Cyber insurance requirements have moved from checkboxes to evidence, and the space between the two is where coverage quietly fails.
Carriers underwrite a recognizable control set. Multifactor authentication, endpoint detection and response, tested backups, patching discipline, a written incident response plan, and user training appear on nearly every application.
Partial deployment reads like no deployment. A control covering most of the environment still leaves an exception list, and the exception list is what an underwriter asks about.
Documentation is the deliverable. Dated exports, coverage percentages, and restore test logs carry weight that a verbal assurance from a provider does not.
Regulated operations answer twice. Manufacturers and healthcare organizations face framework requirements and carrier requirements, and the two question sets overlap more than most teams expect.
Treat the next application as an audit you can pass on purpose, rather than a form completed in the two weeks before the policy lapses.
There was a time when a cyber policy was a signature and a premium. That time is over. The application landing on your desk this year reads like a technical questionnaire, because it is one, and the answers you give become part of the contract you are buying. Cyber insurance requirements now function as a de facto security baseline for any organization that wants coverage at a price it can justify to the board. Marsh, one of the largest commercial brokers in the world, puts it plainly in its guide to 12 key cyber hygiene controls: insurers are requiring specific controls, and insurability itself is at stake.
For organizations across Michigan and the Great Lakes weighing whether their current setup will survive the next renewal, the useful question is not which policy to buy. It is whether the controls you believe you have would hold up if an underwriter, or a forensic team after a claim, asked you to prove them. That is a question about your environment, and it is best answered with IT and security expertise across the Great Lakes well before the application deadline arrives.
What Are Cyber Insurance Requirements Today?
Cyber insurance requirements are the specific security controls a carrier expects to be in force, documented, and verifiable before it will bind or renew a policy. They are not a published standard. They are the accumulated result of a decade of claims data, and they tighten in the direction the losses point.
Look at where the money actually goes and the logic becomes obvious. Coalition's 2026 Cyber Claims Report found that business email compromise and funds transfer fraud together accounted for 58 percent of the incidents it saw across its policyholders in 2025, while ransomware remained the costliest category at an average loss of 269,000 dollars. That distribution explains the application. Carriers ask relentlessly about email security, identity controls, and backup recovery because those three areas map directly to the claims they pay.
The threat picture keeps moving, and the questionnaire follows it. Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken stolen credentials as the leading initial access vector, the first time in the report's nineteen year history that credential theft lost the top spot. Verizon also found third parties involved in 48 percent of breaches. Expect patch cadence and vendor access questions to get sharper for exactly that reason.
Why Does Proof Matter More Than Purchase?
Because a control you cannot document is, from the carrier's perspective, a control you do not have. Cyber insurance requirements are written in percentages and dates now, not in yes or no boxes, and the shift has caught out plenty of organizations that were genuinely doing the work.
The tools were purchased. The invoices are real. Nobody validated the deployment, and nobody owns the number.
The Exceptions Are Where Coverage Dies
Run the arithmetic before an underwriter does. Suppose your asset inventory lists 260 endpoints and your EDR console reports agents on 240. That is 92 percent coverage. The missing 20 are the older workstations running the machine software nobody wants to touch, the shared terminal near receiving, and two servers that were supposed to be decommissioned last year. On the application, the accurate answer is not yes. It is 92 percent, with a named exception list and a remediation date.
That answer is also the better one. An underwriter can price a documented gap. What an underwriter cannot price, and what a claims adjuster will find later, is a yes that turns out to be a 92.
Verbal Confidence Is Not an Underwriting Artifact
Carriers accept exports, not impressions. Ask your current provider for the artifact rather than the reassurance: a conditional access policy report, an EDR coverage summary broken out by device type, a restore test log with a date on it, a patch compliance rate for internet facing systems. Each one either exists or it does not, and the answer takes minutes to establish.
If those artifacts take three weeks to surface, the delay is itself the finding. Underwriting evidence is a byproduct of a disciplined review cycle, which is the broader case made in Cybersecurity Risk Assessment: What Yours Must Uncover. An application deadline is a poor substitute for that cycle, though it does have a way of revealing whether one exists.
Which Controls Do Underwriters Verify First?
Six controls carry the most weight on nearly every application, and the first three function as pass or fail for most carriers. Treat the list below as a working cyber insurance checklist, and treat the gaps it exposes as the shortlist for layered security controls worth prioritizing this cycle.
Multifactor authentication, scoped correctly. Email, remote access, privileged accounts, cloud admin consoles, and the backup console. Partial coverage invites follow up questions. CISA, in joint guidance with the NSA, FBI, and MS-ISAC, urges organizations to prioritize phishing resistant methods and is explicit that number matching on push notifications is an interim mitigation for push fatigue, not the destination.
Endpoint detection and response across servers and workstations. Legacy antivirus does not satisfy this question. Underwriters want coverage percentages and want to know who watches the alerts at two in the morning.
Backups that have actually been restored. Isolation and immutability matter, but the question that separates real answers from hopeful ones is when you last performed a full restore and how long it took.
Patching with a defined cadence. Given that vulnerability exploitation now leads initial access, internet facing systems draw the most scrutiny.
A written, exercised incident response plan. NIST finalized Special Publication 800-61 Revision 3 in April 2025, replacing the 2012 handling guide and reframing incident response as continuous cybersecurity risk management rather than a binder opened during a crisis. A plan with no exercise date is a document, not a capability.
Security awareness training with participation data. Carriers ask because the human element remains the connective tissue across most claim types.
Multifactor authentication. What the application asks: Is MFA enforced on email, VPN, and admin accounts?. What proof looks like: Identity provider policy export, legacy authentication blocked, admin account inventory.
