A few years ago, buying cyber insurance meant filling in a short form. After a wave of ransomware claims, insurers changed course. Today the application is a security assessment, and the answers decide whether you get coverage, at what price and with what exclusions. Requirements vary by insurer and by the size of your business, but the core list is now fairly consistent across the Canadian market.
What Controls Do Cyber Insurers Usually Require?
| Control | What insurers typically ask |
|---|---|
| Multi-factor authentication | Enforced on email, remote access (VPN, RDP), cloud apps and all privileged accounts |
| EDR | Deployed on all endpoints and servers, not just traditional antivirus |
| 24/7 monitoring | Whether alerts are watched around the clock, by staff or an MDR/SOC provider |
| Backups | Regular, encrypted, with an offline or immutable copy, tested recently |
| Patching | Critical patches applied within a defined window; no unsupported operating systems |
| Email security | Filtering, attachment and link scanning, and often DMARC |
| Privileged access | Separate admin accounts, limited domain admins |
| Training | Regular security awareness training and phishing simulations |
| Incident response plan | Written, with contacts, ideally tested in a tabletop exercise |
| Payment verification | Call-back procedures for funds transfer requests |
Why Are Insurers So Focused on MFA and EDR?
Because claims data told them to. Stolen credentials on remote access and email are among the most common causes of ransomware and business email compromise claims, and MFA blocks a large share of those. EDR is what catches an attacker who gets in anyway. Insurers increasingly ask for MFA and EDR as conditions of coverage, not as bonus points.
Do Insurers Require 24/7 Monitoring?
Not always, but more questionnaires now ask who responds to alerts after hours. An EDR tool with no one watching it overnight is weaker evidence than a managed detection and response service with analysts on shift. For mid-sized firms or those in higher-risk sectors (healthcare, legal, financial services, manufacturing), expect this question.
What Happens If You Cannot Meet the Requirements?
Possible outcomes, depending on the insurer:
- Higher premium or higher deductible (retention).
- Lower limits, or sublimits for ransomware or social engineering.
- Specific exclusions, such as no coverage for incidents caused by an unpatched system.
- A declined application until controls are in place.
The worst outcome is not a decline. It is answering "yes" to a control you do not fully have, then having a claim questioned later. See Why are cyber insurance claims denied?.
How Do You Get Ready for a Renewal?
Start 90 days before renewal:
- Get the questionnaire from your broker early.
- Check every answer against reality, not policy documents. "MFA on all remote access" means all, including that old vendor VPN account.
- Fix the quick gaps: MFA exceptions, EDR coverage on servers, backup isolation.
- Gather evidence: screenshots, reports, training records.
- Note controls in progress honestly, with target dates.
Our cyber insurance readiness page explains how we help Canadian businesses prepare, and How to answer a cyber insurance questionnaire covers the trickiest questions. Insurers and brokers are the final word on what a specific policy requires.