You Checked Yes on the Cyber Insurance Questionnaire. Can You Prove It?

Fourth quarter rolls around and a cyber insurance application or renewal packet lands on the office manager’s desk. It asks about multifactor authentication, endpoint protection, tested backups, and how fast a departing employee loses access. Someone checks the boxes based on what they believe is true.

We hear the honest version of this constantly. One Monterey County investment adviser put it plainly when reaching out to us: “I try my best to be cyber-safe, but I want to be sure I’m doing what I can to protect my clients’ data.”

This is not a scare piece. It is a control-by-control look at what proof a carrier actually expects, and exactly what to ask for so your yes answers come with a document and a date behind them.

Why Cyber Insurance Requirements for Small Business Got Harder to Answer

Ten years ago, a cyber policy application was a page long and mostly about revenue. Today it reads like a security audit, because carriers learned which controls actually stop claims.

That matters for one reason worth sitting with: the answers on an insurance application are statements the carrier relies on when it prices and issues the policy. If a control was not really in place at the time of a loss, that becomes a conversation you do not want to have during a claim.

The timing makes it worse locally. Q4 renewals land in the same weeks Monterey Bay businesses are building next year’s budget, so a premium jump gets noticed fast.

• Monterey County agricultural production value came in at $4.82 billion in 2025, down about 3 percent from the prior year
• Growers, packers, coolers, and the accountants, attorneys, and equipment shops that serve them are all watching fixed costs
• A policy that gets repriced or declined over an undocumented control is not a small line item

Financial advisers, law offices, and nonprofits in the region feel this on top of their existing obligations. If you are in a regulated field, our breakdown of IT and cybersecurity requirements for financial firms in the Monterey Bay Area covers where insurance questions and regulator questions overlap.

The MFA Question Is Really Four Questions

A modern application does not ask whether you “use MFA.” It asks where. Carriers generally want a second factor in four places:

• Email, including webmail and mobile access
• Remote access, meaning VPN and any remote desktop connection
• Any cloud app holding business data, such as your accounting, practice management, or file storage platform
• Administrator accounts, which is where most small offices come up short

The gap we find most often in Salinas and Monterey offices is the same one every time: every user mailbox is protected, but the Microsoft 365 global admin account is not. That is the single login an attacker would most want.

Several carriers have also stopped accepting text message codes as satisfactory for privileged logins, and prefer an authenticator app or a physical security key. Federal guidance points the same direction, urging businesses to confirm MFA on all remote and administrative access and to favor phishing-resistant methods. You can read the CISA guidance on requiring multifactor authentication for the plain-language version.

Here is how to check it without becoming a technician. Ask whoever handles your IT for a conditional access policy export or a sign-in policy report showing which accounts are covered and which factor types are allowed. A verbal “yes, you’re covered” is not something you can attach to an application.

Antivirus and EDR Are Not the Same Thing

The questionnaire asks about endpoint detection and response (EDR). Most owners answer using the antivirus that came with the computer. Those are different products doing different jobs.

Antivirus compares files against a list of known bad software. EDR watches behavior on the machine, flags things like a program suddenly encrypting files or an unusual admin login, and sends an alert to a human who reviews it.

That is why applications now ask two separate questions:

• Is EDR installed on every workstation and server?
• Are the alerts monitored around the clock, not read the next business day?

In offices that grew one computer at a time, and that is most small businesses here, coverage is almost always partial. The three newest laptops have an agent. The old front desk machine and the server in the hall closet do not.

An honest answer requires seeing the device list. A real coverage report shows every device by name, whether the agent is installed, when it last checked in, and which machines are reporting nothing at all. If the report shows five devices and you have eleven, you have your answer.

Partial coverage is one of the patterns we write about in five cybersecurity gaps that keep showing up in small business networks.

Turning a Shaky Yes Into a Documented One

Four controls drive most of the questions on a cyber application. This shows the proof that backs each one up.

The Backup Question Is the One Most Often Answered on Faith

Every application asks whether your backups are tested. This is the question we see answered yes with the least evidence behind it.

A very common situation around here: the office manager inherited a backup system a previous technician set up years ago. Emails arrive saying the job completed. Nobody has ever watched a single file come back.

A completed backup job is not a tested restore. Underwriters know the difference, and they are asking about three specific things:

• A dated restore test. When did someone last pull real data back, and what was the result?
• Where the copies live. Is there a local copy for fast recovery and a separate offsite copy for a true disaster?
• Whether a compromised admin account could delete them. If your backups can be wiped with the same credentials an attacker stole, they are not really a recovery plan.

There is a concrete way to verify this in one week. Ask your provider to restore one real file and one full machine into a test environment, then put the date, what was restored, how long it took, and the result in writing.

That single document is the evidence the carrier wants, and it is the same document that tells you whether you would survive a ransomware Monday. We go deeper on what a plan contains in does your business have a real data recovery plan, or just backups?

One more trap worth knowing: if your answer relies on cloud email, read Microsoft 365 does not back up your data before you check that box.

What to Ask For, Control by Control

Print this and hand it to whoever manages your systems. Each row turns a belief into a document you can file.

Patching Is Where the Math Just Shifted

For years, stolen passwords were the top way attackers got in. That changed. The 2026 Verizon Data Breach Investigations Report found that unpatched software vulnerabilities passed stolen credentials as the leading entry point, accounting for roughly 31 percent of breaches.

The follow-up number explains why underwriters care so much. Only about 26 percent of known exploited vulnerabilities were remediated during 2025, down from 38 percent the year before. Attackers are walking through doors that were reported, documented, and left open.

So applications now ask who applies patches, how often, and how you prove it. A small Central Coast business owner we spoke with ran straight into that last part when he needed written proof of patch updates on short notice and had nowhere to get it.

Fix that with a folder, not a project. Keep a simple dated evidence folder that holds:

• Your MFA or conditional access policy export
• The current endpoint coverage report
• The last three monthly patch reports
• The most recent restore test result
• Your written offboarding steps

Refresh it once a quarter and the renewal packet becomes a copy-and-paste job instead of a guessing game. And anything you are unsure about is worth confirming with both your IT provider and your broker before you sign, because a corrected answer costs a phone call while an inaccurate one can cost a claim. If you want a baseline to measure against first, start with what a real cybersecurity baseline looks like for a small business.

Frequently Asked Questions About Cyber Insurance Requirements