Cyber insurance for SMBs: what insurers require before covering you

By Kike Gandia · Co-Founder & CEO, OSCP

It's increasingly common for an insurer to reject a cyber insurance claim, or refuse to issue the policy at all, because the company hadn't implemented the minimum controls it declared on the application questionnaire. Cyber insurance is no longer a blank check: it's a contract with concrete technical conditions that must be met before, during and at the moment of the incident. This guide explains what controls are required today and how to avoid surprises.

The minimum controls almost every insurer requires

Two-factor authentication (MFA) on email, VPN and administrative access; regular, tested backups, ideally with at least one offline or immutable copy; managed antivirus/EDR on every device; a documented incident response plan; and anti-phishing staff training. Without these five, many insurers simply won't issue the policy, or will issue it with exclusions that hollow out the coverage.

Why a claim can be denied even with a policy in place

The application questionnaire you filled out when you took out the policy is a binding declaration. If you stated MFA was enabled on all systems and the attack came through an account without it, the insurer can claim a material misrepresentation and deny the entire claim, not just the related portion. It's the most common reason for cyber insurance claim denial among SMBs.

How to verify you meet what you declared

Before renewing or taking out a policy, it's worth a quick review of the controls you're about to declare: is MFA active on ALL critical systems, not just some? Are backups actually tested, or just generated? Is the asset inventory you give the insurer up to date? A basic vulnerability assessment before renewal catches these gaps before the insurer finds them during a claim.

How to lower the premium without lowering coverage

The more controls you can prove, not just declare, with documented evidence, the better premium you get. A recent pentest or vulnerability assessment report, a documented security policy and an anti-phishing training log usually translate into real discounts at renewal, because they lower the perceived risk for the insurer.

What evidence the insurer accepts for each control

Declaring a control and being able to prove it are different things, and the gap only shows when there is a claim. This table summarizes what usually counts as proof for each control, and the mistake that most often invalidates the declaration:

Declared control	Evidence that backs the declaration	Typical mistake that voids it
MFA on email and admin access	MFA coverage report exported from the console, dated, with the percentage of accounts	Exempting leadership or service accounts "for convenience"; leaving basic authentication or legacy protocols enabled
Tested backups	A record of the last real restore, not just the last completed backup	Never having restored; keeping copies in the same domain or account as the source system
Managed EDR or antivirus	List of devices with an active agent, checked against the device inventory	Personal machines, legacy servers or executives' laptops missing from the console
Incident response plan	Document with roles, phone numbers and a decision tree, reviewed and dated	A plan written years ago naming people who no longer work there
Anti-phishing training	Per-employee record with dates and simulation results	A single onboarding session with no repetition and no coverage of new hires

The pattern is always the same: the insurer does not argue about whether the control existed in general, but whether it existed at the exact point the attacker came through.

FAQ

Does cyber insurance replace having security measures?

No, it's complementary. It covers part of the financial impact of an incident (forensics, notification, potential fines, business loss), but it doesn't prevent the incident or exempt you from basic controls.

What if I don't have any of the required controls?

You can often still get coverage, but at a much higher premium or with specific exclusions for scenarios tied to the missing control. It pays to implement them before taking out the policy, not after.

Do I need a vulnerability assessment before buying the insurance?

It's not mandatory, but it's the fastest way to know whether what you're about to declare on the questionnaire is actually true, and to catch gaps before the insurer finds them during a claim.

What documentation will the insurer ask for right after an incident?

First, the claim notice within the deadline set in the policy wording, which tends to be very short: read it before you need it, not during. Then the incident timeline, audit logs from the affected system, evidence that the declared controls were active at that moment, and the forensic report. This is why log retention matters: if your platform only keeps records for a few weeks and the compromise started earlier, you lose the ability to demonstrate both what happened and that you were compliant.

Can we touch the affected systems before the loss adjuster arrives?

Contain, yes — isolate from the network, cut access, invalidate sessions; wipe or reinstall, no. Rebuilding a compromised server destroys the evidence that supports both the claim and the notification to the AEPD (Spanish Data Protection Agency) if personal data was involved. The sequence that causes no problems is: isolate, preserve (forensic image, or at minimum export the logs), notify the insurer, and only then recover.

Who chooses the provider that handles the incident, us or the insurer?

Many policies work with their own panel of providers, and using an outside one without prior authorization can leave that cost uncovered. It is one of the clauses worth reviewing before signing, especially if you already work with a security team that knows your environment: some policies allow you to request that your usual provider be added to the panel.

Does the policy require a pentest, or is a vulnerability assessment enough?

It depends on the risk profile and the sum insured. For an SMB with standard exposure, a periodic vulnerability assessment usually covers what the questionnaire asks. When there is an in-house internet-facing application handling customer data, or the sum insured is high, a pentest report plus evidence of critical-finding remediation is more commonly required.

Sources

Review my compliance before buying cyber insurance