What MFA do cyber insurance carriers actually require?

Ask an underwriter what disqualifies a small business fastest and you'll hear the same answer: no MFA. It's the first control on the application because stolen credentials are the front door for most attacks, and because it's so cheap to fix that not having it reads as a signal about everything else.

But "do you have MFA?" is not actually the question carriers ask. They ask something more specific, in three parts.

Where exactly is MFA required?

1. All business email accounts. Not most. All. Email is where password resets land, where wire instructions get sent, and where an attacker with one phished password can quietly read everything. Applications ask whether MFA is enforced for all users, and an opt-in rollout with stragglers is a "no."

2. All remote access. VPN, remote desktop (RDP), and remote-support tools like the ones your IT provider uses. Internet-reachable remote access without MFA is the classic ransomware entry point, and several carriers treat it as close to uninsurable.

3. All administrator accounts. Domain admins, Microsoft 365 / Google Workspace admins, firewall and backup consoles. A phished admin password turns a bad day into a total one, so privileged accounts get their own line on most applications.

What does "enforced" mean in practice?

Enforced means the system requires the second factor: the user can't skip it, and new accounts get it automatically:

• Microsoft 365: Security Defaults (free tier) or Conditional Access policies requiring MFA for all users, with no permanent exclusions.
• Google Workspace: 2-Step Verification set to enforced for every organizational unit, with a bounded enrollment window.

Exceptions are where applications go to die. If a legacy system genuinely can't do MFA, isolate it, document the compensating controls, and disclose it. That's a defensible answer. A silent exception is a misrepresentation you attested to.

The setup, honestly described

For a business already on Microsoft 365 or Google Workspace, enforced MFA is free and takes an afternoon, most of which is communication: tell everyone the date, send the 3-step enrollment instructions, run enforcement, then chase the last two people (there are always two). The written MFA policy that goes with it (required by the same applications) is a two-page document if you start from a decent template.

That afternoon removes the single most common declination trigger in small-business cyber underwriting. There is no better return on effort anywhere in this process.

What counts as MFA, and what carriers ask next

Not all second factors are equal, and the forms are starting to say so.

A code by text message or voice call counts as MFA on most applications today, and it is far better than nothing. It is also the weakest common form, because a code can be read from a lock screen, intercepted, or talked out of someone by a convincing caller. CISA's guidance has pushed away from SMS for years. Use it as a floor, not a destination.

A code emailed to the mailbox you are protecting is not MFA. If the attacker is in the mailbox, they receive the code. Applications that ask where MFA is enforced are asking partly to catch this.

An authenticator app with number matching is the practical middle, free on both Microsoft 365 and Google Workspace, and what most small businesses should land on. The user approves a push and types a number shown on screen, which defeats the fatigue attack where someone spams approval prompts at 2 AM until one gets tapped.

Hardware security keys and passkeys are phishing-resistant: they cannot be replayed against a fake login page, because the credential is bound to the real site. A growing number of supplementals now ask about phishing-resistant MFA for administrator accounts specifically. If you have keys on your admin accounts, say so on the form. It is the one answer in this section that can improve your terms rather than merely clearing the bar.

Answering the application question accurately

The honest-and-favorable framing, in order of preference:

1. "Yes, enforced for all users" because you actually did the rollout above.
2. "Yes, with documented exceptions" where the legacy system is named, isolated, and has compensating controls in writing.
3. Never "yes" as an aspiration. The attestation you sign makes your MFA answer a warranty; a claim investigation will pull the authentication logs.

Want to see how your MFA posture (and the other nine domains carriers probe) scores today? The free Readiness Check takes five minutes and shows you exactly where you stand, and every question an application asks is written out with the fix for each.