Cyber Insurance Requirements: Small-Business Checklist

Cyber insurance requirements are the security controls an insurer expects before it will quote, bind, or keep a policy. They are not a global law. A broker in Texas, London, Dubai, or Johannesburg will still ask a familiar list: multi-factor authentication, backups, privileged access, and what you will do at 2 a.m. when ransomware hits.

This is a preparation checklist for small companies. It is not an offer of insurance, not a comparison of carriers, and not legal advice. Policy wording wins over any blog. If you already had a claim or a known incident, tell the broker. Hiding it is how claims get denied.

What cyber insurance is for (and what it is not)

A typical small-business cyber policy may help with incident response retainers, ransom negotiation (where legal), business interruption, notification costs, and some third-party liability. It will not replace a missing backup. It will not make a weak password into a strong one. Some policies exclude war, infrastructure failure, or uninsured crime that is really a BEC wire fraud — read the crime vs cyber split with your broker.

US state insurance regulators and the NAIC publish consumer material on cyber risk. The UK’s FCA and NCSC, and various Gulf and South African regulators, also warn that insurance is a transfer of leftover risk, not a control.

The application questions you should expect

Carriers change forms every year. These topics keep showing up:

1. MFA on email and remote access. “Yes, on some accounts” is a weak answer. They want admin, VPN, RDP, and cloud email. Phishing-resistant methods such as passkeys score better than SMS. See passkeys for small business.
2. Who has global admin. Named people, not a shared “info@” mailbox.
3. Backups that are offline or immutable and a restore test date you can name.
4. EDR or at least current antivirus on endpoints, plus a patch habit for internet-facing systems.
5. Email security: Microsoft 365 or Google Workspace with spam/phishing features on, forwarding rules reviewed.
6. An incident response contact. Even a one-page plan plus a lawyer and an IT vendor on retainer is better than “we will figure it out.”
7. Employee training in the last 12 months, including phishing. AI-written mail is now part of that story — warning signs.
8. Vendor and payment controls for changing bank details.
9. Prior incidents, ransoms, or threats in the look-back period on the form.
10. Revenue, industry, record counts (especially health, payment, or children’s data).
11. Where data lives — including staff using personal ChatGPT with customer files.
12. Cyber hygiene around AI agents if you have given tools the power to send or pay. Insurers are starting to ask. See AI agent security.

A 14-day checklist before you talk to a broker

Days 1–3: identity

• Turn on MFA everywhere you can. Remove leftover admin accounts.
• Inventory laptops and phones that hold mail.
• Disable legacy protocols (basic auth, unused app passwords).

Days 4–7: backups and logging

• Confirm you have a backup that ransomware on the file server cannot encrypt in place.
• Restore one file and one mailbox. Write the date down.
• Turn on unified audit logs in M365 or Workspace. Know who can read them.

Days 8–11: people and payments

• Write a four-step incident card: isolate, call IT, call broker/lawyer, do not power-wash evidence.
• Require a second channel for bank-detail changes.
• Run a 20-minute staff briefing. Keep attendance.

Days 12–14: the form

• Answer every question with evidence, not optimism.
• If a control is missing, say so and give a date you will finish it. Some carriers will quote with a warranty.
• Compare quotes on sublimits (social engineering, funds transfer, betterment), not only the headline premium.

Regional notes

United States, UK, Canada, Australia, Germany: brokers are common; some policies are packaged with a breach coach. Ask whether the panel law firm is included in the limit.

Saudi Arabia and the UAE: availability is growing but wording and data-residency questions can be stricter. Use a local licensed broker. Do not assume a US online binder covers a Riyadh entity.

South Africa: POPIA exposure belongs in the conversation. Ask how notification and regulator costs are treated.

If you have no broker, start with the same controls anyway. They reduce the chance you need the policy.

Claims behavior that keeps coverage

Notify early, on the number in the policy, even if you hope it is nothing. Do not pay a ransom because a pop-up said so without the carrier and counsel. Do not wipe machines before imaging if the policy expects forensics. Keep invoices. Misrepresentation on the application is a separate disaster from the incident itself.

FAQ

Is cyber insurance required by law?

Usually no for a generic small shop. Contracts, landlords, or payment processors sometimes require it. That is a commercial requirement, not a crime statute.

Will MFA alone get me a cheap policy?

It is table stakes. Backups, admin hygiene, and clean answers matter as much.

Does a claim raise my premium?

It can. So can a silent incident you hid. Ask the broker how they handle renewals after a notice-only event.

Can I buy a policy the week after I was breached?

You can try. Expect exclusions for the known event. Fix the hole first.

Treat cyber insurance requirements as a punch list: MFA, backups you have restored, a named admin, a one-page IR card, and honest answers. Buy the policy after the controls exist. The PDF does not patch the server.