Cyber insurance requirements for small practices and firms

Who this page is for

• Your cyber policy renews in the next three months and the application looks longer than last year’s.
• The application asks yes or no questions about MFA, EDR and backups that you can’t answer with confidence.
• Your broker said you need certain controls in place before the insurer will quote.
• You’re buying cyber insurance for the first time for a practice or a small firm.

The problem

The renewal email arrives 45 days before expiration. Attached is a supplemental application with questions like “Is MFA required for all remote access to your network?” and “Do you use an endpoint detection and response tool on all endpoints?”

The office manager forwards it to the IT company, which replies “yes” to most of it. Nobody checks whether the front desk’s shared mailbox has MFA, or whether the backup drive is offline. The policy is bound on those answers.

What insurers commonly ask about

Each insurer writes its own application, and I won’t claim to know every one. What I can show is what insurers and agencies publish.

Travelers publishes five cyber readiness practices: multifactor authentication, keeping systems up to date, endpoint detection and response, an incident response plan, and data backups using a 3-2-1 approach. CISA’s #StopRansomware Guide recommends the same core controls. HHS’s healthcare Cybersecurity Performance Goals list several of them as essential goals.

Control	What to be ready to show	Published basis
MFA on email	MFA enforced for every mailbox, including shared and service accounts	Travelers; CISA; CPG Multifactor Authentication
MFA on remote access	VPN, remote desktop and the IT company’s remote tool all require MFA	Travelers; CISA guide; HICP 2.S.A
MFA on admin accounts	Every admin account, in email, cloud apps and on-premises systems	Travelers; HICP 3.S.A
Endpoint detection and response	EDR installed and reporting on every computer and server, and who responds	Travelers; CISA guide
Backups	At least one copy offline or immutable, and a recent test restore	Travelers (3-2-1); CISA guide (“offline, encrypted backups”)
Patching	Automatic updates, and no unsupported operating systems	Travelers; CPG Mitigate Known Vulnerabilities
Training and phishing tests	Training records and simulation results	CISA guide; CPG Basic Cybersecurity Training
Incident response plan	A written plan with contacts, including the insurer’s hotline	Travelers; CISA guide; CPG Basic Incident Planning
Privileged access	Separate admin accounts, least privilege	CISA guide; CPG Separate User and Privileged Accounts

The MFA question in detail

Travelers’ MFA article says MFA is “often used to verify users who are accessing an organization’s network or their email remotely, or accessing privileged or administrative accounts.”

Its readiness page goes further and says MFA “should be used for all users all the time.”

CISA’s MFA page calls phishing-resistant MFA, meaning FIDO or WebAuthn security keys and passkeys, the standard to aim for. It also says “any MFA is better than no MFA.”

For the application, the practical test is simple. If any mailbox, VPN account or admin login can be reached with only a password, the honest answer to “MFA on all” is no.

Renewal timeline

This is the schedule I suggest, not an insurer rule:

• 90 days out: get last year’s application and the new one from your broker. Mark every control question.
• 75 days out: check each answer against a setting or report, not memory. The HIPAA security checklist covers most of these controls.
• 60 days out: order and deploy anything missing, usually MFA gaps, EDR or an offline backup.
• 30 days out: save evidence: screenshots of MFA enforcement, EDR coverage reports, a backup test result, training records, the incident response plan.
• Before signing: read each answer once more with whoever manages IT, and ask the broker about any question you’re unsure of.

How to prepare

Build one folder you can reuse every year and for client or payer questionnaires:

• MFA enforcement screenshot from your email admin console.
• List of remote access tools, including the IT company's, with MFA status.
• EDR console report showing every device covered.
• Backup report with the offline or immutable copy and the last test restore date.
• Patch status report and a list of any unsupported systems with your plan for each.
• Training completion records and phishing test results.
• The written incident response plan.
• Your latest HIPAA risk analysis, for health care practices.

Some insurers also offer tools to policyholders. Coalition, for example, describes Coalition Control as a platform “built to help policyholders improve their security.”

Options compared: services that close common gaps

Gap	Providers I work with	Options I don’t work with	Pricing info (as of October 2026)
EDR on every endpoint, with someone responding	Huntress managed EDR; CyberMaxx MDR; Coro	Microsoft Defender for Business	Huntress MSRP $8.99 per endpoint per month, 50-seat minimum direct (Huntress); Defender $3.00 per user per month, paid yearly (Microsoft); Coro and CyberMaxx by quote (Coro, CyberMaxx)
MFA and password hygiene	Keeper	1Password; MFA built into Microsoft 365 or Google Workspace	Keeper prices didn’t display when I checked [VERIFICAR] (Keeper)
Training and phishing tests	Hook Security; Huntress Managed SAT; Coro	KnowBe4	Huntress SAT MSRP $2.08 per learner per month; KnowBe4 from $2.40 per seat per month at 25 to 50 seats on a 3-year term (KnowBe4); Hook by quote (Hook)
Email security	Coro	Microsoft Defender for Office 365, Google Workspace security settings	Coro by quote
Identity threats in Microsoft 365 or Google	Huntress Managed ITDR	Sign-in alerts built into your email platform	Huntress ITDR MSRP $4.80 per identity per month

What it costs

The cost that matters is usually the gap between what you have and what the application asks for. Using only published prices as of October 2026:

• EDR for 10 users with Microsoft Defender for Business: $30 per month, paid yearly.
• Managed EDR for 10 endpoints with Huntress at MSRP: $89.90 per month, usually through an IT provider.
• Training for 10 learners with Huntress Managed SAT at MSRP: $20.80 per month.

Insurance premiums themselves aren’t published, and I don’t sell insurance. Your broker prices the policy.

My recommendation by scenario

• If MFA is the only gap, fix it in the email admin console this week. It’s often the quickest gap to close.
• If you have antivirus but no EDR, add EDR before renewal. If nobody can watch alerts, choose managed EDR or MDR.
• If your only backup is a drive attached to the server, add an offline or immutable copy and test a restore before you answer the backup question.
• If you’re a law firm, expect questions about wire transfer verification too. The law firm page covers that control.
• If you’re a health care practice, line the application up with your HIPAA work, using the healthcare cybersecurity guide.

Questions to ask your broker and your IT provider

1. Which questions on this application, if answered “no,” would stop a quote or change the premium?
2. Does “all remote access” include our IT company’s remote support tool?
3. Does our antivirus count as EDR under this insurer’s definition?
4. Does the policy have a panel of incident response vendors we must use?
5. What is the claims hotline, and does it belong in our incident response plan?
6. What evidence would the insurer ask for after a claim?

Common mistakes on applications

If a question uses a term you don’t recognize, like immutable backup or privileged access, the glossary has short definitions.

1. Answering from memory. Check each answer against a setting, report or screenshot.
2. Counting partial MFA as yes. One shared mailbox or one admin account without MFA can make “all” untrue.
3. Calling antivirus EDR. Travelers describes EDR as monitoring for anomalous behavior, not only searching for malware.
4. Forgetting the IT vendor. Its remote tool reaches every computer you own.
5. Backups that can be encrypted with everything else. A backup on the same network may not meet the insurer’s definition.
6. Not reading the incident clause. A policy can require prompt notice to the insurer and the use of its approved vendors. Put those terms in your plan before you need them.

If you want me to compare the services that close your application gaps before your renewal date, send me your renewal date and current setup.