Cyber Insurance Requirements for Businesses

Cyber insurance is entering a new phase. Insurers are now expecting stronger security controls, clearer documentation, and greater operational maturity from organizations of every size. For businesses, the renewal process may increasingly resemble a cybersecurity audit. Premiums, coverage limits, exclusions, and even eligibility will depend heavily on the strength of your security program and your ability to prove that required controls are in place.

Here is what businesses need to know about cyber insurance costs, underwriting requirements, evolving coverage, and how to prepare for renewal.

Coverage Is Expanding and Becoming More Restrictive

Cyber insurance once focused primarily on data breaches and recovery costs. Policies may now address a wider range of risks, including ransomware, business email compromise, supply-chain incidents, regulatory penalties, digital asset restoration, and reputational damage.

At the same time, insurers are tightening the conditions under which these losses are covered.

Ransomware coverage, for example, may depend on whether an organization has multi-factor authentication, endpoint detection and response, immutable backups, and a tested incident-response plan. Policies may also include lower limits, higher deductibles, co-insurance requirements, or exclusions when required controls are missing.

Insurers are particularly concerned about:

• AI-enabled cyberattacks
• More sophisticated ransomware
• Business email compromise
• Supply-chain attacks
• Cloud concentration risk
• Weak incident-response and recovery capabilities

Cybersecurity is no longer simply a factor in pricing. It increasingly determines whether coverage is available at all. Businesses that can demonstrate strong security controls, documented processes, and effective risk management are better positioned to control insurance costs and secure broader coverage.

Foundational Security Controls

Many of the controls insurers are prioritizing are not new. What is changing is the level of enforcement. Carriers are increasingly declining, delaying, or limiting applications when businesses cannot demonstrate that foundational cybersecurity controls are operating effectively.

Multi-Factor Authentication

Multi-factor authentication, or MFA, is now a baseline requirement for critical access points, including:

• Email accounts
• Remote and VPN access
• Administrator and privileged accounts

MFA must be consistently enforced. Because stolen credentials remain a leading cause of cyber incidents, missing MFA can result in higher premiums, reduced coverage, or a declined application.

Managed Endpoint Detection and Response

Traditional antivirus software is no longer considered sufficient. Insurers increasingly expect endpoint detection and response, or EDR, across servers and workstations. EDR can identify suspicious activity and isolate compromised devices before an attack spreads.

Technology alone, however, is not enough. Managed detection and response, supported by continuous Security Operations Centre monitoring, provides the human oversight needed to investigate alerts and respond to threats around the clock.

This combination of technology, monitoring, and active response is becoming increasingly important to both insurers and businesses.

A Tested Incident-Response Plan

A written incident-response plan has become another standard insurance requirement.

The plan should identify who is responsible for making decisions, containing threats, communicating with stakeholders, preserving evidence, and restoring operations. Many insurers also expect businesses to conduct at least one tabletop exercise each year.

Underwriters may ask whether the organization has established relationships with external partners such as legal counsel, digital forensics specialists, insurance contacts, and public relations professionals.

A plan that has been tested provides significantly more value than one that has only been documented.

Cyber Hygiene and Network Hardening

Insurers are examining foundational security practices more closely, including:

• Strong password requirements
• Timely security patching
• Formal vulnerability management
• Network segmentation
• Restricted administrative access
• Separation of backup environments
• Protection of operational technology
• Removal of unsupported hardware and software

These controls are now considered minimum expectations rather than competitive differentiators. Meeting only the minimum requirements may help a business qualify for insurance, but organizations that exceed them may receive better pricing, broader limits, and fewer exclusions.

NIST Cybersecurity Framework 2.0 and Insurance Readiness

The NIST Cybersecurity Framework 2.0 places increased emphasis on governance, accountability, risk ownership, and executive oversight.

As a result, more insurers and brokers are structuring their assessments around the framework. Businesses may encounter services described as cyber insurance readiness assessments or cyber insurance gap analyses that evaluate controls against NIST principles.

Businesses that can map their cybersecurity programs to NIST CSF 2.0 may experience a smoother application process and be better positioned to obtain competitive terms.

