A cyber insurance renewal denial usually doesn’t mean your company is “bad at security.”
It usually means you couldn’t prove (quickly and clearly) that you meet the controls carriers now expect—especially around:
- MFA requirements for insurance (not just “some MFA,” but the right MFA in the right places)
- Endpoint Detection & Response (EDR) coverage on endpoints
- A written incident response plan (and ideally evidence it’s been tested)
Those aren’t guesses. They show up directly in real underwriting materials and public guidance. For example, Beazley’s cyber insurance application asks whether you require MFA for remote access and web-based email, what endpoint security solutions you use (including EDR/MDR), and whether you have an incident response plan for intrusions/malware. Beazley
The hook
“Get audit-ready in 30 days so your premium doesn’t double.”
That line captures the reality of renewal season: when you’re missing a few controls or can’t produce evidence, renewal can turn into a price shock or a declination. Pricing and approvals vary by carrier and risk profile, so no one can promise your premium outcome—but a focused 30‑day sprint is often enough to close the most common gaps and make your submission underwriter-friendly. Underwriting rigor has increased, and insurers have explicitly cited missing controls like MFA and EDR as reasons to refuse coverage.
This guide walks you through a 2026-ready checklist and a practical 30‑day plan to help you get approved (or re-approved) without turning it into a year-long security overhaul.
Note: This is educational guidance, not legal or insurance advice. Work with your broker/carrier for binding requirements.
Why renewals get denied in 2026
Carriers have tightened expectations as ransomware and cyber losses drove a harder underwriting posture—and they’re asking more direct “Yes/No + proof” questions.
Aon has noted insurers may refuse coverage when basics are missing—specifically calling out lack of multi-factor authentication, endpoint detection and response, and backups as refusal criteria.
And state-level resources aimed at helping organizations understand underwriting show the same themes repeatedly: MFA for email/admin/cloud, EDR on endpoints, patching timelines, backups (including MFA on backup environments), and written response planning. State of Indiana
The 2026 Cyber Liability Insurance Requirements Checklist
Think of this as two checklists in one:
- Controls checklist (what underwriters commonly look for)
- Evidence checklist (what you’ll need to show)
1) MFA requirements for insurance (the version underwriters mean)
What underwriters ask (examples):
- “Do you require MFA for remote access (including VPN)?”
- “Do you require MFA for web-based email?”
- “Do you require MFA for administrative/privileged access?” (common underwriting question set)
- “Do you require MFA for cloud provider services (Microsoft 365, AWS, Azure, Google Cloud)?”
What “good” looks like in 2026 (practical baseline):
- MFA enforced for email, VPN/remote access, SSO, all admin portals, and privileged accounts
- Conditional access where possible (block legacy authentication; require MFA from new devices/locations)
- Stronger MFA options for high-risk accounts (phishing-resistant where feasible)
Important nuance (because underwriters are learning this too):
CISA urges organizations toward phishing-resistant MFA, and if you can’t do that immediately, CISA recommends mitigations like number matching to reduce MFA fatigue/push-bombing risk.
Evidence to prepare (what to hand your broker/underwriter):
- Screenshot/export showing MFA is enforced for email and remote access (not “optional”)
- List of apps covered by SSO/MFA (or a short “exceptions + compensating controls” note)
- For admins: proof of phishing-resistant MFA policy or step-up requirements (if applicable)
2) EDR requirement (and what “having EDR” actually means)
Many underwriting question sets now explicitly ask whether you use EDR—often phrased as “EDR on all endpoints.”
What underwriters ask (examples):
- “Do you use advanced endpoint detection and response (EDR) tool on all endpoints?”
- “What security solutions do you use (EPP/EDR/MDR)?”
What “good” looks like in 2026:
- EDR deployed on all supported endpoints (laptops/desktops; servers where applicable)
- Central management (you can prove coverage in a report)
- A response workflow: isolate device, kill process, remediate, reimage if needed
- If you’re small: either internal monitoring discipline or a managed detection layer (MDR) for after-hours visibility
Evidence to prepare:
- EDR coverage report (device count + compliance %)
- Screenshot of policies enabled (tamper protection, behavioral protections)
- A one-page “EDR response runbook” (who gets alerted, who isolates, who approves actions)
3) Patch and vulnerability hygiene (the boring requirement that gets you denied)
Underwriting resources commonly call out patch timelines (e.g., “critical patches within 30 days”).
