CyberReadiness.AICyberReadiness.AI

Free resource · Updated 2026

Cyber Insurance Coverage Checklist

Before you apply for — or renew — a cyber insurance policy, you'll need to answer detailed questions about your security controls. This checklist covers the controls that cyber insurance applications commonly ask about, drawn from real carrier application forms, written in plain English. Work through it before you sit down with the paperwork.

Multi-Factor Authentication (MFA)

Why insurers commonly ask

MFA is one of the most consistently required controls. Cyber insurance applications commonly ask whether MFA is in place for email, remote access, and admin accounts — because compromised credentials appear in a large proportion of claims.

Self-check

  • Is MFA required for all email accounts — not just administrators?
  • Is MFA in place for all remote access, including VPN and remote desktop?
  • Are admin and privileged accounts protected with app-based or hardware MFA (not SMS-only)?

Backups & Recovery

Why insurers commonly ask

Ransomware is a top driver of cyber claims. Insurers typically ask whether backups exist, whether they're stored offline or in immutable storage, whether backup credentials are separate from production systems, and whether a restore has actually been tested — because an untested backup may not work under pressure.

Self-check

  • Are backups stored offline or in immutable storage that ransomware cannot encrypt?
  • Do backups use separate credentials — not shared with production systems?
  • Has a full restore been successfully tested in the past 12 months?

Endpoint Protection

Why insurers commonly ask

Endpoints — laptops, desktops, servers — are common initial access points. Insurers commonly look for whether the business has antivirus or, better, an endpoint detection and response (EDR) solution deployed across all devices and kept current.

Self-check

  • Is antivirus or EDR software installed on all company-owned devices?
  • Is it actively monitored and kept up to date?
  • Are any unmanaged or personal devices excluded from protection?

Email Security

Why insurers commonly ask

Phishing is the leading initial attack vector. Insurers typically ask about email filtering, anti-phishing tools, and domain authentication standards — because a missing DMARC record makes it easier for attackers to impersonate your domain in fraud attempts.

Self-check

  • Is an email filtering solution in place that scans for phishing and malicious links?
  • Is DMARC configured for your business domain (set to at least 'quarantine' or 'reject')?
  • Are SPF and DKIM records published for all sending domains?

Patching & Vulnerabilities

Why insurers commonly ask

Unpatched systems are a common entry point for attackers. Cyber insurance applications commonly ask whether critical patches are applied within a defined timeframe and whether any vulnerability scanning is conducted.

Self-check

  • Are critical and high-severity patches applied within 30 days of release?
  • Is there a managed patching process or periodic vulnerability scanning in place?
  • Are end-of-life operating systems or software present anywhere in your environment?

Access Control

Why insurers commonly ask

Least-privilege access limits what a compromised account can reach. Insurers commonly ask whether access is granted on a need-to-know basis, whether departing employees are promptly offboarded, and whether shared admin accounts are in use.

Self-check

  • Do employees have access only to the systems and data they need for their role?
  • Are accounts disabled on or before an employee's last day?
  • Are shared or generic admin accounts eliminated in favor of individual named accounts?

Incident Response Plan

Why insurers commonly ask

A documented plan shows that a business knows what to do when something goes wrong — and typically reduces the severity of a claim. Insurers commonly ask whether a written plan exists, whether roles and contacts are defined, and whether it has been reviewed recently.

Self-check

  • Is there a written incident response plan — even a basic one?
  • Does it define who is responsible, who to contact (legal, IT, insurer), and what steps to take?
  • Has the plan been reviewed or tested in the past 12–24 months?

People & Payment Controls

Why insurers commonly ask

Business email compromise and fraudulent funds transfers are among the costliest claims categories. Insurers commonly ask whether employees receive security awareness training and whether call-back verification is required before transferring funds or changing payment details.

Self-check

  • Do employees receive regular security awareness training — at minimum, annually?
  • Is out-of-band (phone call-back) verification required before changing payment details or wiring funds?
  • Are urgent fund-transfer requests treated with heightened scrutiny regardless of how they appear?

Checking boxes is the easy part — knowing where you stand is the point.

The free assessment goes deeper: your CyberReadiness Score — two components: Cyber Posture and Insurance Readiness — your specific gaps ranked by severity, and plain-English next steps in about 10 minutes.

Get your free CyberReadiness Score

FREE · CYBERREADINESS SCORE · ~10 MINUTES