Cyber Insurance Controls That Can Lower Your Premium

Six controls shape most cyber insurance terms: multi-factor authentication on email and remote access, tested backups kept separate from your network, endpoint detection on every device, prompt patching, regular security training and a call-back rule before any change to payment details. Carriers ask about each one on the application. Your answers must be accurate, because a wrong yes can put a claim at risk. This guide is for new owners who inherited someone else's computer setup and now have to sign a cyber application for it.

The short answer

Many carriers treat a few controls as the price of admission, not a discount: multi-factor authentication, backups and endpoint protection come first.
Better controls can improve your price, limits, retention (the part of each claim you pay first) and the coverages a carrier will offer, such as social engineering cover.
You sign the application. Verify every control answer with your IT person or provider before you sign, especially in the first months after closing.
If a control is missing, fix it before the application goes out, or answer no and explain your plan.
Payment verification by phone costs little to set up and helps protect against one of the most common losses.

Why do cyber carriers care so much about controls?

Cyber insurance pays for things like breach response, ransomware recovery, lost income from a network outage and claims from people whose data was exposed, depending on the policy. Most of those losses start with a handful of failures: a stolen password, an unpatched system, a phishing email, or backups that turn out to be encrypted along with everything else. Carriers have learned which controls stop those failures, so they ask about them in detail and price accordingly.

For many carriers, some controls decide whether you get a quote at all. Others move the price, the retention (the part of each claim you pay first) and the limits or sublimits offered. Controls are also where a new owner can make the biggest difference fastest, often within weeks. For what the policy itself should include, see the new owner's cyber review and cyber liability insurance.

Which controls do cyber applications ask about?

Applications differ by carrier. The first six rows are the core controls from the top of this guide, and many applications also ask about the last three. The last column is the step to take before you answer.

Control	What applications typically ask	Why carriers care	Verify before you sign
Multi-factor authentication (MFA)	Is it required for email, remote access, admin accounts and cloud apps? For all users?	Stolen passwords are a leading way in	Get a report from the email system showing every account has it turned on, not just most
Backups	How often? Kept offline or separate from the network? Encrypted? Restores tested?	Restorable, separate backups let you recover without paying a ransom	Ask for the date of the last successful test restore
Endpoint detection and response (EDR)	Is it installed on all computers and servers? Is someone monitoring alerts?	Catches attacks that plain antivirus misses	Compare the device count in the tool with your actual devices
Patching	How fast are critical updates applied? Any unsupported systems?	Known, unpatched flaws are easy targets	List any old servers or software no longer receiving updates
Training	Do employees get security training and phishing tests?	People click links; training reduces it	Keep completion records
Payment verification	Are changes to bank details confirmed by phone to a known number?	Fake invoices and payment redirects are common losses	Write the rule down and confirm accounting follows it
Remote access	Is remote desktop open to the internet? Is all remote access behind a virtual private network (VPN) or similar with multi-factor authentication?	Exposed remote access is a common ransomware entry point	Ask your IT provider for a list of every remote access path and how each is protected
Incident response plan	Do you have a written plan? Who calls the insurer?	A fast, organized response limits damage and cost	Write a one-page plan with the insurer's claims hotline
Admin access	Who has administrator rights? Are admin accounts separate from daily accounts?	Attackers seek admin access to spread	List every admin account and remove the ones not needed

These line up with government guidance for small businesses. The Cybersecurity and Infrastructure Security Agency (CISA) tells small businesses to require multi-factor authentication through technical controls, perform and test backups, and keep systems patched. The National Institute of Standards and Technology (NIST) also has a small business cybersecurity resource page.

Why must your application answers be accurate?

The application becomes part of the basis on which the carrier issues the policy. If you answer yes to a control that was not in place, the carrier may dispute a claim, especially one the missing control would have stopped, and in some cases may seek to void the policy. In many states that can happen even if the missing control had nothing to do with the loss. Some cyber policies also require you to keep the controls you described in place for the whole policy period. How far a carrier can go depends on the policy wording and your state's law, and no one wants to find out during a ransomware attack.

New owners face a special risk here. You may be signing an application in the first weeks after closing, about systems the seller's team or an outside provider set up. "I think we have that" is not good enough. Ask whoever runs IT, whether an employee or a managed service provider (MSP), to confirm each answer in writing with evidence such as screenshots or reports. If an answer is "mostly", such as multi-factor authentication on everyone except a few shared accounts, treat it as a no until it is fixed, or describe the exception in the application. During an IT migration, answers can change week to week; see cyber risk during an IT migration.

