Cyber Insurance Requirements for MSP Clients in 2026

A client forwards you their cyber insurance renewal questionnaire and asks you to fill in the technical parts. Forty questions later you're attesting to controls across an environment you inherited, and your answers sit in a file a claims adjuster will read line by line after a breach. Cyber insurance requirements moved faster than the renewal cycle did, and the gap between what's on the form and what's deployed on the network is where coverage quietly disappears. Here's the control list carriers bind on in 2026, what counts as passing, and the proof to attach before the broker asks for it.

TL;DR

• The short answer. Carriers bind on four hard gates: MFA on email and remote access, EDR on every endpoint and server, immutable restore-tested backups, and a written incident response plan.
• Evidence beats attestation. Underwriters want exports and console screenshots, not checkbox answers.
• Denials trace to control gaps. Coalition found 82% of denied claims involved organizations without fully deployed MFA.
• Documentation moves price. Well-evidenced controls price 20% to 35% better than undocumented ones.

Why Underwriting Turned Into a Technical Audit

Carriers spent three years paying for the difference between what applicants wrote down and what they ran. The NAIC's 2025 report covering claims closed in 2024 counted more than 38,000 cyber claims, of which fewer than 10,000 paid out. That's roughly one in four.

The loss math explains the tightening. Coalition's claims data puts ransomware at 9.6% of cyber claims but 91% of incurred losses, with the average ransom demand climbing past $1 million, a 47% jump. A small slice of incidents drives nearly all the money going out the door, so underwriters price the controls that stop that slice.

Pricing itself is in an odd spot. Marsh McLennan's Global Insurance Market Index tracked cyber rates falling 6% to 7% per quarter through 2025, and cyber reinsurance rates dropped 32% at the January 2026 renewals, which Gallagher Re described as historic softening. S&P Global Ratings expects that to reverse, projecting rates up 15% to 20% across 2026. Cheap renewals in the first half of the year are not a signal that scrutiny is loosening. Roughly three in four carriers now run external attack surface scans during underwriting, so the questionnaire is cross-checked against what's visible from the internet before anyone reads your answers.

MFA: The Control Most Denied Claims Trace Back To

MFA is the first gate and the one with the most failure modes. Carriers want it enforced on email, on every remote access path (VPN, RDP, and your RMM), on all administrative and privileged accounts, and on the backup console. That last one gets missed constantly, and it's the account ransomware operators go looking for.

Method matters more each year. Phishing-resistant MFA using FIDO2 keys or passkeys is what carriers reward. SMS and voice codes still get accepted at the low end, but several carriers now exclude them for admin accounts.

Two things trip up otherwise clean tenants. Legacy authentication protocols left enabled in Microsoft 365 create a bypass around conditional access, and underwriters ask about them by name now. Service accounts are the other one, because they rarely support interactive MFA and rarely appear on anyone's inventory. Document how each service account is protected instead of pretending it doesn't exist.

EDR and XDR: Antivirus Alone No Longer Binds a Policy

Signature-based antivirus stopped satisfying carriers around 2023. What binds a policy now is endpoint detection and response with behavioral detection, host isolation you can trigger remotely, and a central console showing coverage across the estate.

Coverage scope is where applications get rejected. Servers count. Hypervisors count. That one unmanaged machine in the warehouse counts, and it's usually where the initial foothold lands. Carriers ask what percentage of endpoints carry the agent, and anything under 95% invites follow-up questions.

More carriers now ask whether detections are watched by humans around the clock, which pushes toward MDR or a SOC arrangement rather than an alert queue nobody reads on a Saturday. If you're picking between platforms for client environments, the practical differences between the major EDR agents show up in exactly these underwriting questions, and our SentinelOne vs Sophos comparison breaks down how each handles isolation and reporting.

Backups: Immutable, Offsite, and Restore Tested

The old 3-2-1 rule has been replaced in practical underwriting by 3-2-1-1-0: three copies, two media types, one offsite, one immutable, and zero errors on the last verification. Carriers ask about each digit.

Immutability needs a defined retention window, and 14 to 30 days is the range that stops arguments. The backup system also needs credential separation from production Active Directory, because a domain admin compromise that reaches the backup console turns a bad week into a total loss. Carriers increasingly ask whether the backup platform authenticates against the same directory as everything else.

The restore test is the requirement with the highest failure rate at claim time. "We have backups" and "we restored a live system on a named date and it worked" are different answers to the same question. Underwriters want the date, the scope, and the recovery time. If backup platform selection is still open for a client, the tradeoffs between immutability models and restore speed are covered in our breakdown of MSP backup solutions.

Incident Response Plans Underwriters Accept

A folder called "IR Plan" containing a two-page template does not pass. What carriers accept is a written plan with a version date inside the last 12 months, named roles with names in them rather than job titles, the carrier's own breach hotline listed in the notification steps, and evidence that somebody ran a tabletop exercise against it.

The carrier hotline detail is worth flagging to clients. Policies typically require notification within a defined window, often 72 hours, and using the carrier's approved incident response vendor. Calling your own forensics firm first can reduce what gets reimbursed later.