Carrier applications also ask about managing and installing critical patches across internet-facing systems.
What “good” looks like in 2026:
- A defined patch SLA (example: critical within 7–14 days, high within 30)
- Clear ownership (IT or MSP) and reporting
- No internet-facing systems running unpatched for long periods
Evidence to prepare:
- Patch compliance dashboard screenshot
- A short written patch policy (even 1 page)
- List of internet-facing assets + update cadence
4) Backups built for ransomware (plus the detail people miss)
Underwriting checklists frequently include backup questions—both frequency and restore testing.
And Aon has explicitly cited backups (or lack thereof) alongside MFA and EDR as a refusal criterion in a hard market context.
What underwriters ask (examples):
- “Do you regularly back up business critical data?”
- “Do you test backups for restorability?”
- “Do you require MFA for access to backup environment?”
What “good” looks like in 2026:
- Backups are not just sync (avoid describing OneDrive/Google Drive as “backup”)
- Backups are protected with MFA and separate credentials
- Regular restore tests (at least quarterly for key systems; at minimum annually)
Evidence to prepare:
- Backup job success reports
- Restore test record (date, system, RTO/RPO notes, result)
- MFA/role access screenshot for backup console
5) A written Incident Response Plan (IRP) that’s not shelfware
Underwriters ask directly whether you have an incident response plan for intrusions/malware.
General underwriting guidance also lists “written incident response plan” as a typical application question.
And from a security standards standpoint, NIST’s incident response guidance (SP 800‑61 Rev. 3) is designed to help organizations incorporate incident response recommendations into risk management and improve detection/response/recovery outcomes. NIST Computer Security Resource Center
What “good” looks like in 2026:
- A written IR plan that includes:
- roles + call tree (including broker + carrier hotline if applicable)
- incident severity levels and decision authority
- containment steps for account takeover and ransomware
- communications plan (internal + external)
- evidence preservation guidance and vendor engagement
- A tabletop exercise record (even a simple 60-minute session)
Evidence to prepare:
- The IR plan PDF (date/version + owner)
- Tabletop summary (date, attendees, scenario, action items)
- A “first 60 minutes” checklist (one page)
Why carriers care (not just “because compliance”):
Marsh McLennan research has found incident response planning ranks among effective controls associated with lower breach-based claim probability, alongside items like EDR and logging/monitoring and awareness training.
6) Logging, monitoring, and “who watches after hours?”
Underwriting toolkits commonly include questions about continuous monitoring, log retention/review, and whether a SIEM is monitored 24/7 by a SOC.
What “good” looks like in 2026:
- Centralized logging for:
- identity (SSO/email)
- endpoints (EDR)
- remote access
- Alerts go to a real person/team, with an after-hours plan
Evidence to prepare:
- A list of log sources + retention duration
- Screenshot of alert rules + routing
- A short escalation policy (who gets called, when)
7) Security awareness and phishing testing (yes, it matters in underwriting)
Underwriting resources include questions about security training and phishing simulations.
And Marsh McLennan has highlighted security awareness training and phishing testing among controls associated with reduced claim likelihood.
Evidence to prepare:
- Training completion report
- Phishing simulation summary (high-level metrics are fine)
- Policy acknowledgment evidence (if you collect it)
8) Privileged access management (PAM) and admin hygiene
Marsh McLennan has noted that insurers frequently recommended controls like EDR, MFA, and privileged access management (PAM) in prior research.
Underwriting question sets also routinely ask about MFA for privileged access.
What “good” looks like in 2026:
- Separate admin accounts
- No shared admin credentials
- MFA required for all admin actions
- Least privilege + just-in-time elevation where possible
Evidence to prepare:
- Admin account inventory
- MFA enforcement proof for admin roles
- Privilege elevation policy (short is fine)
9) Vendor access + funds transfer controls (often overlooked, often asked)
Carrier applications may include questions around vendor change verification and anti-fraud training.
Underwriting toolkits also include vendor management and verification practices.
