A Practical Guide to Cyber Risk, Readiness, and Coverage
Cyber insurance isn’t about fear it’s about preparedness. For IT teams, MSPs, CPAs, and accounting professionals, cyber insurance has become a practical requirement driven by client expectations, regulatory pressure, and real operational risk.
Kovermi helps you understand what cyber insurance actually asks, why it matters, and how to help better advise and protect your clients.
These controls reflect what cyber insurers commonly validate during underwriting, renewal, and claims review.
MANAGED IT & SECURITY
Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) are often asked to validate cybersecurity controls for cyber insurance applications.
Insurers rely on IT providers to confirm security posture, including MFA, endpoint protection, backups, and patch management, making MSPs a critical part of the cyber insurance process.
ACCOUNTING FIRMS & CPAS
Accounting firms and CPAs are frequently asked to confirm internal controls, policies, and cyber risk exposure during cyber insurance reviews.
As trusted advisors, CPAs help clients interpret cyber insurance requirements and coordinate with IT and insurance professionals to ensure accurate, compliant responses.
CONSULTING & ADVISORY
Consultants, vCIOs, and advisory firms are often the first resource clients turn to when faced with cyber insurance requirements.
Advisors help businesses understand insurer questionnaires, assess readiness, and determine next steps without unnecessary disruption or confusion.
APPLICANTS FOR CYBER
Businesses applying for cyber insurance are typically responding to a client, regulatory, or contractual requirement.
Applicants need clear explanations of cyber insurance questions, security controls, and coverage expectations to complete applications accurately and secure appropriate protection.
FUNDAMENTALS
Core Concepts of Cyber Insurance Questionnaires
Do all users have MFA enabled for email, remote access, and admin accounts?
Definition: Multi-Factor Authentication (MFA) requires users to verify identity using two or more factors, something they know (password), have (phone or token), or are (biometrics).
Why insurers care: Insurers typically expect MFA to be enforced for email, remote access (VPN/RDP), cloud applications, and privileged or administrative accounts. MFA cyber insurance requirements:
- Email systems such as Microsoft 365 & Google Workspace
- Virtual Private Networks (VPN)s
- Cloud and Software-as-a-Service (SaaS) admin portals
- Common gaps insurers flag:
- MFA enabled for some users, not all
- MFA missing on privileged, admin or service accounts
- MFA enforced but not monitored
Are all endpoints protected by centrally managed endpoint security?
Definition: Endpoint protection software monitors laptops, desktops, and servers for malware, ransomware, and suspicious behavior.
Why insurers care: Endpoints are the most common entry point for ransomware. Most insurers now expect centrally managed endpoint detection and response (EDR) or equivalent advanced endpoint protection, not standalone antivirus alone. What does good look like?
- Centralized management and inventory of devices
- Real-time monitoring & signature file updates for AV
- Automatic updates for supported software
- Ensure Remote Desktop Protocol (RDP) is disabled
- Local firewalls are enabled
- Encryption is enabled
Are systems patched regularly and vulnerabilities addressed?
Definition: Patch management ensures operating systems and software receive security updates that close known weaknesses.
Often appearing as an endorsement or policy condition related to patching obligations, Neglected Software Exploit Endorsement is a cyber insurance policy provision that allows limited coverage for losses caused by unpatched software vulnerabilities during a defined grace period. After the grace period expires, coinsurance may apply, reducing the insurer’s share of covered losses.
Failure to Maintain is a cyber insurance policy condition that allows insurers to limit or deny coverage if the insured organization fails to maintain the cybersecurity controls and practices represented during the application process. This clause is typically evaluated during renewal and at the time of a claim, not just at application.
Why insurers care: Unpatched systems are one of the fastest ways attackers gain access. Many insurers ask whether critical security patches are applied within defined timelines (often 14–30 days) and whether patching is documented.
- “Ad hoc”, manual, and inconsistent updates
- No visibility into patch status
- Unsupported operating systems
Are backups performed regularly, stored offline and immutable?
Definition: Backups are secure copies of business data stored separately from production systems.
Why insurers care: Ransomware without reliable backups becomes a business-ending event. Insurers may also ask whether backup restoration is tested periodically to confirm data can be recovered. Insurers want to see:
- Daily or frequent backups
- Offsite or immutable storage
- Periodic testing of restorations
Are employees trained on phishing and cyber threats?
Definition: Security awareness training teaches employees how to recognize and avoid cyber threats.
Why insurers care: Humans are often the weakest link, but also the strongest defense when trained. Underwriters often ask whether training is conducted at least annually and whether participation can be documented.
- Evidence of training during onboarding and annually
Are user permissions reviewed and restricted?
Definition: Least privilege means users only have access to what they need to do their job.
Why insurers care: Excess access increases damage during a breach. Insurers commonly ask whether user access and administrative privileges are reviewed periodically.
- Periodic (monthly, quarterly, annual) user access reviews
- Remove stale or unused accounts
- Inventory human, non-human, and service accounts & identities
Do you segment your network to limit lateral movement between systems?
Definition: Network segmentation separates critical systems, user devices, and sensitive data into distinct network zones with controlled access between them.
Why insurers care: Insurers view network segmentation as a key control for reducing ransomware spread and breach impact. Segmented networks limit lateral movement, lower potential losses, and demonstrate mature cybersecurity risk management. Network segmentation is evaluated as a loss-containment control that limits ransomware spread and reduces potential claim severity.
- Avoid flat networks
- Avoid shared admin access
- Document network & segmentation strategy
Do you secure internet domains and email systems against spoofing and business email compromise (BEC)?
Definition: Internet domain security protects company domains and email systems by enforcing encrypted communications (TLS/SSL) and using email authentication standards to verify that messages are legitimate and not impersonated.
Business Email Compromise (BEC) is a form of fraud where attackers impersonate trusted email domains to redirect payments or obtain sensitive information.
- SPF (Sender Policy Framework): Specifies which mail servers are authorized to send email on behalf of a domain.
- DKIM (DomainKeys Identified Mail): Uses cryptographic signatures to verify that email content has not been altered in transit.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): Builds on SPF and DKIM to instruct receiving systems how to handle unauthenticated emails and provides reporting on domain abuse.
- Insurers increasingly expect DMARC to be set to an enforcement policy, not monitoring only.
BEYOND THE BASICS
Additional Cyber Insurance Considerations
Beyond core cybersecurity controls, cyber insurers increasingly evaluate how organizations prepare for, detect, and contain incidents. CPAs may encounter the following areas during underwriting, renewal, or claims review.
Incident Response
& Disaster Recovery Planning
Insurers may ask whether a documented incident response (IR) or disaster recovery (DR) plan exists and is maintained. These plans demonstrate preparedness and support faster containment of cyber events. A related term is Business Continuity and Disaster Recovery (BCDR).
Security Monitoring
& Event Logging
Some carriers review whether systems are monitored for suspicious activity and whether security events are logged and reviewed to support timely detection and response. This may involve a Security Information and Event Management (SIEM) solution.
Remote Access Security
(VPN / Zero Trust)
Cyber insurance applications often include questions about secure remote access, such as VPNs or zero-trust controls, to prevent unauthorized system access. Modern solutions for distributed workforces include Secure Access Service Edge (SASE) services.
Vendor & Third-Party
Risk Controls
Certain insurers assess whether organizations consider third-party or vendor cyber risk, particularly when critical systems or data are managed by external providers.