A decade ago, getting cyber insurance meant answering a few yes/no questions and paying a modest premium. Then ransomware losses exploded, carriers hemorrhaged money, and the market corrected hard. Today’s applications run pages deep, ask pointed technical questions, and increasingly come with a blunt reality: no controls, no coverage — or coverage with premiums and exclusions that make the gaps expensive anyway.

Here’s what carriers now commonly expect, why, and how to get ready before your renewal instead of the week it’s due.

Why the questions got strict

Carriers price risk from claims data, and their claims data is unambiguous: most losses trace back to a handful of preventable weaknesses — no MFA on email or remote access, exposed remote desktop, unpatched known vulnerabilities, and backups that didn’t survive the attack. So applications became audits of exactly those weaknesses. Answering “yes” untruthfully is worse than answering “no”: material misrepresentation on an application is grounds for a carrier to rescind the policy or deny a claim — meaning you paid premiums for coverage that evaporates at the moment of use. Courts have sided with carriers on this. Accuracy matters more than a perfect scorecard.

The controls carriers ask about

1. Multi-factor authentication — the non-negotiable. Expect specific questions: MFA on email? On remote access/VPN? On admin accounts? On backup systems? Many carriers treat missing MFA in these spots as declinable. If you deploy one thing before renewal, deploy MFA.

2. EDR / MDR on endpoints. “Do you have antivirus?” has become “Do you have endpoint detection and response, and does anyone monitor it 24/7?” Carriers learned that ransomware detonates at 2 a.m. Saturday; managed detection (MDR) — humans watching the alerts around the clock — is increasingly the expectation for better pricing.

3. Backups that survive an attack. Applications now probe the details: Are backups encrypted? Separated from the production network? Is at least one copy offline or immutable? Are restores tested, and how often? They’re checking whether your backups would survive the backup-hunting phase of a ransomware attack — because backups that die with the network turn a restore into a ransom negotiation.

4. Patch and vulnerability management. How quickly do you apply critical security patches? Do you have a process, or does it happen when someone remembers? Some carriers scan your public internet footprint themselves before quoting — exposed remote desktop or an end-of-life firewall can show up as a declination you never get to explain.

5. Email security and awareness training. Advanced email filtering, plus recurring security awareness training with simulated phishing. Carriers know most incidents start with a click, and they price accordingly.

6. Access hygiene. Least-privilege administration (no domain-admin daily drivers), prompt offboarding of departed employees, unique credentials, no shared accounts. Some applications ask how quickly access is revoked at termination.

7. An incident response plan. Written, with named roles and current contacts. Even a short one signals — accurately — that a claim on your policy will be smaller because the response will be faster.

8. Funds-transfer controls. Because business email compromise drives so many claims: do you verify payment-detail changes by phone at a known number? Dual approval on wires? Weak answers here can carve social-engineering losses out of your coverage or cap them at a fraction of the policy limit — check that sublimit; it’s routinely a nasty surprise.

How to prepare (start 90+ days before renewal)

  1. Pull last year’s application and re-answer it honestly. Every “yes” you can’t currently prove is a work item.
  2. Close the big four first: MFA everywhere that matters, EDR/MDR deployed, an immutable/offline backup copy with a documented restore test, no remote access exposed without protection. These carry the most pricing weight.
  3. Document as you go. Screenshots of MFA enforcement, the EDR console, backup job history, a restore-test log, the one-page IR plan. Carriers (and their auditors, post-claim) want evidence, not assurances.
  4. Involve whoever runs your IT early. A good IT provider has completed these applications many times, knows what underwriters mean by each question, and can often produce the attestation evidence directly. Filling out a cyber application alone, from memory, is how inaccuracies happen.
  5. Read the policy, not just the premium. Sublimits (especially social engineering), exclusions, panel requirements (some carriers require using their breach responders), and notification deadlines all determine what the policy is actually worth on a bad day.

The useful reframe

It’s tempting to treat carrier requirements as hoops. The better frame: the requirements list is a free, claims-data-driven summary of what actually stops attacks on businesses like yours. Every control on it earns its place twice — once as lower premiums and cleaner coverage, and again as a genuinely harder target. Meet the list honestly and the insurance becomes what it should be: the backstop you never use, rather than the dispute you lose.