Cyber insurance applications used to feel closer to paperwork. Today, they feel much more like a security review. A business owner or COO renewing a policy may be asked about multi-factor authentication (MFA), backups, access controls, staff training, patching, incident response, and password management before an insurer even confirms terms.
Underwriters want to know which controls are in place, where they apply, how consistently they are enforced, and whether the business can prove it. This is because cyber insurance can’t be used as a replacement for cybersecurity. It sits alongside security controls, incident planning, recovery processes, and risk management as part of managing cyber risk
For businesses preparing to apply or renew, here’s what you need to know about what insurers expect to see before they are comfortable taking on the risk.
What cyber insurance underwriters really check
The controls most insurers expect
A practical cyber insurance checklist
Why businesses struggle to qualify
How SMB risk affects insurance conversations
How Proton Pass supports cyber insurance readiness
What cyber insurance underwriters really check
A cyber insurance assessment is designed to understand how likely a business is to suffer a cyber incident, how severe that incident could become, and how prepared the business is to recover.
The underwriter is not only looking at what a company does or how much revenue it generates. They also want to understand how it handles access, credentials, data, systems, suppliers, and continuity. A company with weak admin controls, no MFA enforcement, and untested backups presents a different risk profile from one that can show clear policies, enforced controls, and recovery evidence.
That is why cyber insurance requirements often focus on operational security. Insurers want to know whether attackers can easily get in, whether the business can contain the damage, and whether essential systems can be restored without paying a ransom or remaining offline for days.
Cyber insurance underwriting can involve a detailed questionnaire, follow-up questions, evidence requests, scans, or calls with IT providers. For smaller businesses, this process may be difficult, especially when security hasn’t laid out formal processes.
For example, it isn’t enough to say that your company uses MFA. An insurer may want to know where and how MFA is enforced, whether it covers admin accounts, and which critical applications, if any, are left out. A stronger answer is specific, documented, and backed by evidence.
The controls most insurers expect
Cyber insurance requirements vary by provider, policy type, company size, and risk profile. Still, most assessments now look for the same basic signs: whether your business can prevent common attacks, limit the damage if an account is compromised, recover from disruption, and prove that controls are actually in place. This often includes how your business handles passwords. A strong password policy and a secure business password manager are among the most effective password management best practices you can put in place.
MFA
This is one of the first controls insurers look for because many claims stem from credential abuse. You may be asked whether 2FA is enabled for email, VPNs, remote access, cloud platforms, password managers, and other critical applications.
The assessment may also go further, asking whether MFA is enforced for all users, only for certain systems, or only for admin accounts, and how that enforcement actually works.
There’s a difference between MFA being available and MFA being mandatory: an underwriter will want to know whether it’s enforced, whether it’s configured at the identity provider or app by app, and what happens when someone fails or bypasses the prompt.
A stronger response shows where MFA is required, which applications are covered, how it is enforced, and how exceptions are approved and reviewed.
Admin and privileged account protection
Insurers also want to understand how your business protects accounts with elevated access. Admin accounts can change settings, create users, access sensitive data, disable security controls, or move across systems, which makes them especially valuable to attackers.
Businesses may be asked whether admin access is limited to specific people, reviewed regularly, protected with MFA, and separated from everyday user accounts. Evidence can include access policies, user lists, role-based permissions, and logs that show privileged activity.
Backups and recovery readiness
Backups matter because insurers look beyond prevention. They also want to know how quickly your business can recover. If a ransomware attack, accidental deletion, or system failure affects your business, the insurer wants to know whether it can recover without paying a ransom or losing critical data.
This usually means having backups that are regular, protected from unauthorized access, and tested. It isn’t enough to say backups exist. You should be ready to show what is backed up, how often backups run, where they are stored, who can access them, and when restoration was last tested.
Endpoint and email security
Many attacks start through an employee inbox or device, so insurers often ask about endpoint and email protection. This can include anti-malware, endpoint detection, spam filtering, phishing protection, and controls that block suspicious attachments, links, or login attempts.
For email specifically, insurers may also ask whether your domain uses email authentication (SPF, DKIM, and DMARC) to stop attackers from spoofing your company’s address.
For smaller businesses, this may be handled by an IT provider or through built-in features in the tools they already use. What matters is being able to explain what protection is active, which devices and accounts are covered, and how alerts or incidents are handled.
Patch management
Outdated software gives attackers an easier path into business systems. Because of this, insurers may ask how quickly your business applies security updates to operating systems, browsers, applications, servers, and other critical software.
They may also ask whether updates are automatic, manually reviewed, or managed by an external IT provider. A stronger answer explains who owns patch management, how updates are tracked, and how the business handles urgent vulnerabilities.
Employee security training
Insurers know that employees are often targeted through phishing, social engineering, fake invoices, malicious links, and credential theft.
Recurring security awareness training helps reduce that exposure, and phishing awareness training in particular addresses the attack type behind most credential-related claims. Still, the assessment may ask for more than a general statement that employees are trained.
Businesses may need to show how often training happens, what it covers, whether new employees receive onboarding, and whether staff know how to report suspicious activity. Practical, recurring training is more useful than a one-off session that no one revisits.
Incident response planning
A written incident response plan shows that your business knows what to do when something goes wrong. Insurers may ask whether your business has a documented process for identifying, reporting, containing, and escalating security incidents.