Underwriters also read the plan for whether it survives contact with a real outage. If the notification chain depends on email that runs in the tenant currently encrypted, the plan has a hole in it. Out-of-band contact details, a printed copy stored somewhere reachable, and a decision-maker authorized to approve spend at 2am are the three details that separate a plan from a document. None of them cost money to add.

Supporting Controls That Move the Premium

The four gates get you bindable. The supporting controls decide what you pay. Privileged access management and least-privilege enforcement come up first, followed by email authentication with SPF, DKIM, and DMARC set to enforcement rather than monitoring.

Patching is scored on speed, not intent. Carriers ask for a documented SLA on internet-facing systems and critical CVEs, and they're comparing your answer against what their external scan already found. End-of-life software gets its own question, because unsupported operating systems now trigger exclusions rather than higher premiums.

Security awareness training rounds it out, and carriers ask for phishing simulation failure rates rather than completion percentages. Completion tells them nothing. A failure rate trending down over four quarters tells them the training works. For a broader view of how these pieces fit together across a client base, our MSP security stack guide maps the layers and what each one costs to run.

Network segmentation and log retention sit further down the questionnaire but carry weight on larger accounts. Carriers want to know whether a compromised workstation reaches the file server and the backup network without crossing a boundary, and whether you can hand an incident response team 90 days of logs when they ask. Flat networks with 30-day retention still bind, they just price worse.

The cost question follows directly from all of it. Cyber insurance for a small business client usually lands between $1,000 and $2,500 a year for a $1 million limit, with the median sitting near $1,500, and the spread is driven by controls and industry more than headcount. Two clients with the same revenue and the same tool list can sit at opposite ends of it based on what each one can prove. That difference is worth showing clients before renewal, because it reframes security spend from a cost line into a number that shows up on their insurance bill.

The Attestation Gap That Puts MSPs on the Hook

Here's the part the vendor blogs skip. A cyber insurance application is a warranty, not a survey. If a claims investigation finds a control was represented as in place when it wasn't, the carrier can deny the claim or rescind the policy entirely, treating it as though coverage never existed. That applies even when nobody lied.

A large share of denials involve honest misrepresentation. The client believed MFA was everywhere, answered yes in good faith, and nobody had checked the three legacy service accounts on the file server. The claim gets denied on a technicality that was never a deliberate choice.

The business owner signs the form, but the MSP supplies the technical answers, which is how MSPs end up named in downstream errors and omissions claims. Three guardrails keep that exposure manageable. Never answer a control question you can't produce an export for. When coverage is partial, write "partial" and define the scope rather than rounding up to yes. And when a client declines a control on cost, put the decline in writing and keep it, because that document is the difference between a shared problem and your problem.

What Voids Coverage After the Breach

Denials cluster into a short list, and every item on it is knowable before the policy binds.

• Material misrepresentation on the application, including unintentional errors
• Unpatched or end-of-life software named in a specific exclusion
• War and state-sponsored actor exclusions, which have widened since 2023
• Failure to maintain warranty, where controls existed at binding but lapsed mid-term
• Late notice filed past the policy's reporting window

Failure to maintain warranty deserves attention because it's the one that grows quietly. Controls attested to in March drift by September. An EDR agent stops reporting, an offboarded admin keeps a standing session, immutability gets shortened to save storage cost. Quarterly control verification against the application answers is cheap insurance on the insurance.

The Evidence Pack, Control by Control

Underwriters have moved from checkboxes to artifacts. Building the pack once and refreshing it quarterly turns renewal season from a scramble into an export job.

An MSP with strong controls and this pack in hand can see 20% to 35% better pricing than a peer of identical size running the same tools without documentation. Same security posture, different premium, and the only variable is whether the proof exists in an exportable form.

Running the Renewal Timeline

Renewal conversations go badly when they start two weeks out. Working backward from the binding date gives you room to fix what the scan finds.

Running your own external scan before submission is the cheapest move on this list. Carriers are looking at the same exposed RDP port and the same expired certificate you'd find, and fixing it beforehand changes the conversation from explanation to confirmation.

Where Your Tooling Fits

The evidence pack is straightforward when the data lives in one place and painful when it's scattered across an RMM, a separate patch tool, a standalone EDR console, a backup portal, and a ticketing system that doesn't talk to any of them. Seven exports from seven vendors, reconciled by hand, per client, every year.

That reconciliation problem is part of why we built OpenFrame as an AI-native all-in-one MSP and IT platform, with RMM, endpoint management, patching, and native PSA in a single system rather than a bundle of acquisitions. Ticket history, patch compliance, and device coverage sit in the same data model, so a client's control evidence is a report rather than a project. It's priced to work for smaller teams, and there's no lock-in clause holding your data hostage if you decide it isn't the right fit.

Whatever platform you run, the underwriting shift points the same direction. Controls you can prove are worth more than controls you have.

Cyber insurance stopped rewarding good security and started rewarding documented security. Those are not the same thing, and only one of them pays a claim.