Cyber Insurance Requirements for MSPs and IT Teams (2026)

Updated: November 2026

Cyber insurance requirements are the security controls a carrier expects to see before it binds a policy: MFA on email, remote access and admin accounts, EDR on every endpoint and server, offline or immutable backups with a tested restore, a written incident response plan and a patching window it can read on the application. Whether you answer the questionnaire for client environments as an MSP or for your own company as an IT team, every answer is a representation the carrier relies on when a claim comes in. This checklist covers what published carrier forms ask, what counts as a pass, and the proof to attach before the broker asks for it.

TL;DR

• The short answer. Four controls decide whether a policy binds: MFA, EDR on endpoints and servers, isolated and tested backups, and a rehearsed incident response plan. Patch targets, privileged access, email authentication and phishing results fill the rest of the form.
• Answer with numbers. Ransomware supplements ask for percentages, product names, patch windows and test dates, so attach exports instead of a bare yes or no.
• Email and remote access come first. Coalition puts business email compromise and funds transfer fraud at 58% of its 2025 claims, and At-Bay traced 87% of its 2025 ransomware claims to remote access.
• The signature carries the risk. A control claimed on the application but missing at claim time can void the policy, whoever filled in the technical answers.

Why Underwriting Turned Into a Technical Audit

Carriers spent three years paying for the difference between what applicants wrote down and what they ran, and claim volume is still climbing. The NAIC's 2026 cyber market report counted 56,323 reported claims in 2025, up 20% on 2024, and the industry loss ratio rose to 53% from 48.7%.

The loss mix explains the questions. Coalition's claims report for 2026 found initial ransom demands rose 47% in 2025 to an average of over $1 million, and ransomware was its costliest claim type at an average loss of $269,000, while business email compromise and funds transfer fraud made up 58% of claims. That split is why applications open with MFA on email and why carriers such as AXIS add a separate ransomware supplement. Coalition also notes that a claim closed without an indemnity payment is a different thing from a denial, since a claim can close under the retention or after the carrier's own response team contains the incident.

Pricing has softened while scrutiny has held. Marsh's market index for the third quarter of 2026 shows cyber rates down 4% globally, the thirteenth straight quarterly decline, and flat in the US after a long run of cuts. A lower renewal quote still arrives with the same questions about EDR coverage, patch windows, backup isolation and phishing results.

Whether the policy pays out is its own debate, and it is worth reading before renewal:

MFA Requirements for Cyber Insurance

MFA is the first gate and the one with the most failure modes. Travelers' MFA supplement (form CYB-14306, March 2023 revision) asks whether MFA protects web-based email, all remote network access for employees, contractors and third-party service providers, and internal and remote admin access to directory services, backup environments, network infrastructure, endpoints and servers. The third-party line covers an MSP's own access, so the RMM and remote support tools count as remote access paths. The backup environment is on the list because it's the system ransomware operators go looking for.

Remote access is where ransomware gets in. At-Bay's InsurSec Report for 2026 traced 87% of its 2025 ransomware claims to remote access services, and VPN compromises accounted for 73% of intrusions where the entry point was known.

Method matters too. AXIS's ransomware supplement asks which second factor you use, from SMS and secondary email to authenticator apps and physical security keys, and CISA ranks MFA methods with phishing-resistant FIDO/WebAuthn as the gold standard and SMS or voice codes as the weakest. Travelers' form still counts an SMS code as a second factor, so read each carrier's wording before you assume a method passes or fails.

Two things trip up otherwise clean tenants. Legacy authentication protocols left enabled in Microsoft 365 create a bypass around conditional access, which matters because AXIS asks whether MFA covers all Microsoft 365 users. Service accounts are the other one: AXIS asks how many domain and service accounts sit in the Domain Admin group, and those accounts rarely support interactive MFA or appear on anyone's inventory. Document how each one is protected and list it in the answer.

EDR and XDR: Antivirus Alone No Longer Binds a Policy

Applications ask about endpoint detection and response by name, separately from antivirus. What carriers look for is behavioral detection, host isolation you can trigger remotely, and a central console showing coverage across the estate.

Coverage scope is where applications get rejected. Servers count, hypervisors count, and so does the unmanaged machine in the warehouse. The AXIS ransomware supplement asks what percentage of endpoints and, separately, what percentage of servers run EDR, and CFC's application asks what share of endpoints lack it and why.