The plan should make clear who is responsible, who needs to be contacted, how evidence is preserved, and how the company communicates with employees, vendors, customers, legal counsel, or regulators when needed. Even a simple plan is better than relying on improvisation during a crisis.
Third-party access controls
Vendors, contractors, agencies, IT providers, and software partners can introduce risk when they have access to business systems or data. Insurers may ask whether third-party access is limited, reviewed, and removed when it is no longer needed.
They may also look for MFA on vendor accounts, separate credentials for external users, and a clear process for approving access. The business should be able to show who has access, what they can access, why they need it, and when that access was last reviewed.
A practical cyber insurance checklist
Before starting a cyber insurance application or renewal, your business should gather proof that its security controls are not only planned, but already working. Underwriters don’t expect every smaller business to have enterprise-level documentation. But they do expect clear answers, consistent practices, and evidence that the company can explain how access, recovery, training, and incident response are handled.
A checklist will not guarantee coverage or lower premiums, but it can make your assessment more effective, reduce back-and-forth, and help the business enter the underwriting process with stronger answers.
Cyber insurance readiness checklist
MFA
Evidence to prepare: List of systems where MFA is enforced, including email, cloud apps, remote access, admin accounts, and any documented exceptions.
Password management
Evidence to prepare: Password manager policy, user adoption records, shared vault structure, admin settings, and reports showing weak, reused, or exposed passwords.
Backups
Evidence to prepare: Backup schedule, storage location, access controls, retention policy, and the date of the most recent restore test.
Incident response plan
Evidence to prepare: Written response plan, escalation contacts, internal roles, reporting steps, and any recent tabletop exercise or plan review.
Training records
Evidence to prepare: Security training dates, attendance records, onboarding materials, phishing awareness content, and reporting instructions for employees.
Patch management
Evidence to prepare: Patch policy, update logs, list of covered systems, ownership details, and records for urgent vulnerability remediation.
Privileged access review
Evidence to prepare: Admin user list, role-based permissions, access review records, MFA status for privileged accounts, and offboarding documentation.
Why businesses struggle to qualify
Businesses often struggle with cyber insurance because the application exposes gaps that day-to-day operations can hide. A company may have MFA on some systems, backups in place, an IT provider on call, and employees who know the basics of phishing. But insurers look for consistency across the business: where controls are enforced, who owns them, how often they are reviewed, and what evidence supports each answer.
This is especially difficult for smaller businesses that have built security gradually, without formal documentation. Access may be granted through different systems, shared credentials may still live in spreadsheets instead of in a secure team password manager, backups may not have been tested recently, and security training may happen informally.
None of these issues automatically means a business is uninsurable, but they can create delays, exclusions, higher premiums, or follow-up questions during underwriting.
The strongest applications are usually not the ones with the most complex security programs. They are the ones that can clearly show how core controls work, where the remaining gaps are, and what the business is doing to close them.
How SMB risk affects insurance conversations
Insurers care about controls because small and mid-sized businesses are not invisible to attackers. Proton’s SMB Cybersecurity Report found that one in four SMBs were breached last year despite having cybersecurity measures in place. The report also points to human error, inconsistent security policies, and lack of data control as key causes.
Many businesses approach their cyber insurance applications with security measures already in place, but the assessment often shows whether those measures are consistent, current, and easy to prove. MFA may protect some accounts but not others. Backups may run on schedule but have no recent restore test behind them. Admin access may have expanded as the company grew, without a clear record of who still needs it.
For a COO or business owner, that scrutiny can be useful before the policy is even issued. It turns everyday assumptions into specific evidence: access lists, backup records, MFA coverage, password practices, documented policies, and known gaps. Instead of relying on what people believe is happening, the business gets a clearer picture of how its controls actually work.
Seen this way, the assessment is not only an obstacle to coverage. It can help the business identify the weaknesses that would matter most during a breach, and fix them before they become harder, more expensive, or more disruptive to address.
How Proton Pass supports cyber insurance readiness
Cyber insurance assessments look at the business as a whole, including backups, patching, incident response, employee training, network security, and vendor risk. A password manager can’t satisfy every requirement on its own, but it can strengthen one of the areas insurers examine closely: how your business handles credential management and access.
A business password manager like Proton Pass for Business helps teams replace insecure password habits with a more controlled system. Employees can create and store unique passwords in end-to-end encrypted password vaults, use autofill to reduce reuse, manage passkeys, and securely share credentials without relying on email, spreadsheets, chat threads, or browser-saved passwords.
Built-in two-factor authentication also helps teams keep passwords and verification codes in one secure workflow, instead of scattering access across different apps and personal devices, which adds friction and pushes people toward shortcuts.
As a password manager for IT teams, Proton Pass adds the visibility and control needed to make those practices easier to enforce. Teams can configure password requirements, enforce 2FA policies, manage vault access, assign role-based permissions, provision users with SCIM, support single sign-on (SSO), and use logs for compliance or incident response reviews. These features can support common underwriting questions around MFA, password management, shared credentials, privileged access, onboarding, offboarding, and access reviews.
The broader cyber insurance application will still need documentation across the rest of the security program. But for the credential portion of the assessment, Proton Pass can help your business give a clearer answer: who has access, how credentials are protected, how sharing is controlled, and what evidence is available when an underwriter asks.
Tick every cyber insurance box with a business password manager.
