Does cyber insurance require a specific level of IT security?

Managed cybersecurity services now align closely with cyber insurance requirements, since most carriers require baseline security controls before issuing or renewing a policy. Multi-factor authentication (MFA), endpoint detection and response (EDR) and offline or immutable backups have become standard underwriting conditions insurers use to assess and price cyber risk.

Baseline security controls cyber insurers look for:

• Multi-factor authentication (MFA): Most carriers now require MFA on email, remote access and privileged accounts as a minimum condition for coverage.
• Endpoint detection and response (EDR): If a policy application shows no EDR tooling deployed across company devices, then many insurers will decline coverage or apply a higher premium.
• Offline or immutable backups: Backups stored separately from the primary network reduce the chance that ransomware can encrypt or delete recovery copies, a factor insurers weigh heavily during underwriting.
• Documented incident response plan: A written, tested incident response plan is increasingly requested during the application process to demonstrate an organization can contain and report a breach quickly.

To see how these controls map to a full security program, read our answer to this related question: How is managed cybersecurity different from basic antivirus software?