MFA, EDR and backups: the controls cyber insurers now require

Cyber underwriters expect a handful of controls before they offer full terms: multi-factor authentication on email, remote access and administrator accounts; endpoint detection and response (EDR) that someone monitors; backups that ransomware cannot reach and that you have tested; prompt patching of internet-facing systems; email filtering with staff training; locked-down privileged accounts; and a written incident response plan. Without them you can still be quoted, but often with a ransomware sublimit, higher retention, a condition to fix gaps within weeks, or a declination.

The list is not arbitrary. It follows how attacks happen and how small incidents become expensive ones, and the FBI and CISA publish nearly the same list.

Why these controls and not others

Underwriters price what makes losses less likely and smaller. Three data points show the logic.

• Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 through October 2025, found that exploiting vulnerabilities overtook stolen credentials as the most common way in, and that ransomware was present in 48% of breaches, up from 44%, according to Help Net Security's coverage. The same coverage reports that only 26% of the vulnerabilities on CISA's known exploited list were fully remediated by the organizations Verizon measured, with a median of 43 days to fully patch.
• The FBI's 2025 Internet Crime Report counted more than 3,600 ransomware complaints in 2025. Of ransomware complaints from organizations outside the critical infrastructure sectors, 18% came from legal services, 17% from contracting trades and 10% from engineering and architecture firms, so ordinary small professional firms are the target.
• The same FBI report lists its recommended mitigations: encrypted, immutable, off-site or offline backups that are regularly tested; MFA on webmail, VPNs and accounts that reach critical systems; EDR to detect lateral movement; network segmentation; least-privilege administrator accounts; and timely patching with priority on known exploited vulnerabilities in internet-facing systems.

An application that asks about MFA, EDR, backups, privileged accounts and patching is asking about that list. the cyber insurance application: what underwriters ask and how to answer covers the form itself; this guide covers the substance behind each answer.

The controls, one at a time

Multi-factor authentication

What the carrier wants is MFA on every route an outsider can use: email, VPN or other remote access, administrator and privileged accounts, and access by vendors and outside IT providers. Many forms also ask about the backup console. Partial coverage is the common weakness. Turning MFA on for staff email while leaving an old administrator account on a password alone defeats the point, because the administrator account is the one attackers want.

The type of second factor matters too. CISA's phishing-resistant MFA fact sheet (October 2022) ranks the methods. Hardware keys and other FIDO/WebAuthn methods are the strongest. Authenticator-app codes and app push prompts with number matching are the best options for small and mid-size businesses that cannot move to phishing-resistant MFA right away. Text-message and voice codes sit at the bottom, to be used only as a last resort because of SIM swap and related attacks. Some applications, such as the AXIS ransomware supplement, ask which method you use.

Endpoint detection and response

Traditional antivirus checks files against known signatures. EDR watches how programs behave on laptops and servers, flags lateral movement and can isolate a machine. Carriers ask for the product name, the share of endpoints and of servers covered, and increasingly whether a security operations center or managed detection and response (MDR) service watches the alerts around the clock. An EDR agent on 70% of machines and alerts that sit unread overnight gives a much weaker answer than the checkbox suggests. Some insurers credit approved MDR services in pricing (what drives the cost of cyber insurance has an example).

Backups that survive the attack

The question is not whether backups exist but whether ransomware can encrypt or delete them. Strong answers combine several features: a copy that is offline or immutable (it cannot be altered or deleted for a set period), separate credentials that are not joined to the main network login, MFA on the backup management console, and encryption. Then comes the part that most small firms skip: restoring from the backup on a schedule and recording how long it took. CISA's #StopRansomware Guide recommends offline, encrypted backups tested for availability and integrity.

One limit to understand. Many attacks now steal data and threaten to publish it. IOA's 2026 midyear cyber outlook notes that this shift makes backups less useful against extortion demands. Backups protect you from downtime, not from a leak, which is why the policy and the controls work together.

Patching and unsupported software

Carriers ask how fast you patch critical flaws, whether you track CISA's known exploited vulnerabilities list, and whether any systems have reached end of life and no longer receive fixes. CISA's guide also advises against exposing remote desktop services to the internet. If a legacy machine must stay, the usual acceptable answer is that it is isolated on its own network segment with a written retirement date.

Privileged accounts and segmentation

Underwriters want administrators to use separate accounts from their daily ones, unique local administrator passwords, a password vault, and the smallest practical number of domain administrator accounts. Segmentation keeps one infected workstation from reaching servers and backups. Both limit how far a single stolen password goes.

Email security, training and payment controls

Filtering and sandboxing stop some malicious messages. Sender authentication records (SPF, DKIM and DMARC) make it harder to spoof your domain. Training and phishing simulations address the rest. For fraud, the control carriers care about is procedural: a call-back to a known number before changing bank details, and a second approver on wires. IOA's 2026 outlook says social engineering limits are returning to $1 million or more for insureds that can show strong payment authentication. See business email compromise and funds transfer fraud coverage.

An incident response plan

The plan names who decides, whom to call first (the policy hotline), how to isolate systems and where the offline contact list is kept. CISA recommends a plan approved in writing by the chief executive, exercised regularly and stored in hard copy. building an incident response plan your insurer will like shows what insurers look for.

Control by control: what to show

What happens if you are missing some

The carrier has several tools short of saying no. It can restrict ransomware coverage with a sublimit or coinsurance (ransomware sublimits and coinsurance in cyber policies), raise the retention, shorten the business interruption period, or bind subject to conditions with deadlines. Some forms also make coverage depend on maintaining the controls described in the application, so read the conditions and exclusions in your wording and ask your broker what happens if a control lapses mid-term. Misstating a control is far riskier than lacking it. See insurance applications: why accuracy matters and what misrepresentation costs.

A 90-day order of work

Say a 25-person engineering firm has weak answers across the board. This sequence tackles the most common attack paths first. It is an illustration, not a guarantee of any carrier's terms.

1. Weeks 1 to 2. Require MFA on email and on every administrator account. Remove shared admin logins. Use an authenticator app or hardware key instead of text messages where you can.
2. Weeks 2 to 4. Close remote desktop exposure and require MFA on the VPN and on any vendor access. Find and patch internet-facing systems and retire what is unsupported.
3. Weeks 3 to 6. Move backups to an immutable or offline copy with separate credentials, and run a full restore test of a critical system. Time it and write down the result.
4. Weeks 5 to 8. Deploy EDR to all endpoints and servers and decide who watches alerts after hours, in-house or through an MDR provider.
5. Weeks 8 to 12. Write the incident response plan, add the call-back and second-approver rule for payments, run one phishing simulation and one tabletop exercise.

Then fill out the application with evidence for each answer, and run the cyber insurance readiness checklist first. The effort pays twice: it improves the quote, and it makes the incident the policy exists for less likely.

Key takeaways

• Insurers focus on MFA, EDR, protected and tested backups, patching, privileged access, email and payment controls and an incident response plan, the same set the FBI and CISA recommend.
• Scope decides the answer: MFA on all access paths, EDR on all machines and watched, and backups tested by an actual restore.
• CISA ranks phishing-resistant methods highest and text-message codes lowest, so choose the second factor deliberately.
• Missing controls usually mean sublimits, coinsurance, conditions or declination, but misstating a control is more dangerous than lacking it.
• Work in order of attack path, collect evidence as you go and keep it with your application file.