A few years ago, buying cyber insurance as a small business meant filling out a short form and paying a modest premium. That era is over. After a long run of ransomware claims, insurers have tightened their underwriting, and the application now reads like a security audit. Answer “no” to the wrong question and you may face a higher premium, a lower limit, an exclusion for ransomware, or a flat refusal.
There is a second, quieter risk. If you answer “yes” to a control you don’t actually have, and you later file a claim, the insurer may argue that the application was inaccurate. Businesses have had claims disputed for exactly this reason.
So the application is worth taking seriously, not just as paperwork but as a free checklist written by people who pay for breaches for a living. Here are the seven controls that come up on almost every small business application, what underwriters are really asking, and how to close the gap if you’re not there yet.
1. Multi-factor authentication (MFA) everywhere that matters
This is the first question on most applications, and often a hard requirement. Underwriters usually ask about MFA in three places: email, remote access (VPN, remote desktop, remote support tools) and administrator accounts.
The reason is simple. Stolen passwords are behind a large share of business email compromise and ransomware incidents, and MFA blocks most of those attacks outright.
What “yes” should mean: every user has MFA on email, including the owner and the office manager who “doesn’t need it.” Remote access is impossible without a second factor. Admin accounts for Microsoft 365, Google Workspace, your firewall and your backup console all require it. Where you can, use an authenticator app or a hardware key rather than text-message codes.
2. Backups that survive ransomware
Insurers no longer accept “we back up to a drive in the server closet.” Modern ransomware looks for backups and encrypts or deletes them first. Expect questions like: Are backups kept offline or immutable? Are they separated from your main network credentials? How often do you test a restore?
What “yes” should mean: you follow some version of the 3-2-1 rule (three copies, two types of storage, one off-site), at least one copy can’t be changed or deleted for a set period, and the backup system uses separate credentials with MFA. Most importantly, someone has actually restored files, and ideally a whole server, in the last few months and written down how long it took. A backup you have never restored is a hope, not a control.
3. Endpoint detection and response (EDR)
Traditional antivirus compares files against a list of known threats. EDR watches behavior: a process suddenly encrypting hundreds of files, a user account running unusual commands at 3 a.m. Many insurers now ask specifically for EDR, and some ask whether it is monitored around the clock.
What “yes” should mean: an EDR product is installed on every laptop, desktop and server, not just most of them, and alerts go to a person or team who will act on them, including nights and weekends. For a small business without its own security staff, that usually means working with a provider of managed security services in New York, or a similar team where you are, rather than relying on an alert inbox no one reads.
4. Patching on a schedule
Attackers routinely exploit vulnerabilities within days of a patch being released. Applications often ask how quickly you apply critical updates and whether you have any unsupported systems, such as old versions of Windows or a firewall that no longer receives updates.
What “yes” should mean: operating systems and common applications update automatically or through a managed tool, critical patches go out within a defined window (14 days is a common benchmark, faster for actively exploited flaws), and you have a list of devices that can’t be updated along with a plan to replace or isolate them.
5. Email security
Email remains the most common way in. Underwriters ask whether you filter incoming mail for malicious links and attachments, and increasingly whether your domain is protected against spoofing.
What “yes” should mean: an email filtering service sits in front of your mailboxes, external emails are clearly tagged, and your domain has SPF, DKIM and DMARC records configured, with DMARC moving toward an enforcing policy. That last step makes it much harder for criminals to send invoices that look like they came from you.
6. Limited administrator rights
When every employee is a local administrator on their own computer, one click on a malicious attachment can give an attacker control of the machine and a path to the rest of the network. Insurers ask whether everyday users have admin rights and how privileged accounts are managed.
What “yes” should mean: staff use standard accounts for daily work. IT tasks use separate admin accounts with MFA, and the number of people with domain or global admin access is small enough to name from memory. Shared admin passwords are stored in a password manager, not a spreadsheet.
7. Security awareness training and phishing tests
Technology doesn’t stop an employee from approving a fake wire transfer. Most applications ask whether staff receive regular training and whether you run simulated phishing tests.
What “yes” should mean: new hires get training in their first weeks, everyone gets short refreshers through the year, and you run occasional phishing simulations and follow up with people who click. Just as important, you have a simple rule for payments: any change to bank details is confirmed by phone using a number you already have, never one from the email.
A quick self-check before you fill out the application
| Control | Ask yourself | Common gap |
| MFA | Is it on email, remote access and every admin account? | The owner’s account or an old VPN |
| Backups | When did we last test a full restore? | Backups on the same network, never tested |
| EDR | Who responds to an alert at 2 a.m. on a Saturday? | Installed, but nobody is watching |
| Patching | Do we have any devices that can’t be updated? | Old servers and firewalls |
| Email security | Is DMARC set up for our domain? | Records missing or set to “none” forever |
| Admin rights | Do regular users have local admin? | Everyone is an admin “to save time” |
| Training | When was our last phishing test? | Training once, years ago |
Make the application work for you
Treat the renewal questionnaire as an annual security review. Fill it out with whoever manages your IT in the room, answer honestly, and keep notes on what each “yes” actually refers to. If you find gaps, it is often better to close them before applying than to accept a policy with exclusions you’ll only discover after an incident.
Most of these controls are not expensive. MFA, DMARC and tighter admin rights cost little more than time. Monitored EDR and well-designed managed backup services cost more, but they are also what decides whether a ransomware attack becomes a bad week or a business-ending event. Insurers have done the math. Small businesses should too.
About the author: Nathan Spitalny is the CEO of RDE Technologies, a managed IT and cybersecurity provider in Oceanside, New York, that has helped businesses run and protect their technology since 2009.
