Cyber insurance used to be easy to buy. You answered a short questionnaire, checked a few boxes, and a policy showed up. That era is over. Renewal and binding questionnaires now read like a technical audit, and the answers you give are treated as warranties you must be able to prove. Get them wrong and two things can happen: the carrier declines to bind the policy, or worse, it pays nothing after a breach because a control you attested to was not actually in place.
If your renewal is approaching and you are not confident you can pass, this is the moment to get ahead of it. Below is what carriers are asking for in 2026, why each control matters to an underwriter, and how these requirements map directly to the work a fractional security leader does.
Why questionnaires got harder
After several years of heavy ransomware losses, insurers tightened underwriting. The questionnaire stopped being a formality and became the primary tool carriers use to price risk and decide whether to offer coverage at all. Two shifts matter most to you.
First, specific technical controls are now effectively prerequisites for coverage rather than nice-to-haves. Second, and this is where companies get burned, your answers are representations the insurer relies on. If a control you claimed is missing when a claim is investigated, the carrier may argue the policy was issued on a false basis and seek to rescind it or deny the claim. Because the operative test is whether the misrepresentation was material, not whether it was intentional, an honest mistake can carry the same consequence as a deliberate one.
The controls carriers expect in 2026
Requirements vary by carrier, industry, coverage limit, and company size, so treat the following as the widely shared baseline rather than a universal rulebook. That said, these controls appear on nearly every major carrier's application today.
Multi-factor authentication, applied everywhere that matters
MFA is the single control most likely to make or break a policy. Carriers commonly expect it on three fronts, and a gap in any one is a problem:
- Email, particularly cloud email such as Microsoft 365 and Google Workspace.
- Remote access, including VPN, remote desktop, and any external connection into your network.
- Administrative and privileged accounts, including domain admins and cloud administrator roles.
The failure pattern is answering "yes" to MFA based on partial deployment. You enabled it on email, but a single administrator account or a legacy VPN was left uncovered, and that gap becomes the attacker's entry point. On the application, "we have MFA" and "we have MFA everywhere the carrier asked about" are very different statements, and the carrier will hold you to the specific one you signed.
Endpoint detection and response (EDR)
Traditional antivirus no longer satisfies most underwriters. Carriers increasingly expect EDR, or a managed detection and response (MDR) service, deployed across endpoints and servers with active monitoring. Underwriters like EDR because it shortens the window between compromise and containment, which is what drives the size of a ransomware loss.
Tested, resilient backups
Backups are your leverage against a ransom demand, so carriers scrutinize them closely. The common expectation is backups that are encrypted, kept offline or immutable so ransomware cannot encrypt them too, and, critically, restore-tested on a schedule. Untested backups are a frequent and painful surprise during an actual incident. Being able to show a recent, successful restore test is worth more to an underwriter than simply owning backup software.
A documented incident response plan
Carriers commonly ask whether you have a written incident response plan, and increasingly whether you have exercised it. A plan that defines roles, escalation paths, and notification steps, and that has been walked through in a tabletop exercise, signals that a breach will be contained rather than improvised. "We would figure it out" is not an answer that binds a policy.
Supporting controls
Beyond the core four, applications routinely probe patch and vulnerability management, email filtering, security awareness training, privileged access controls, and network segmentation. None of these individually sinks an application, but together they shape your premium and your terms.
Evidence is replacing verbal attestation
The most important shift for 2026 is that carriers increasingly want proof rather than a checked box. Expect requests for screenshots, configuration exports, MFA enrollment reports from your identity provider, EDR agent-health reports, and dated tabletop after-action notes. Some carriers also run external scans of your internet-facing footprint and compare what they find against what you claimed.
The practical consequence: you should assume every answer will be tested, either at underwriting or, far more expensively, during a claim. Build the evidence file before you sign, not after a breach.
How a wrong answer denies a claim
The risk here is not theoretical. In a widely cited 2022 dispute, Travelers v. International Control Services, the insurer moved to rescind a cyber policy after a ransomware attack, arguing the insured had represented on its application that it used multi-factor authentication for administrative and privileged access when, according to the filing, MFA in fact protected only the firewall. Access was gained using an administrator's credentials that were not protected by MFA. Because the application had been signed by the company's CEO and the person responsible for its network and information security, the carrier argued it was entitled to treat the policy as void. The matter was resolved in 2022 with the policy rescinded by agreement and declared null and void from its inception.
