2026 Cyber Insurance Requirements: The IT Checklist Your Carrier Will Ask About

More than 40% of cyber insurance claims are denied. Not because the business lacked a policy – because they couldn’t prove they met the IT requirements their carrier demanded.

MFA failures alone account for 37% of all denied claims. A Memphis municipality had an $18.3 million claim rejected because MFA wasn’t deployed on every system. And that was a large organization with dedicated IT staff. For a 20-person dental practice or a 50-employee warehouse, the stakes are just as real – even if the dollar amounts are smaller.

If your policy renewal is approaching, here’s the cyber insurance IT requirements checklist carriers are actually using in 2026 – and what you need to document to avoid a denial.

Why Cyber Insurance Claims Are Getting Denied at Record Rates in 2026

The cyber insurance market has fundamentally changed. Five years ago, carriers asked a few questions and issued a policy. Today, underwriters audit your IT infrastructure the way a bank audits your financials before a commercial loan.

Three things are driving the shift:

1. Ransomware losses are unsustainable. 88% of SMB data breaches now involve ransomware, and attackers have shifted to encryption-free data extortion – exfiltrating your data over weeks, then threatening to publish it. “Just restore from backup” no longer stops the bleeding.
2. AI-powered attacks are more convincing. AI deepfakes now drive 40% of business email compromise attacks, up from less than 5% in 2023. Commodity tools can clone a voice from three seconds of audio for under $20. The average per-incident loss exceeds $4.1 million.
3. Carriers got burned. Years of paying out on policies with minimal security requirements taught insurers a painful lesson. Now they require proof – screenshots, configuration exports, and third-party attestations – not just checkboxes on an application form.

The result? Businesses that can’t document their security posture are either paying significantly higher premiums, getting dropped at renewal, or discovering their claim is denied after an incident has already happened.

The 7-Point IT Checklist Every Carrier Now Requires

Every major cyber insurance carrier in 2026 evaluates these seven areas during underwriting, mapping back to the same NIST Cybersecurity Framework that regulators and insurers increasingly expect businesses to follow. If you can’t demonstrate compliance in any one of them, expect a higher premium, a coverage exclusion, or an outright denial.

1. Multi-Factor Authentication (MFA) on All Remote Access and Privileged Accounts

This is the single most common reason claims get denied. We cover it in detail in the next section.

2. Endpoint Detection and Response (EDR) on Every Device

Traditional antivirus no longer qualifies. Carriers require EDR with 24/7 monitoring – software that detects suspicious behavior patterns, not just known virus signatures. We cover the EDR vs. antivirus distinction below.

3. Encrypted, Tested Backups with Offline Copies

Carriers want to see:

• Automated daily backups
• At least one offline or air-gapped copy (not just cloud sync)
• Documented backup restoration tests (quarterly minimum)
• Defined recovery time objectives (RTOs) for critical systems

If your backup and recovery strategy relies entirely on cloud sync with no offline component, most carriers will flag it.

4. Security Awareness Training for All Employees

Annual training is the minimum. Carriers increasingly require:

• Phishing simulation testing (not just classroom training)
• Documented completion records for every employee
• Training updates when new threat types emerge

With AI-crafted phishing emails generating click-through rates 4x higher than human-written phishing, carriers know that untrained staff are the weakest link.

5. Patch Management with Documented Timelines

Carriers want to see that critical patches are applied within 30 days (14 days for zero-day vulnerabilities). They’ll ask for:

• A list of all software in your environment
• Patch deployment records
• A process for handling end-of-life software that no longer receives patches

6. Incident Response Plan – Tested, Not Just Written

Having a plan in a binder on a shelf doesn’t count. Carriers now ask when you last tested your incident response plan and who participated. They want to see:

• A written plan with assigned roles
• Annual tabletop exercises
• Contact information for legal counsel, IT provider, and insurance broker
• Breach notification templates ready to deploy

7. Network Segmentation and Access Controls

Flat networks where every device can reach every other device are a red flag. Carriers expect:

• Separation between operational and guest networks
• Role-based access controls (not shared logins)
• Privileged access management for admin accounts
• Logging and monitoring of network activity

MFA: The #1 Reason Claims Get Denied (And How to Fix It)

Multi-factor authentication is not new. But the way carriers evaluate it has changed dramatically.

In 2024, most carriers accepted MFA on email and VPN. In 2026, they require it on every system that accesses sensitive data – including:

• Email (Microsoft 365, Google Workspace)
• VPN and remote desktop connections
• Cloud applications (practice management software, WMS platforms, accounting tools)
• Admin consoles for firewalls, backup systems, and security tools
• Privileged accounts on servers and workstations

SMS-based MFA is being rejected. Carriers increasingly require app-based authentication (Microsoft Authenticator, Duo) or FIDO2 hardware keys. SIM-swapping attacks have made SMS codes unreliable, and underwriters know it.

The “everywhere” requirement is what trips people up. A Memphis dental practice might have MFA on their Microsoft 365 email but not on their Dentrix server login. A warehouse might have MFA on VPN but not on their WMS admin console. Carriers look for gaps – and a single unprotected system can void your entire claim.

How to Fix It

1. Audit every system that touches sensitive data – patient records, financial data, inventory systems, email
2. Enable app-based MFA on each one (not SMS)
3. Document it with screenshots showing MFA is active on every platform
4. Test it by attempting a login without the second factor to confirm it’s enforced, not just enabled

If you’re already working with a managed IT provider, they should be able to provide a complete MFA deployment report. If they can’t, that’s a problem.

