What does MFA need to cover for cyber insurance?

Insurers expect multi-factor authentication on all email accounts, all remote access (VPN/RDP), and all administrative or privileged accounts. Partial MFA - covering some users but not admins or remote access - is one of the most common reasons for worse pricing or declined applications.

Can a cyber insurance claim be denied over the application?

Yes. If the application attested to controls (like MFA or backups) that forensics later show were not actually in place, carriers can contest or rescind. Never attest to a control you have not verified; disclose partial deployments honestly.

What backup setup do cyber underwriters want?

Offline or immutable backups with separated credentials, plus evidence of a tested restore. Backups an attacker can reach with stolen admin credentials do not count.

Why do insurers ask about funds-transfer procedures?

Business email compromise generated about $3.0 billion in reported U.S. losses in 2025 per the FBI's IC3 - the most expensive enterprise attack type. A written callback-verification procedure for any bank-detail change is the control that blocks it.

The Security Controls Cyber Insurers Now Require (MFA, EDR, Backups — the 2026 Application Checklist)

Quick answer: In 2026, most cyber insurers will not offer their best terms — and many will not offer terms at all — without MFA on email, remote access, and privileged accounts; endpoint detection and response (EDR); and offline, tested backups. Close behind: patching discipline, security-awareness training, and a written funds-transfer verification procedure. These are not box-checking: answering the application wrong can void a claim.

The cyber application has quietly become a security audit. Underwriters learned expensive lessons and now the questions are specific, the answers are attestations, and the difference between "yes" and "no" is measured in thousands of dollars — or in whether a claim gets paid. Here is the checklist, and why each item is on it.

The checklist, in underwriting order

Control	What insurers expect	Why it's on the application
MFA	On all email accounts, all remote access (VPN/RDP), and all admin/privileged accounts — not just "some users"	Account takeover is the front door for BEC and ransomware; email-based fraud losses passed $4B in 2025 per the FBI
EDR	A modern endpoint detection product on every workstation and server, monitored	Catches the intrusion between phish and encryption — the window where losses are prevented
Backups	Offline or immutable copies, separated credentials, and a documented restore test	Determines whether ransomware is an outage or an extinction event — and whether the insurer pays a ransom
Patching	Critical patches applied on a defined cadence; no end-of-life systems facing the internet	Unpatched edge devices are a top intrusion vector
Training	Recurring security-awareness training with completion records	Phishing remains the highest-volume attack; documented training is the human-layer control
Funds-transfer procedure	Written callback verification for any payment-instruction or bank-detail change	Directly targets BEC — the most expensive business attack, $3.0B reported in 2025

Answer the application like it's a sworn statement

Because functionally it is. Carriers have rescinded policies and fought claims where the application said "MFA: yes" and the breach forensics said otherwise. Two rules keep you safe: never attest to a control you have not verified, and if a control is partially deployed, say so — brokers can place partial-control risks; they cannot fix a misrepresentation after a loss. (This cuts both ways: fixing a "no" before you apply is often cheap, and our cost guide shows how much premium each control moves.)

Where the requirements are coming from

It is not only insurers. Client contracts, enterprise vendor-security questionnaires, and government work increasingly demand both the controls and the certificate of insurance proving cyber coverage — which makes the application checklist double as a sales-readiness checklist. Free authoritative starting points: CISA's Cyber Essentials and the FTC's small-business cybersecurity guidance.

The practical order of operations

Week 1: MFA on email + remote access + admin accounts. Highest premium impact per hour of work.
Week 2: EDR deployment; confirm backups are offline/immutable and run one restore test with a screenshot.
Week 3: Write the funds-transfer callback procedure (one page); enroll the team in awareness training.
Then apply. Applications completed after the controls are live routinely quote materially better than the same firm a month earlier.

Want a real number for your business? We broker cyber coverage nationwide, know what underwriters ask, and can tell you which security controls actually move your premium.

Call (818) 356-8150 or start online.

Get a Cyber Insurance Quote

Cyber Policy Quotes is a division of Thrive Risk Management (CA License #6012320). This article is general information, not a quote or a contract. Premium ranges are illustrative 2026 industry estimates and vary by risk, carrier, and state. Coverage is subject to the terms of the issued policy.