vendor Risk Management — Including AI Tools

Insurers increasingly ask about third-party risk, particularly as supply chain attacks have become more common. In 2026, this specifically includes AI tools that employees use for business work.

What insurers specifically check:

• Whether critical vendors have been assessed for security posture
• Whether key vendors (cloud providers, SaaS platforms) have SOC 2 Type II or equivalent attestation
• Whether employees are using AI tools that process business data without assessment
• Contractual security obligations with key vendors

The common gap: No vendor security assessment process. Employees using AI tools (ChatGPT, Copilot, AI writing assistants) to process business data without any assessment or policy. No awareness of which vendors actually have SOC 2 certification.

What evidence to produce: Vendor inventory with security assessment status. SOC 2 reports or equivalent for critical vendors. AI use policy.

10. Written Security Policies

Underwriters treat the existence of written policies as evidence that security is managed as a programme rather than ad hoc. Documented policies are also what protect you when a claim is disputed.

What insurers specifically check:

• Information security policy exists and is current (reviewed in past 12 months)
• Acceptable use policy exists and employees have acknowledged it
• Password/MFA policy documented
• Data handling and retention policy

What evidence to produce: Policy documents with revision dates and version numbers. Employee acknowledgement records.

The Evidence Pack: What to Prepare Before Your Audit

Insurers increasingly request evidence rather than self-reported answers. The shift has been from “do you have MFA?” to “show us your MFA configuration.” Preparing an evidence pack before your audit or renewal is the single highest-value pre-audit activity.

Organise evidence by control category. A simple shared folder with one subfolder per category, containing screenshots, exports, and documents, is sufficient. Label each screenshot with the control it demonstrates and the date it was captured.

Recommended evidence pack contents:

Cyber Insurance Audit Preparation Checklist

Use this checklist 30–60 days before your application or renewal.

60 Days Before

• ☐ Pull last year’s application or policy questionnaire and review each question honestly against your current state
• ☐ Identify gaps between your current controls and what you attested to last year
• ☐ Run the cybersecurity audit checklist from our companion article to establish a baseline
• ☐ Confirm your broker contact and renewal timeline

45 Days Before

• ☐ Verify MFA is enforced (not just enabled) on all email accounts for all users
• ☐ Verify MFA is enforced on all cloud services — audit every SaaS tool against MFA status
• ☐ Verify MFA is enforced on all remote access (VPN, RDP)
• ☐ Confirm no former employees have active accounts on any system
• ☐ Verify no end-of-life operating systems are in use (Windows 10 EOL October 2025)
• ☐ Check firewall and VPN firmware currency
• ☐ Verify backup restoration has been tested in the past 12 months — if not, schedule and run a restoration test
• ☐ Verify at least one backup copy is stored in a location not continuously connected to primary systems

30 Days Before

• ☐ Capture evidence screenshots for every control in the evidence pack (see table above)
• ☐ Verify SPF, DKIM, and DMARC are correctly configured — use a free DNS checking tool
• ☐ Review and update the written information security policy — date it and note any changes
• ☐ Verify security awareness training is current and completion records are available
• ☐ Verify incident response plan is documented, current, and has a named owner
• ☐ Review vendor inventory — confirm SOC 2 status of critical vendors is known
• ☐ Review AI tool usage — ensure a policy exists on what business data can be processed by AI tools
• ☐ Confirm cyber insurance policy requirements are being actively maintained (these often include MFA, backup, and training as coverage conditions)

2 Weeks Before

• ☐ Organise evidence pack in a shared folder, labelled by category with dates
• ☐ Review the insurer’s questionnaire — read every question carefully against your actual controls, not your aspirational ones
• ☐ Answer every question based on what is verifiably in place, not what you intend to implement
• ☐ Flag any questions where the honest answer differs from last year’s answer and discuss with your broker

Application or Renewal

• ☐ Submit the questionnaire with accurate answers — do not overstate control implementation
• ☐ Have the evidence pack available for any follow-up verification requests
• ☐ Review coverage terms, sublimits, and exclusions — particularly ransomware and BEC coverage
• ☐ Confirm the insurer hotline number and add it to your incident response plan

The Questions That Most Commonly Cause Problems

Based on what insurers and brokers report finding during audits, these are the questions where small businesses most frequently provide inaccurate answers:

“Is MFA enforced for all employees on all email accounts?” The common problem: MFA is enforced for admins but not all users. Or MFA is available but optional. Or a third-party integration bypasses MFA. Insurers verify this at the directory level.