New Underwriting Focus Areas

Underwriters are also paying closer attention to emerging risks that may not have appeared on older insurance applications.

Artificial Intelligence Risk

As businesses adopt generative AI and automated tools, insurers are becoming more concerned about organizations using them without formal oversight.

Potential risks include:

• Confidential data being entered into public AI platforms
• Intellectual property exposure
• Inaccurate or biased outputs
• Automated decisions without proper review
• Unapproved AI applications
• Weak access controls
• Limited visibility into employee AI use

Insurers may increasingly restrict coverage for losses involving AI systems that lack documented governance, risk assessments, monitoring, and accountability.

Businesses should establish an acceptable-use policy, approved tools, data-handling rules, employee training, and clear ownership of AI-related risks.

Cybersecurity Leadership

Cybersecurity is no longer viewed solely as an IT responsibility. Insurers increasingly expect executive teams to receive regular cybersecurity reporting, review major risks, approve policies, and understand the organization’s incident-response responsibilities.

Businesses should be able to demonstrate:

• Clear ownership of cybersecurity risk
• Regular executive-level reporting
• Documented policies
• Formal risk assessments
• Leadership involvement in incident planning
• Defined decision-making authority

Strong governance shows insurers that cybersecurity is being managed as a business priority.

Post-Incident Improvements

Cyber insurance generally focuses on restoring an organization to its pre-incident condition. The cost of upgrading, modernizing, or strengthening systems after an attack may be classified as “betterment” and excluded from reimbursement. For example, an insurer may cover the cost of restoring a compromised server but not the additional cost of replacing it with a newer, more secure platform.

This makes proactive investment essential. Businesses should not rely on insurance to fund security improvements after an incident.

Cyber Insurance Is Becoming More Proactive

Many insurers now include pre-breach services designed to reduce the frequency and severity of claims.

These services may include:

• Security awareness training
• Phishing simulations
• Incident-response planning
• Vulnerability assessments
• Access to preferred forensic providers
• Cybersecurity guidance and educational resources

These benefits can provide meaningful value and complement the organization’s broader cybersecurity program.

How ACS Helps Businesses Stay Insurable

The cyber insurance process can feel overwhelming, particularly when applications require detailed technical information and supporting documentation. ACS helps organizations strengthen their cybersecurity posture and prepare for increasingly rigorous underwriting requirements. Our services support common insurance requirements in the following areas:

• Managed IT and identity security
  • MFA implementation
  • Administrator account separation
  • Access management
  • Technology lifecycle planning
• Managed Security and SOC services
  • Endpoint detection and response
  • Centralized logging
  • Continuous monitoring
  • Alert investigation
  • Threat response
• Backup and Disaster Recovery
  • Encrypted and immutable backups
  • Restore testing
  • Recovery planning
  • Documented recovery objectives
• Cybersecurity Strategy and Governance
  • NIST CSF 2.0 alignment
  • Security policies
  • Risk assessments
  • Incident-response planning
  • Executive reporting
• Security Awareness Training
  • Ongoing employee education
  • Phishing simulations

ACS can also help organizations document their controls, identify gaps before renewal, and create a practical roadmap for improving long-term cyber resilience.

Cyber Insurance Readiness

Your organization should be able to confidently answer “yes and here is the proof” to the following questions:

• Is MFA enforced?
• Is managed endpoint detection and response deployed across servers and workstations?
• Are backups encrypted, offline or immutable, and regularly tested?
• Does the business have a documented incident-response plan?
• Has an incident-response exercise been completed within the past year?
• Are vulnerabilities identified, prioritized, and remediated through a formal process?
• Do employees receive regular cybersecurity and phishing training?
• Are security responsibilities clearly assigned?
• Is cybersecurity regularly reviewed by executive leadership?
• Can the organization map its security program to a recognized framework such as NIST CSF 2.0?

Cyber insurance can help transfer part of an organization’s financial risk, but it cannot replace effective cybersecurity. Business must demonstrate strong controls, operational resilience, executive accountability, and clear evidence that their security program works. ACS can help your organization evaluate its current readiness, address gaps, and navigate the cyber insurance process with confidence.