Small Business · Free Resource

Cyber Insurance Readiness Checklist

The 12 IT controls cyber insurers now require before issuing — or paying out — a policy, with a plain-English score guide. Verify your controls actually match what you've attested to. Save this page or print it (Ctrl/Cmd+P).

⚠ Most denied cyber claims aren't fraud — they're owners who believed a control was in place that was never actually verified.

Access

MFA enabled and enforced on every email account

Not just "turned on in policy" — actually enforced, with no user exceptions or bypasses. Insurers will check this specifically after a claim.

Access

MFA enabled on all remote access

VPN and Remote Desktop both need MFA — a common gap even at businesses that got email MFA right.

Detection

EDR installed and reporting on every endpoint

Endpoint Detection and Response, not traditional antivirus — including any remote-worker laptops insurers may not think to ask about but will check.

Backup

Encrypted, offsite backups isolated from your production network

Separate from systems a ransomware event could reach and encrypt alongside everything else.

Backup

Backup restoration actually tested

A real file restoration from the offsite copy — not just confirmation that the backup job ran.

Access

Privileged access management — no shared admin passwords

Separate, individually-attributable admin accounts for IT functions, not one shared login everyone uses.

Detection

Email filtering with anti-phishing controls

Beyond basic spam filtering — phishing remains the most common entry point insurers see in claims.

Administrative

Security awareness training, annual and documented

Every employee, at least once a year, with completion records you can produce if asked.

Administrative

Patch management process with evidence

Critical patches applied within 30 days of release, with documentation showing it actually happened.

Administrative

Incident response plan, documented and on file

At least one person in your business knows exactly what to do in the first 2 hours of a ransomware event.

Access

Managed vendor/third-party remote-access controls

Any vendor with remote access to your systems is tracked and access-controlled, not a standing, unmonitored connection.

Documentation

Current policy reviewed for ransomware sublimits and reporting windows

Know your actual coverage — and the 30–72 hour claim-notification window — before you need it, not after.

Score Yourself

10–12 checked Strong postureYour controls likely support what you've attested to — worth a pre-renewal verification pass.

6–9 checked Moderate exposureReal gaps — close these before your next renewal, or a claim could be at risk.

0–5 checked High riskAct now — this is the profile of a business whose next claim could be denied on misrepresentation grounds.

This page is yours to keep — bookmark it, print it, or share it with your insurance broker.

Free Consultation

Not Sure Your Controls Match What You've Attested To?

Book a free 30-minute Risk Review. Wlad will walk your actual environment against this exact checklist and give you a written report within 24 hours — before your renewal, or before a claim.

Schedule My Free Risk Review →

Questions first? Send us a message or call (516) 734-1515