“Do you have EDR deployed on all endpoints?” The common problem: Consumer antivirus described as EDR. Or EDR on company-owned devices but not on personal devices used for business work. Or EDR installed but not centrally managed.

“Are your backups stored in a location that could not be encrypted by ransomware?” The common problem: Backups stored on a network drive connected to the same network. Or cloud backup using the same credentials as the primary systems (ransomware can reach it). Or backup exists but restoration has never been verified.

“Have you tested your backup restoration in the past 12 months?” The common problem: Backups run automatically and are assumed to be working. Restoration testing is a separate, explicit activity that must be documented. Many businesses have never done it.

“Do you have a written incident response plan?” The common problem: “We know what to do” is not a written plan. The IRP must be documented, current, and accessible. It must name who does what.

“Is security awareness training completed by all employees annually?” The common problem: Training was conducted for most employees but completion records weren’t maintained. Or training was conducted once at onboarding but not annually since.

Claim Denial: The Risk That Makes This Matter

Cyber insurance claim denials are not just a financial loss — they’re a compounding disaster. You’ve already experienced a breach. Then you discover your claim is denied because a required control wasn’t implemented or can’t be verified.

The most common bases for claim denial:

Misrepresentation in the application. If you checked “yes, MFA is enforced on all accounts” and it wasn’t, that’s a material misrepresentation. Insurers can void the policy entirely, not just deny the claim.

Control requirement not met at time of incident. Even if MFA was enforced when you applied, if it lapsed before the incident, the coverage condition may not be satisfied. Cyber insurance controls are not one-time attestations — they’re ongoing requirements.

Exclusion applies. Ransomware sublimits, social engineering fraud exclusions, and war exclusions are common. Review your policy specifically for these before assuming you’re covered.

Coverage gap due to undisclosed change. If your IT environment changed materially after the policy was issued (new major cloud service, new remote access, significant staff change) and you didn’t notify the insurer, the change may be outside covered scope.

The practical takeaway: cyber insurance works as a safety net only if the conditions are genuinely met and verified. An insurance policy that states requirements you’re not actually meeting is not a safety net — it’s a false sense of security that becomes expensive at the worst possible moment.

What Cyber Insurance Covers (and What It Doesn’t)

Before the audit prep, understand what the policy you’re maintaining actually provides.

Typically covered:

• Incident response costs: Forensic investigation, breach coach, legal counsel during the response
• Notification costs: Cost of notifying affected individuals and regulatory authorities
• Business interruption: Revenue loss during systems downtime following a covered incident
• Data restoration: Cost of restoring or recreating lost or corrupted data
• Extortion/ransomware: Ransom payment (verify your policy terms — many have sublimits) and associated costs
• Third-party liability: Claims from customers, partners, or regulators following a breach

Commonly excluded or sublimited:

• Ransomware: Many policies include ransomware coverage but with lower sublimits than the main policy limit — verify the sublimit
• Social engineering / BEC fraud: Funds transferred by an employee who was deceived are often excluded or under a separate fraud sublimit — verify coverage
• State-sponsored attacks: War exclusions can apply to nation-state attacks — review the specific exclusion language
• Pre-existing breaches: Incidents that began before the policy start date
• Controls not in place: If a required control wasn’t implemented, the claim may be denied

Review your policy for:

• The ransomware sublimit vs the main policy limit
• Whether social engineering / BEC fraud has a sublimit or is covered under the main limit
• The specific war exclusion language and how it applies
• What the policy defines as the trigger for coverage (discovery vs occurrence)

What to Avoid

Don’t overstate controls on the application. The denial risk from misrepresentation significantly outweighs the premium saving from a cleaner application. If MFA isn’t fully implemented, say so. Your broker can advise whether to implement it before the application, disclose the gap with a remediation timeline, or accept a higher premium or sublimit. None of those outcomes is as bad as a claim denial at 2am during an active ransomware event.

Don’t treat the annual renewal as the only time controls are verified. Insurers are increasingly conducting mid-term audits and post-loss verification. A control that was in place at renewal but lapsed six months later may not satisfy a claim filed at month seven. Treat insurance control requirements as operational ongoing requirements, not annual attestations.

Don’t assume your IT provider has addressed everything. Even in a fully MSP-managed environment, there are controls the MSP may not have implemented: policies you haven’t documented, training you haven’t conducted, vendor assessments you haven’t commissioned. The insurance policy is yours, the questionnaire answers are yours, and the claim denial will be yours. Verify with your IT provider specifically what’s in place versus assumed.

