Quick Answer
Five controls appear on virtually every application and will cost you coverage if absent: MFA, EDR, tested immutable backups, email security, and an incident response plan. The rest affect pricing and terms rather than eligibility.
The Non-Negotiables
MFA across email, remote access, and administrator accounts. Partial deployment no longer satisfies most underwriters, and full coverage of email and remote access is the baseline expectation.
EDR on effectively all endpoints, with evidence of deployment coverage rather than a licence count.
Backups that are immutable or isolated, with documented restore testing. Untested backups are treated as unproven.
Email security including filtering and authentication — SPF, DKIM, and DMARC configured and enforcing.
Incident response plan that's written, current, and has been exercised, with a named coordinator.
What Shapes Your Terms
Beyond the baseline, underwriters look at patching cadence with documented timeframes, privileged access controls, network segmentation, security awareness training with completion rates, continuous monitoring, and vendor risk management. Gaps here rarely stop coverage but show up in the premium and the sub-limits.
How Much Applies to You
Requirements scale with your size, industry, revenue, the data you hold, and the limits you're seeking. A small firm buying modest cover faces a shorter list than one seeking high limits or handling regulated data.
Depth Matters More Than Presence
Ticking "yes" is no longer enough. Underwriters ask for coverage percentages and dated evidence, and a yes without documentation is increasingly treated with skepticism. Answer from reports rather than assumption — an inaccurate answer can affect a claim later.
Example Scenario
A 180-person manufacturer preparing for renewal had gaps across MFA on privileged accounts, outdated software, inconsistent backup testing, and no continuous monitoring. Addressing the baseline items first put it in a materially stronger position before the application went in.
How PureStack Helps Businesses Meet Cyber Insurance Expectations
We check each control against your real configuration, prioritise the ones that affect eligibility over the ones that affect pricing, and produce the evidence behind your answers.