Which controls should a new owner fix first?

If you can only do a few things before the cyber application goes out, start here, in this order:

Turn on multi-factor authentication for every email account, remote access tool, admin account and the banking portal.
Check the backups. Make sure a copy is kept offline or separate from the main network, and run a test restore.
Install endpoint detection on every computer and server, with someone watching the alerts.
Adopt a payment call-back rule. Any new or changed bank details from a vendor, customer or employee are confirmed by phone to a number already on file, not the one in the email.
Remove old access. Shut off accounts for the seller, departed employees and old vendors, and reduce admin rights.
Patch or isolate old systems that no longer get security updates.
Start training, including a short session on fake invoices and payment requests.

Item four deserves emphasis. The Federal Bureau of Investigation (FBI) Internet Crime Complaint Center reported about $55 billion in exposed losses from business email compromise worldwide between October 2013 and December 2023, and its first tip is to verify payment and account changes through a second channel. Note that a tricked employee sending money is usually a social engineering loss, which many policies cover only through a specific endorsement, an optional insuring agreement or a sublimit, if at all, depending on the form. See funds transfer fraud for new owners and commercial crime insurance.

How much can better controls change your cyber terms?

There is no fixed discount, and carriers generally do not publish one. What changes is your position in the market. An account that lacks the basic controls may get fewer quotes, higher retentions, lower limits or exclusions for ransomware. An account with strong, verified controls usually has more carriers interested, which is what gives you room to negotiate price and terms. For general pricing factors, see what cyber insurance costs.

A hypothetical example. A buyer acquires a 30-person specialty distributor. The cyber application asks whether multi-factor authentication is required for all remote access. The seller's provider says yes, but a check finds an old accounting server that staff reach through a remote desktop connection with only a password. The buyer has the provider put that connection behind multi-factor authentication, confirms with a report, and only then signs the application. Had the buyer answered yes without checking, and ransomware had come in through that server, the claim could have been disputed. Fixing the gap also gives more carriers a reason to quote. The example is illustrative; outcomes depend on the carrier and the policy wording.

What should you send the underwriter with the application?

A short controls summary often helps more than the checkboxes alone. Include:

Who runs IT, and whether a provider monitors your systems around the clock.
Evidence of multi-factor authentication coverage (for example, a report showing all accounts enrolled).
Backup design and the date of the last successful test restore.
The endpoint tool and the number of devices covered.
Your written payment verification procedure and incident response plan.
Training completion rates and any phishing test results.
Changes made since closing, with dates, and anything still in progress.

Send it 90 to 120 days before renewal, or before you buy a first cyber policy, so the underwriter has time to ask follow-up questions. For how this fits a broader submission, see what underwriters want to see from a new owner. A Morrow review can check that the application answers match the evidence and request quotes from carriers that write your type of business. The carrier makes the final underwriting decision.

Keep reading

Frequently asked questions

Can I get cyber insurance without multi-factor authentication?

Some carriers may still quote, but many treat multi-factor authentication on email and remote access as a basic requirement, and missing it can mean fewer options, higher retentions or narrower coverage. It is usually one of the fastest controls to fix.

What happens if I answer an application question wrong by mistake?

Tell your broker and the carrier as soon as you find the error. A wrong answer can give the carrier grounds to dispute a claim or, in some cases, to void the policy, depending on the wording and state law. Correcting it before a claim is far better than after.

Does cyber insurance cover an employee who wires money to a fake vendor?

Often not under the base cyber or crime policy. That is usually a social engineering loss, which many policies cover only through a specific endorsement or optional insuring agreement, often with a lower sublimit. Check the wording and ask whether a verification procedure is required.

Our IT is outsourced. Who answers the security questions?

You sign the application, so you are responsible for the answers. Ask your provider to confirm each control in writing with evidence, and check that their answers cover every device and account.

Will training employees really matter to an underwriter?

It is one of the controls applications ask about, and carriers view it as part of a layered defense. Keep records of who completed training and any phishing test results so you can show it.

References

Just bought a business? Get your insurance reviewed.

Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.

Request a review Check a contract

Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114

This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.

Cyber Controls That Can Lower Your Cyber Insurance Premium