Both forms also ask who watches the alerts. AXIS asks whether a security operations center runs 24/7 and whether it's internal, outsourced or hybrid, and CFC asks whether the EDR is monitored in-house or by a third party. That pushes toward MDR or a SOC arrangement rather than an alert queue nobody reads on a Saturday. If you're picking between platforms for client environments, the practical differences between the major EDR agents show up in exactly these underwriting questions, and our SentinelOne vs Sophos comparison breaks down how each handles isolation and reporting.

Cyber Insurance EDR Requirements

The EDR questions on published forms come down to four answers you should be able to prove:

• Deployment. The product name and the share of workstations and servers running the agent, with every gap named and explained.
• Server coverage. Domain controllers, file servers and hypervisors listed by name, since a workstation-only rollout is the gap a deployment report exposes first.
• Response. Who acts on an alert at night and on weekends: your own staff, a managed detection and response provider or a SOC.
• Prevention mode. Whether the agent blocks and isolates on its own or only raises alerts.

For an in-house IT team, those four answers come from one console. For an MSP they come per client, and a tenant whose agent count trails its asset list is the one to fix before the renewal date.

Does XDR Meet Cyber Insurance Requirements?

XDR answers the EDR question when it includes the vendor's own endpoint agent on every device, because the forms ask about endpoint and server deployment. An XDR or SIEM that only ingests logs from other tools doesn't count as EDR coverage on its own. Where XDR helps at underwriting is identity and email, the paths behind the email fraud and remote access claims above, and our EDR vs XDR comparison covers scope, cost per endpoint and where MDR fits.

Backups: Immutable, Offsite, and Restore Tested

Backup questions map onto the 3-2-1-1-0 rule: three copies, two media types, one offsite, one offline or immutable, and zero errors on the last verification. AXIS asks how often critical data is backed up, whether copies sit offline, offsite or in the cloud, whether backups are immutable, encrypted and protected by MFA, and how often a full recovery is tested.

Immutable backups need a defined retention window that outlasts the time an attacker could sit in the network unnoticed. The backup system also needs credential separation from production Active Directory, because a domain admin compromise that reaches the backup console turns a bad week into a total loss. AXIS asks about it directly: are backup credentials unique and stored separately from other user credentials, and are encryption keys kept offline?

The restore test is where a backup answer gets proven or disproven. "We have backups" and "we restored a live system on a named date and it worked" are different answers to the same question. Underwriters want the date, the scope and the recovery time, and AXIS asks whether your recovery time objective for critical systems was validated in the last 12 months. If backup platform selection is still open for a client, the tradeoffs between immutability models and restore speed are covered in our breakdown of MSP backup solutions.

Incident Response Plans Underwriters Accept

A folder called "IR Plan" containing a two-page template does not pass. What holds up is a written plan with a version date inside the last 12 months, named roles with names in them rather than job titles, the carrier's own breach hotline listed in the notification steps, and evidence that somebody ran a tabletop exercise against it.

The carrier hotline detail is worth flagging to clients and to your own leadership. Read the policy for its notification window and for any panel of approved incident response firms, because calling your own forensics firm first can reduce what gets reimbursed later.

Underwriters also read the plan for whether it survives contact with a real outage. If the notification chain depends on email that runs in the tenant currently encrypted, the plan has a hole in it. Out-of-band contact details, a printed copy stored somewhere reachable, and a decision-maker authorized to approve spend at 2am are the three details that separate a plan from a document. None of them cost money to add.

Supporting Controls That Move the Premium

The four gates get you bindable, and the supporting controls fill the rest of the form. Privileged access management and least-privilege enforcement come up first, followed by email authentication with SPF, DKIM and DMARC set to enforcement rather than monitoring. AXIS asks whether a PAM tool is in place and behind MFA, and whether SPF, DKIM and DMARC are deployed.

Patching is scored on speed. AXIS asks for a critical patching target in bands from under 24 hours to more than seven days, plus a target for routine vulnerability patching, and CFC asks how quickly zero-day patches go out after the vendor releases them. End-of-life software gets its own question on both forms, with a request for the remediation plan, segregation and decommission timeline.

Security awareness training rounds it out. AXIS asks how often phishing simulations run, the click rate and reporting rate of the most recent one, and how repeat clickers are handled, so a click rate trending down over four quarters is the number to keep. For a broader view of how these pieces fit together across a client base, our MSP security stack guide maps the layers and what each one costs to run.