Endpoint detection and response. What the application asks: What percentage of endpoints and servers are covered?. What proof looks like: Console coverage report by device type with a written exception list.
Backups. What the application asks: Are backups isolated, and when was the last tested restore?. What proof looks like: Restore test log with dates, recovery time results against stated objectives.
Patching. What the application asks: How quickly are critical vulnerabilities remediated?. What proof looks like: Patch compliance rates, defined SLA, internet facing asset list.
Incident response. What the application asks: Do you have a written plan, and when was it last exercised?. What proof looks like: Plan document, tabletop exercise date, named roles and contacts.
Awareness training. What the application asks: Is training required, and are phishing simulations run?. What proof looks like: Completion rates by department, simulation results over time.
What Do Cyber Insurance Requirements Mean for Michigan Manufacturers and Healthcare Organizations?
They mean answering the same questions twice, to two different audiences, with the same evidence. A manufacturer preparing for CMMC or TISAX is already building asset inventories, access controls, and incident response documentation. A healthcare organization completing its HIPAA risk analysis is doing cybersecurity compliance work an underwriter would recognize on sight. Very little of that effort has to be duplicated for an insurance application, and organizations that run compliance and framework readiness as one program rather than two spend less and answer better.
The plant floor is where the standard questionnaire breaks down. An underwriter asks whether EDR is deployed on all endpoints. The honest answer in a facility running press controllers, legacy HMIs, and a CNC network is complicated, and generalist providers frequently get it wrong, either by excluding operational technology from the asset count or by claiming coverage the agent cannot actually provide. Segmentation, monitored network boundaries, and a documented scope statement are the correct response. Pretending the OT network is not there is not.
Downtime math makes the stakes concrete. Take a two shift operation losing an illustrative 15,000 dollars per hour of production. A single day of stopped lines costs 360,000 dollars, more than the average ransomware loss Coalition recorded across its entire book of claims. The premium conversation is small next to that number, and so is the cost of closing the gaps that would have made the policy respond cleanly. For organizations running manufacturing IT and OT environments, recovery time is the number that should drive the security roadmap and the coverage conversation alike.
Healthcare hits a different version of the same wall. Shared clinical workstations, tap and go sessions, and legacy applications that will not support modern authentication make the MFA question genuinely hard to answer in a single field. The defensible answer is a scoped one: which systems enforce it, which do not, and what compensating controls cover the difference. Teams supporting clinical and administrative IT environments are usually one organizing pass away from an application packet, not one project away. Identity is the common thread in both settings, and the perimeter it replaced is long gone, a shift worth reading in Why Identity Is the New Perimeter.
What Happens When a Control Fails at Claim Time?
The claim becomes an investigation into your application. Forensic teams reconstruct what was running, when, and on which systems. If the reconstruction and the questionnaire disagree, the conversation shifts from recovery to coverage at the worst possible moment.
Two patterns show up repeatedly, and the difference between them is timing rather than intelligence.
When work begins. Renewal driven scramble: Two to four weeks before expiration. Assess first approach: 90 days out, tied to an annual cycle.
How answers are produced. Renewal driven scramble: Best recollection, vendor assurances. Assess first approach: Dated exports from systems of record.
How gaps are handled. Renewal driven scramble: Hidden, hedged, or answered optimistically. Assess first approach: Disclosed with owners and remediation dates.
Premium outcome. Renewal driven scramble: Priced for uncertainty. Assess first approach: Priced for a documented posture.
At claim time. Renewal driven scramble: Answers relitigated under forensic review. Assess first approach: Evidence already assembled and consistent.
Providers who monitor without responding, or who inherit an environment through acquisition and never validate it, tend to produce the left column. That is a pattern, not an accusation, and it is diagnosable. Ask for the artifacts and see what comes back.
Frequently Asked Questions
What are the minimum cyber insurance requirements for a small or mid sized business?
Enforced MFA on email, remote access, and privileged accounts, EDR on workstations and servers, and isolated backups with a tested restore. Any useful cyber insurance checklist starts with those three, because carriers treat them as conditions of coverage rather than preferences.
Can a claim be denied because a control was not actually in place?
A cyber policy is a contract, and the answers on the application are part of it. Carriers can and do contest claims where the represented control posture does not match what investigators find. This is a legal question specific to your policy language, so bring your broker and counsel into it early.
How far ahead of renewal should readiness work start?
Roughly 90 days. That leaves time to run a gap analysis, close the high impact items, and assemble evidence before the submission goes to market. Two weeks is enough time to fill out a form, not to change an answer.
Does CMMC, HIPAA, or TISAX compliance satisfy cyber insurance requirements?
Not automatically, though the overlap is substantial. Cybersecurity compliance work gives underwriters independent evidence that controls operate over time. Carriers still ask their own questions with their own scoping, particularly around backups, endpoint coverage, and recovery objectives.
Who should own the application inside the organization?
One named person with authority over both the technical answers and the documentation behind them. Applications routed between finance, operations, and an outside provider are where inconsistencies enter, and inconsistencies are what adjusters find later.
Know What You Can Prove Before You Sign It
Centaris is an IT and cybersecurity partner working with manufacturers, healthcare organizations, and other regulated businesses across Michigan and the Great Lakes. The work starts with an assessment rather than a product recommendation: what is actually deployed, where the exceptions live, and what evidence exists today. Gaps then get prioritized against your renewal timeline, so the controls that matter most to your risk and your carrier get addressed first. Accredited third parties handle certification and attestation, and your broker handles the coverage.
Renewal season rewards organizations that treated cyber insurance readiness as an annual discipline. Schedule a no obligation assessment and find out which of your answers would hold up under scrutiny.