EDR vs. Traditional Antivirus: What Carriers Actually Accept

Traditional antivirus works by matching files against a database of known threats. If the virus signature is in the database, it gets blocked. If it’s new, it gets through.

Endpoint Detection and Response (EDR) takes a fundamentally different approach. Instead of matching signatures, it monitors behavior patterns on every device – detecting suspicious activity like unusual file encryption, privilege escalation, or data exfiltration in real time.

Here’s why carriers now require EDR:

What carriers specifically require:

• EDR installed on every endpoint (workstations, laptops, servers)
• 24/7 monitoring by a Security Operations Center (SOC)
• Automated response capabilities (isolate infected device, block suspicious process)
• Logging and reporting for incident investigation

If your current security setup is “we have antivirus on all computers,” that no longer meets the bar. Your carrier’s underwriting questionnaire will ask specifically about EDR, and “Norton” or “McAfee” will not satisfy the requirement.

Documentation and Proof – Screenshots, Not Checkboxes

This is where many Memphis businesses get caught off guard. You might have every security control in place – but if you can’t prove it during a claim investigation, the carrier will deny you.

Carriers in 2026 have moved from checkbox attestations to evidence-based underwriting. That means:

What they’ll ask for during underwriting:

• MFA configuration screenshots from each platform
• EDR deployment reports showing coverage percentage
• Backup test results with timestamps
• Training completion records by employee
• Patch management logs
• Incident response plan with date of last tabletop exercise

What they’ll ask for after an incident:

• Everything above, plus
• Timeline of when you discovered the breach
• Evidence of what containment steps you took and when
• Proof that the specific system compromised had all required controls active at the time of the incident

The time to gather this documentation is before your renewal – not after an incident when the claims adjuster is looking for reasons to deny.

Building Your Evidence File

We recommend maintaining a “cyber insurance evidence folder” that’s updated quarterly:

1. MFA screenshots – configuration pages showing enforcement status for every platform
2. EDR dashboard exports – showing all devices covered and monitoring active
3. Backup test logs – date, what was restored, time to recovery
4. Training records – completion certificates and phishing simulation results
5. Patch reports – current patch status across all systems
6. Incident response plan – with signature page from last tabletop exercise

This evidence file serves double duty: it satisfies your carrier during underwriting and protects you if you ever need to file a claim.

For businesses with HIPAA compliance obligations, much of this documentation overlaps with what you already need for your Security Risk Assessment. The 2026 HIPAA Security Rule overhaul – the most sweeping update since 2013 – now requires MFA for all system access and encryption at rest and in transit, aligning closely with what carriers demand. Financial advisory firms face a similar overlap – meeting SEC Regulation S-P compliance requirements gives you a head start on the evidence carriers expect during underwriting.

Frequently Asked Questions

What are the IT requirements for cyber insurance in 2026?

Carriers require seven core controls: multi-factor authentication on all systems, endpoint detection and response (EDR) with 24/7 monitoring, encrypted and tested backups with offline copies, security awareness training, patch management within documented timelines, a tested incident response plan, and network segmentation with access controls. Documentation and screenshots are required to prove each one.

Why do cyber insurance claims get denied?

The most common reason is failure to maintain the security controls the policyholder attested to during underwriting. MFA failures account for 37% of denials – typically because MFA was deployed on some systems but not all. Other common denial triggers include lack of EDR, untested backups, and missing documentation that proves controls were active at the time of the incident.

Can I get cyber insurance without MFA?

Increasingly, no. Most carriers in 2026 will either deny coverage outright or issue policies with significant exclusions if MFA isn’t deployed on all remote access, email, and privileged accounts. Even carriers that will issue a policy without full MFA will likely deny any claim related to a breach where MFA could have prevented the incident.

What happens if my cyber insurance claim is denied?

You’re responsible for the full cost of the incident – breach investigation, legal fees, notification costs, regulatory fines, and any litigation. For a Memphis business, the average total cost of a data breach runs well into six figures. 40% of SMB owners say a $100K breach would shut down their business entirely.

How far in advance should I prepare for cyber insurance renewal?

Start at least 90 days before your renewal date. This gives you time to identify gaps, implement missing controls, gather documentation, and test everything. Rushing to deploy MFA or EDR the week before renewal often results in incomplete coverage that a carrier will catch.

Don’t Wait Until Renewal Day – Get Compliant Now

SMBs are now the #1 target for cyberattacks – 63% of all data breaches since January 2025 have hit small and mid-size businesses. Businesses with 1-49 employees represent 48% of high-risk breaches. And right here in Memphis, the March 2026 Stryker cyberattack – linked to Iranian threat actors – demonstrated that Memphis businesses are specifically targeted due to the city’s data center concentration.

Cyber insurance is your financial safety net. But a safety net with holes won’t catch you.

Here’s how to start:

1. Get your carrier’s underwriting questionnaire – know exactly what they’ll ask
2. Audit your MFA deployment – every system, not just email
3. Confirm EDR coverage – traditional antivirus doesn’t qualify
4. Test your backups – run a restoration this week
5. Build your evidence folder – start with screenshots of what’s in place today

If you’re not sure where your business stands, we can assess your current security posture against carrier requirements and build a remediation plan with a clear timeline. We do this for healthcare practices, warehouses, CPA firms, and law offices across the Memphis metro – from Germantown to Bartlett to Southaven.

We’ve helped Memphis businesses pass underwriting audits, reduce premiums, and file successful claims. If your renewal is within 90 days, the time to act is now.

Schedule Your Free IT Assessment

For related compliance guidance, see our HIPAA compliance checklist for dental practices and our guide on ransomware prevention for Memphis warehouses.