Network segmentation and logging sit further down the questionnaire. AXIS asks whether the network is segmented and on what basis, from business function to data classification, and whether administrator access is monitored for unusual behavior. Logs matter again at claim time, because the incident response team rebuilds the attack timeline from them, so set retention to cover the gap between intrusion and detection.

The cost question follows directly from all of it. Insureon reports that its small-business customers pay an average of $129 a month, or $1,552 a year, based on median policy costs, with annual premiums from about $400 to more than $8,000 (read November 4, 2026). Limits, industry and the volume of sensitive data drive the spread, and two companies with the same revenue and tool list can land far apart based on what each one can prove. That range is worth showing clients or your own finance team before renewal, because it puts security spend next to a number on the insurance bill.

The Attestation Gap That Puts MSPs on the Hook

A cyber insurance application is a signed representation. AXIS's form states that the answers are a material inducement to the insurer and that any policy is issued in reliance on them, and Travelers' MFA supplement asks whether the signer completed it with the person in charge of IT security. If a claims investigation finds a control was represented as in place when it wasn't, the carrier can deny the claim or rescind the policy entirely, treating it as though coverage never existed. That applies even when nobody lied.

Misrepresentation doesn't require intent. The client believed MFA was everywhere, answered yes in good faith, and nobody had checked the three legacy service accounts on the file server. In the Travelers v. ICS case, Travelers said the applicant misrepresented its MFA use on the application its president signed, and in August 2022 both sides asked the court to declare the policy void from inception.

The business owner signs the form, but the MSP supplies the technical answers, which can draw the MSP into a downstream errors and omissions claim. For an in-house IT team the same chain runs inside the company: the executive who signs relies on your answers. Three guardrails keep that exposure manageable. Never answer a control question you can't produce an export for. When coverage is partial, write "partial" and define the scope rather than rounding up to yes. And when a client declines a control on cost, put the decline in writing and keep it, because that document is the difference between a shared problem and your problem.

An underwriter explains how applications are scored and where claims go wrong:

What Voids Coverage After the Breach

Denials cluster into a short list, and every item on it is knowable before the policy binds.

• Material misrepresentation on the application, including unintentional errors
• Unpatched or end-of-life software named in a specific exclusion
• War and state-backed attack exclusions, which Lloyd's has required in standalone cyber policies written or renewed since March 31, 2023
• Failure to maintain warranty, where controls existed at binding but lapsed mid-term
• Late notice filed past the policy's reporting window

Failure to maintain warranty deserves attention because it's the one that grows quietly. Controls attested to in March drift by September. An EDR agent stops reporting, an offboarded admin keeps a standing session, immutability gets shortened to save storage cost. Quarterly control verification against the application answers is cheap insurance on the insurance.

The Evidence Pack, Control by Control

Underwriters have moved from checkboxes to artifacts. Building the pack once and refreshing it quarterly turns renewal season from a scramble into an export job.

For an in-house IT team, the pack is what the executive who signs the application should read first. For an MSP, it's a per-client deliverable that can sit inside a security or compliance plan and be priced as one.

Running the Renewal Timeline

Renewal conversations go badly when they start two weeks out. Working backward from the binding date gives you room to fix what the scan finds.

Running your own external scan before submission is the cheapest move on this list. AXIS asks whether RDP is reachable from outside the network, and an exposed RDP port or an expired certificate found by your own scan can be fixed before anyone has to explain it.

Where Your Tooling Fits

The evidence pack is straightforward when the data lives in one place and painful when it's scattered across an RMM, a separate patch tool, a standalone EDR console, a backup portal, and a ticketing system that doesn't talk to any of them. Seven exports from seven vendors, reconciled by hand, per client, every year.

OpenFrame from Flamingo is open, AI-native infrastructure for IT and security that covers large areas of RMM, remote access, patching, PSA, SIEM, MDM and documentation in one system. Device inventory, patch compliance and ticket history share one data model, so the asset count you reconcile EDR coverage against, the patch report and the incident ticket trail come from the same place. Two AI agents work inline: Fae resolves end-user support requests, and Mingo runs IT operations work for technicians.

OpenFrame isn't an EDR, backup, email security or identity product, so those controls stay with the vendors you choose. It costs $1 per device a month with 10M AI tokens included, or $0.80 on annual billing with 25M, and comes with a 14-day free trial.

Whatever platform you run, the underwriting shift points the same direction. Controls you can prove are worth more than controls you have.

Cyber insurance now rewards documented security, and the documentation is what a claims adjuster reads first.

Disclosure: Flamingo, the publisher of this guide, builds OpenFrame.