Cyber Insurance Readiness Checklist

Carriers now run 12–20 pages of line-by-line control questions and verify your answers with external scans. Score yourself honestly against what they actually require — before you sign, and before a claim depends on it.

How to use this: check a control only if you could prove it with evidence to an underwriter today — not "we mean to," not "probably." A control you can't evidence is a gap, not a checkbox. Your unchecked boxes are your readiness roadmap.

Tier 1

The non-negotiables

Miss even one of these and most carriers will decline you outright — or void the policy later.

MFA on email (Microsoft 365 / Google Workspace), enforced for every userEmail is the #1 breach vector and the first thing carriers check.
MFA on all remote access and VPN
MFA on administrator and privileged accounts
MFA on the backup console / management interfaceAttackers target backups first; this line item is increasingly its own question.
EDR/XDR (endpoint detection & response) on every workstation and serverLegacy antivirus no longer satisfies underwriting.
Someone actively monitors EDR alerts — you know who, and during what hours
Backups are immutable or offline (ransomware cannot reach or encrypt them)
A successful backup restore test in the last 12 months — with a documented date"We back up" is not the question. "When did you last restore?" is.

Tier 2

Premium & exclusion controls

These shape your rate, your exclusions, and whether a renewal is approved.

Tier 3

The honesty check

The difference between a policy that pays and one that doesn't.

Every box above is backed by evidence you could show an underwriter
The person signing the application has verified each control — not assumed it

Why honesty is the whole game

Carriers verify applications with their own external scans, and overstating your security posture leads to rescission — the policy is treated as void from inception, the claim is denied, and any prior payouts can be clawed back. A policy you can't collect on is worse than no policy at all. Answer for the network you have, not the one you intend to build.

Any Tier 1 box unchecked — you likely can't get or keep coverage. Fix these first; nothing else matters until they're done.

Tier 1 complete, Tier 2 gaps — expect a higher premium, coverage exclusions, or a tough renewal. Each gap is a negotiating point working against you.

All three tiers checked, with evidence — you're in strong shape to apply, negotiate, and actually collect if the day comes.

Not sure how you'd really score — or how to close the gaps?

I help regulated businesses get insurable, keep premiums down, and make sure the answers on the application are true enough to collect on. I don't sell insurance — I make sure you can get it, afford it, and actually claim on it.

Book a free 15-minute call: [email protected] · trentcyber.com

Control set aligns with the CIS Critical Security Controls v8.1 (Implementation Group 1) and CISA's #StopRansomware guidance, and reflects controls common across 2026 carrier questionnaires.

This checklist is an educational self-assessment provided by Trent Cyber Advisory, a technical security and compliance advisory practice. It is not insurance advice and is not a substitute for the specific application, underwriting requirements, or policy terms of any carrier; Trent Cyber Advisory does not sell or place insurance. It is not legal advice. © 2026 Trent Cyber Advisory.