The lesson is not that MFA caused the loss. It is that a control attested to on the application, but not actually in place, can be grounds for a carrier to void coverage entirely. The gap between what you believe is deployed and what is actually deployed is the exposure.
Higher limits, higher bars: phishing-resistant MFA
Not all MFA is equal, and higher coverage tiers increasingly reflect that. SMS codes, one-time-passcode apps, and push notifications all reduce risk but remain vulnerable to interception, SIM-swapping, and "push fatigue" attacks that bombard a user with prompts until one is approved.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) describes phishing-resistant MFA, specifically FIDO/WebAuthn (including hardware security keys and passkeys) and PKI-based methods such as smart cards, as the gold standard, because these methods cryptographically bind authentication to the legitimate site and cannot be relayed to an attacker. For organizations pursuing larger limits or operating in higher-risk sectors, expect underwriters to ask about phishing-resistant MFA for the most sensitive access, and to reward it with better terms.
These requirements map to what a fractional CISO delivers
Read the list again and a pattern emerges. Every item is something a security leader owns: verifying MFA coverage against the exact scope the carrier asks about, standing up EDR and monitoring, proving backups actually restore, writing and exercising an incident response plan, and assembling the evidence file that turns "yes" into demonstrable fact.
Most companies in the 10-to-1000-employee range do not have that leader in-house, which is exactly why the questionnaire feels impossible. A fractional CISO closes the gap without a full-time hire: mapping your current controls against carrier requirements, remediating the gaps that would deny a claim, and packaging the evidence so an underwriter, and later an adjuster, has nothing to dispute.
Our four-week Technology & Security Readiness Assessment is built for precisely this moment. It combines stakeholder interviews, an environment review, a security baseline, and a vendor audit into a single executive briefing with prioritized findings and an action plan, so you walk into your renewal knowing which answers you can defend and which gaps to close first. No ongoing commitment is required. If your focus is the insurance questionnaire specifically, our Virtual CISO and Security Advisory engagement takes it the rest of the way.
Common questions
Is MFA legally required to get cyber insurance?
No. There is no law requiring MFA for cyber coverage. It is an industry underwriting standard: most major carriers now treat MFA on email, remote access, and administrative accounts as an effective prerequisite to bind or renew a policy. The requirement comes from the carrier's application, not from regulation, so the specific scope varies by insurer.
Can my claim really be denied for a control I thought was in place?
Yes. Your questionnaire answers are representations the carrier relies on to issue the policy. If a control you attested to, especially MFA, is missing when a claim is investigated, the insurer may deny the claim or seek to rescind the policy on the basis of material misrepresentation. Because the test is materiality rather than intent, an honest mistake can carry the same consequence. The 2022 Travelers v. International Control Services dispute, resolved with the policy rescinded, is the widely cited example.
What is phishing-resistant MFA, and do I need it?
Phishing-resistant MFA cryptographically ties your login to the legitimate site so credentials cannot be relayed to an attacker. CISA identifies FIDO/WebAuthn methods (hardware keys and passkeys) and PKI-based methods (smart cards) as the gold standard, and considers SMS, one-time-passcode apps, and push notifications weaker. It is not universally required, but higher coverage tiers and higher-risk industries increasingly ask for it on sensitive access.
What evidence will an insurer want to see?
Carriers increasingly want proof rather than a checked box: MFA enrollment reports from your identity provider, EDR or MDR agent-health reports, screenshots or configuration exports, backup restore-test results, and dated incident-response tabletop notes. Some also run external scans of your internet-facing systems and compare the results to your answers. Assemble this evidence before you sign, not after a breach.
We can't pass our renewal questionnaire. What's the fastest path?
Start with a scoped assessment that maps your current controls against what your carrier is asking for, identifies the gaps most likely to deny a claim, and prioritizes remediation. Our four-week Technology and Security Readiness Assessment does exactly that and produces an executive briefing with an action plan, with no ongoing commitment. Security-focused work continues through our Virtual CISO and Security Advisory engagement.