The 7 controls every cyber insurance application asks about in 2026

A cyber insurance application in 2026 is a security audit with a signature line. Carriers stopped taking "we're careful" for an answer several renewal cycles ago. Now they ask for specific controls, ask whether they're documented, and have you attest in writing that your answers are accurate. Answer wrong and the best case is a premium surcharge. The worst case is a denied claim months later, when it matters most.

Here are the seven controls that show up, in some form, on virtually every small-business cyber application. For each one: what carriers mean by it, and what evidence you should have in hand before you sign.

1. MFA on email, remote access, and admin accounts

The first page of nearly every application. Carriers ask about three places specifically: business email, remote access (VPN, remote desktop, remote-support tools), and administrator accounts. "Enabled for most people" fails the question. Underwriters ask whether it's enforced, because attackers find the one exception.

Evidence to have: your MFA enforcement policy, plus a screenshot or export from Microsoft 365 / Google Workspace showing enforcement status. (CIS v8.1 IG1, safeguards 6.3–6.5.)

2. Endpoint detection and response (EDR)

Traditional antivirus checks files against known signatures. EDR watches for attacker behavior, the hands-on-keyboard activity that comes before ransomware. Many carriers now ask for it by name, and some list acceptable products. Protection that nobody manages or watches generally doesn't support a "yes."

Evidence to have: the product name, what it covers (every workstation and server), and who sees alerts.

3. Backups that are tested and survivable

Every application asks about backups. The better questionnaires ask three follow-ups: are they automatic, is there an offline or immutable copy ransomware can't reach, and have you actually tested a restore? That last one matters more than most owners expect. Refusing to pay a ransom has become the norm (a record 86% of victims refused in Coalition's 2026 claims analysis), and working, tested backups are what make refusing a real option.

Evidence to have: your backup and recovery policy, and a dated note from your last restore test.

4. Patching, with no end-of-life systems

The 2026 Verizon DBIR puts vulnerability exploitation at the top of initial-access vectors. So applications ask how quickly you patch and whether anything in your environment no longer receives security updates: Windows Server 2012, old firewalls, abandoned line-of-business software. An unsupported system that can be reached from the internet is one of the fastest routes to a declination, or to an exclusion written specifically around it.

Evidence to have: a patch-management policy with real cadences, and an asset list showing support status.

5. Email security beyond the defaults

Business email compromise and funds-transfer fraud drive 58% of incidents in Coalition's 2026 claims data. That's more than ransomware. Carriers respond by asking what sits in front of your inbox: advanced filtering, anti-phishing and impersonation protection, and increasingly whether SPF, DKIM, and DMARC are configured on your domain.

Evidence to have: your email security configuration summary, plus the control that pairs with it: a written funds-transfer verification procedure requiring phone confirmation of any bank-detail change. It's free, and it prevents the single most common loss type outright.

6. Documented security awareness training

Applications don't ask whether your people are careful. They ask whether training is documented and recurring, and sometimes whether you run phishing simulations. The attendance log is the answer; "we remind people to be careful" is a "no" in underwriting terms.

Evidence to have: your training policy, this year's attendance records, and the materials you use.

7. A written, tested incident response plan

The requirement that fails the most applications, because it's pure documentation and nobody owns it. Carriers ask two things. Is the plan written, with named roles, current phone numbers, isolation steps, and carrier and counsel contacts? And has it been tested? A one-hour tabletop walk-through counts, if you keep dated notes.

Evidence to have: the plan itself and the notes from your last exercise. If you have neither, this is a one-afternoon fix with the right template, and it flips one of the most common "no" answers to an honest "yes."

What ties all seven together: the attestation

Every application ends the same way: a signature affirming your answers are true. That's what turns a sloppy "yes" into a denied claim later. The working rule, ours and the one that protects you, is simple — make every answer honestly "yes," or disclose accurately with compensating controls. Never shade an answer.

If you want to know which of the seven you'd pass today, the free Readiness Check scores you across all of them in about five minutes. Instant, no email required. Working from a real form? Every question an application asks is written out, with the fix for each.