Don’t skip the restoration test. It is the most commonly misrepresented control in cyber insurance applications and the most consequential gap in a ransomware event. Testing a backup restoration takes a few hours and needs to happen annually. Document it.

Final Verdict

Cyber insurance in 2026 is an evidence-based audit, not a form-filling exercise. The businesses that prepare well — that start 60 days before renewal, build an evidence pack, run a restoration test, verify MFA enforcement, and answer the questionnaire based on verifiable controls — get better coverage at lower premiums with fewer sublimits and exclusions.

The businesses that treat it as a form to be completed at the last minute, answering based on aspiration rather than verification, face two risks: paying for coverage that won’t respond when they need it, or being denied coverage for failing to implement the controls they said they had.

The three controls that move the needle most with underwriters, in order of impact: MFA enforced everywhere, tested off-network backup, and EDR centrally managed on all devices. If those three are genuinely in place and evidenced, most other gaps represent pricing adjustments rather than coverage refusals.

Start the preparation 60 days before renewal. Build the evidence pack. Test the backup. And answer honestly.

Frequently Asked Questions

How long does a cyber insurance audit take for a small business?

A self-conducted pre-audit preparation using this checklist takes 2–4 hours of focused time, typically spread over several sessions as you gather evidence from different systems. A formal insurer-conducted technical audit — increasingly required for higher coverage limits or businesses in higher-risk sectors — typically takes 1–5 business days of assessor time, with 1–2 weeks of elapsed calendar time for a small business. Some insurers now use automated technical scanning tools that assess your external attack surface and email security configuration as part of the underwriting process, completing within hours of the application.

What happens if I fail a cyber insurance audit?

A failed audit typically results in one or more of: a higher premium, a reduced coverage limit or sublimit for specific risk areas (ransomware sublimit, BEC fraud sublimit), additional coverage conditions requiring specific controls to be implemented, a specific exclusion for the risk area with identified gaps, or (in cases of material gaps) a decline to quote. Outright refusal is most common when MFA is not in place on any accounts or when there is no backup that could survive a ransomware attack. Most insurers would rather impose a higher premium or sublimit than decline entirely for a business that is otherwise viable.

Does cyber insurance require a third-party security assessment?

It depends on your coverage amount, industry, and insurer. Most small businesses with under $1 million in coverage limits are underwritten based on the application questionnaire with some automated technical verification. Businesses seeking $5 million or more in coverage, businesses in high-risk sectors (healthcare, financial services, legal), or businesses with a recent prior claim are more likely to face formal third-party assessment requirements. Consult your broker about the specific requirements for the coverage limit and insurer you’re targeting.

What is a ransomware sublimit and should I be concerned about it?

A ransomware sublimit is a lower coverage cap specifically for ransomware-related costs within a policy that has a higher overall limit. If your policy has a $1 million overall limit but a $250,000 ransomware sublimit, a ransomware attack that costs $800,000 to resolve would only be covered up to $250,000. Ransomware sublimits are common in 2026, particularly for businesses that haven’t implemented specific controls (immutable backup, EDR, MFA). The best way to avoid a sublimit is to implement the controls that demonstrate ransomware readiness. Review your policy specifically for sublimits before assuming your coverage limit applies to ransomware claims.

Can my cyber insurance be cancelled if I lose a required control?

Yes, in some circumstances. Cyber insurance policies typically require covered businesses to maintain specified security controls throughout the policy period. If a material control — MFA on all accounts, EDR on all endpoints — lapses and you experience an incident during the lapse period, the insurer may deny the claim on grounds that the coverage condition was not met. Some policies include mid-term compliance obligations and audit rights. Review your policy for ongoing control requirements and treat them as operational requirements, not just initial attestations.

For further guidance on cyber insurance, consult a licensed cyber insurance broker. Coverage requirements vary by insurer, policy type, coverage limit, industry, and business size. This article reflects general market trends as of August 2026 and does not constitute insurance advice. For CISA guidance on cyber insurance and risk management, see CISA’s Cyber Insurance Resources.

Related reading on SmallBiz Defense:

• Cybersecurity Audit Checklist for Small Business (2026): Free Template
• How to Write a Cybersecurity Policy for Your Small Business (2026)
• Best Multi-Factor Authentication (MFA) Apps for Business in 2026 (Reviewed)