Small Business · Free Resource
Cyber Insurance Readiness Checklist
The 12 IT controls cyber insurers now require before issuing — or paying out — a policy, with a plain-English score guide. Verify your controls actually match what you've attested to. Save this page or print it (Ctrl/Cmd+P).
⚠ Most denied cyber claims aren't fraud — they're owners who believed a control was in place that was never actually verified.
1
Access
MFA enabled and enforced on every email account
Not just "turned on in policy" — actually enforced, with no user exceptions or bypasses. Insurers will check this specifically after a claim.
2
Access
MFA enabled on all remote access
VPN and Remote Desktop both need MFA — a common gap even at businesses that got email MFA right.
3
Detection
EDR installed and reporting on every endpoint
Endpoint Detection and Response, not traditional antivirus — including any remote-worker laptops insurers may not think to ask about but will check.
4
Backup
Encrypted, offsite backups isolated from your production network
Separate from systems a ransomware event could reach and encrypt alongside everything else.
5
Backup
Backup restoration actually tested
A real file restoration from the offsite copy — not just confirmation that the backup job ran.
6
Access
Privileged access management — no shared admin passwords
Separate, individually-attributable admin accounts for IT functions, not one shared login everyone uses.
7
Detection
Email filtering with anti-phishing controls
Beyond basic spam filtering — phishing remains the most common entry point insurers see in claims.
8
Administrative
Security awareness training, annual and documented
Every employee, at least once a year, with completion records you can produce if asked.
9
Administrative
Patch management process with evidence
Critical patches applied within 30 days of release, with documentation showing it actually happened.
10
Administrative
Incident response plan, documented and on file
At least one person in your business knows exactly what to do in the first 2 hours of a ransomware event.
11
Access
Managed vendor/third-party remote-access controls
Any vendor with remote access to your systems is tracked and access-controlled, not a standing, unmonitored connection.
12
Documentation
Current policy reviewed for ransomware sublimits and reporting windows
Know your actual coverage — and the 30–72 hour claim-notification window — before you need it, not after.
Score Yourself
10–12 checked Strong postureYour controls likely support what you've attested to — worth a pre-renewal verification pass.
6–9 checked Moderate exposureReal gaps — close these before your next renewal, or a claim could be at risk.
0–5 checked High riskAct now — this is the profile of a business whose next claim could be denied on misrepresentation grounds.
This page is yours to keep — bookmark it, print it, or share it with your insurance broker.
Free Consultation
Not Sure Your Controls Match What You've Attested To?
Book a free 30-minute Risk Review. Wlad will walk your actual environment against this exact checklist and give you a written report within 24 hours — before your renewal, or before a claim.
Schedule My Free Risk Review →Questions first? Send us a message or call (516) 734-1515