What “good” looks like in 2026:
- Vendors have named accounts + MFA (no shared logins)
- Any bank detail change requires out-of-band verification
- Access is removed when vendors disengage
Evidence to prepare:
- Vendor access list + quarterly review note
- Written process for wire changes
- Proof of finance team training
The “Underwriter-Ready Evidence Pack” (what to compile)
If your renewal was denied, the fastest path back is usually documentation + screenshots + short policies. Here’s a clean, broker-friendly binder format:
- Identity & MFA
- MFA enforcement screenshots (email, VPN/remote access, admin, cloud)
- Exceptions list + compensating controls
- Endpoint Security
- EDR coverage report (all endpoints)
- Patching
- Patch compliance dashboard + written SLA
- Backups
- Backup job report + restore test evidence + MFA on backup environment
- Incident Response
- IR plan + tabletop exercise summary
- Training
- Completion report + phishing simulation summary
The 30‑Day “Audit-Ready” Plan (realistic, high impact)
This is built around the controls most commonly tied to underwriting outcomes: MFA, EDR, backups, IR planning, patching, and monitoring.
Days 1–3: Triage like an underwriter
- Get the declination reason(s) in writing from your broker/carrier
- Inventory:
- email systems
- remote access paths (VPN/RDP/remote tools)
- endpoints (managed vs unmanaged)
- Start an evidence folder (you’re building a submission, not just “fixing security”)
Week 1: Lock identity first (MFA everywhere)
- Enforce MFA for email + remote access + admin accounts
- Remove legacy authentication where possible
- Add stronger MFA for high-risk accounts (phishing-resistant where feasible; or number matching as interim mitigation)
Week 2: EDR coverage + patch posture
- Deploy EDR to all endpoints and generate the coverage report
- Establish patch SLAs and prove compliance (especially for internet-facing systems)
Week 3: Backups that survive ransomware
- Confirm backups are not “sync only”
- Enforce MFA for backup environment access
- Run at least one restore test and document it
Week 4: Incident response + monitoring proof
- Draft/update IR plan and run a tabletop exercise
- Document alert routing / monitoring ownership (who responds, including after hours)
- Package everything into the evidence binder and send to broker
If your renewal was denied: what to do next (practical steps)
- Don’t guess. Ask for the exact blockers.
Carriers often have a short list: “No MFA for email,” “No EDR,” “No IR plan,” “Unsupported systems,” “Backup posture unclear.” Many underwriting frameworks surface those directly. - Respond with proof, not promises.
Underwriters are reading lots of “we plan to…” statements. Replace that with screenshots, reports, and dated policies. - Be precise with MFA language.
If the questionnaire asks “MFA for all systems and applications,” clarify scope: email + remote access + privileged access + cloud services + backups (and list exceptions). Underwriting question sets often ask MFA in these specific areas. - Re-market only after you’ve fixed the top blockers.
Aon has described missing MFA, EDR, and backups as refusal criteria in a tightened market—so fix those before burning cycles on repeated submissions.
FAQ (written for real humans)
Do cyber insurers really require MFA “on everything” in 2026?
Different carriers define it differently, but underwriting resources and carrier applications commonly call out MFA for remote access, web-based email, privileged/admin access, and cloud services as explicit questions.
If you can’t cover literally every app, document exceptions and compensating controls.
Is EDR required for cyber insurance approval?
Many underwriting toolkits include EDR as an explicit question (“EDR on all endpoints”), and carrier applications commonly ask what endpoint security you use and include EDR/MDR as listed options.
Separately, insurers and brokers have cited missing EDR as a refusal factor in some market conditions.
What kind of incident response plan do insurers want?
A plan that is written, owned, and usable—often specifically for intrusions and malware/ransomware. Some carrier applications ask this directly.
Using NIST incident response guidance as a backbone is a solid approach for structure and completeness.
Will doing this guarantee approval or prevent a premium increase?
No—underwriting is risk-based and varies by industry, claims history, and exposure. But this checklist targets the controls most commonly asked about in underwriting materials and public underwriting resources, and it improves your ability to submit a clean, defensible renewal package.
Closing thought: treat renewal like an audit
Cyber insurance is risk transfer—not a substitute for security. But renewals are increasingly decided by whether you can show mature basics quickly: MFA, EDR, backups, patching, monitoring, and a tested incident response plan.
If you run the 30‑day plan above and compile the evidence pack, you’ll be speaking the language underwriters actually use—and that’s often the difference between “denied” and “approved.”