Cyber Insurance Requirements in 2026
Cyber insurance applications and renewals vary by carrier, policy and business. This guide explains common control and evidence topics to review with your broker, insurer and legal advisers before you answer an application.
Cyber insurance applications commonly ask about technical and governance controls, but the wording, evidence, pricing and underwriting decision vary by carrier and policy. Start with the actual application and proposed policy, then document the environment that is in scope.
Application answers should match the controls and evidence that actually exist on the stated date. Inaccurate or incomplete answers may affect underwriting, coverage or claim handling under the policy and applicable law. Confirm interpretation and disclosure duties with the broker, insurer and qualified legal counsel; North Star does not decide coverage.
What cyber insurance covers, and what it excludes.
Examples of coverage categories to discuss with your broker or insurer include:
- Incident response and forensics. The specialists who figure out what happened and contain it.
- Legal counsel and notification costs. Covered costs depend on policy wording; applicable notification duties depend on the organisation and law. Our compliance hub links related guidance; obtain qualified advice on specific legal duties and coverage.
- Business interruption. Lost income while systems are down during recovery.
- Data restoration. The cost of rebuilding systems and recovering data.
- Third-party liability. Claims from customers or partners whose data you exposed.
- Cybercrime riders. Funds-transfer fraud and social engineering losses, often sub-limited and sometimes sold separately.
Exclusions, sub-limits, consent requirements, sanctions issues and ransom-related wording vary by policy and can change. Review the current wording with the broker, insurer and qualified legal counsel before an incident; do not infer coverage from a general guide.
Eight common control and evidence topics to review.
The actual application controls. Use these topics to prepare evidence, then answer only the question asked and record any scope or exception.
MFA on email, remote access, and admin accounts
A common evidence question: whether MFA is enforced for the accounts and access paths named in the application, with any exclusions or break-glass process documented.
Evidence may include: policy configuration, account coverage, exception records and testing that match the exact scope of the application answer.
Why accuracy matters: an undisclosed MFA gap can conflict with the application record. Policy consequences depend on the facts, wording and applicable law, so preserve evidence and ask the broker or insurer how exceptions must be disclosed.
EDR coverage and endpoint exceptions
A common evidence question: which workstations, servers and other endpoints are covered by the stated endpoint control, and how exclusions are recorded. See our EDR vs antivirus guide for terminology.
Evidence may include: an asset inventory, deployment report, alert-handling workflow and documented exceptions that reconcile to the answer given.
Why accuracy matters: deployment evidence can be compared with the application answer. Disclose known exclusions and ask the broker or insurer how the wording applies; this guide cannot determine a claim outcome.
Backup protection and restore-test evidence
A common evidence question: can an attacker who gains admin access encrypt or delete your backups, and when did you last actually restore from them.
Evidence may include: dated backup configuration, the offline or protected immutable copies actually in use, retention/deletion permissions and restore-test results. Check which privileged accounts can change or delete each copy rather than treating a storage label as proof of recovery protection. Review the Cyber Centre's backup access and restore-testing guidance and our 3-2-1 rule guide; the application's exact scope still controls the answer.
Why accuracy matters: failed or untested backups can increase operational loss. Keep restore-test evidence and confirm what records the application or policy requires.
Patch cadence
A common evidence question: how patches and vulnerabilities are prioritised and whether the process meets the timeframe stated in the application.
Evidence may include: a patch management tool (Intune or an RMM) with compliance reporting, and a written note for anything you deliberately cannot patch and why.
Why accuracy matters: patch records may be compared with a stated cadence. Document exceptions, compensating controls and dates rather than answering beyond the evidence.
Security awareness training and phishing simulation
A common evidence question: which people, training activities, frequency and reporting period are named in the application, and whether the current records support that answer. Do not infer that one course, date or simulation automatically meets or fails every insurer's requirements.
Evidence may include: an enrolment list, completion records and simulation results where those activities are in scope. North Star can provide the records included in the selected managed training service.
Why accuracy matters: missing records can conflict with an application answer. Confirm the required population, frequency and evidence with the broker or insurer.
Incident response plan
A common evidence question: is there a written plan naming who does what in an incident, and has it been tested rather than filed and forgotten.
Evidence may include: a plan with named roles, contact paths, insurer instructions and exercises at the frequency required by the application or the organisation's risk plan. See incident response for scoping considerations.
Why accuracy matters: some policies require notice, consent or specified providers. Record those instructions in the plan and confirm them with the insurer before an incident.
Logging, monitoring, or MDR
A common evidence question: if something fires an alert at 11 p.m. on a Saturday, does anyone see it, and are logs retained long enough to investigate afterwards.
Evidence may include: logging sources, retention and monitoring hours that match the wording in the application and selected service.
Why accuracy matters: monitoring records and escalation coverage should match the hours and responsibilities stated in the application; do not describe on-call or alerting as continuous monitoring unless that is the documented service.
Unsupported software and documented exceptions
A common evidence question: whether in-scope hardware or software is outside vendor support and how those items are isolated, upgraded or disclosed.
Evidence may include: a current hardware/software inventory, vendor support status and a replacement or risk-treatment plan with owners and dates. For any retained end-of-life system, document assessed safeguards, dependencies and known exceptions; ask the broker or insurer how the current application requires them to be disclosed.
Why accuracy matters: an undisclosed unsupported system can conflict with the application record. Document the asset, safeguards and disclosure rather than predicting an underwriting or claim result.
Only say yes when it is true.
Application answers, policy wording and applicable law determine the consequences of an inaccurate statement or a control that later changes. Keep dated evidence, record exceptions and notify the broker or insurer when a material answer may no longer be accurate. Obtain legal advice for disclosure and coverage questions.
When current evidence does not support a yes answer, document the gap and ask the broker or insurer how it should be addressed or disclosed before submission. North Star is not an insurer or legal adviser and cannot determine eligibility, pricing, coverage or claim outcomes. We break down common questionnaire topics in our 2026 cyber insurance questionnaire walkthrough.
How these controls map to a managed IT plan.
Many controls require ongoing ownership: policy review, alert handling, restore testing, training records, asset inventory and incident-plan maintenance. Decide who owns each task, how often it is performed and what evidence is retained; a managed plan is one option, not an insurance guarantee.
North Star can scope MFA, endpoint protection, patching, backup, awareness training, monitoring and incident planning under a written proposal. Inclusions, exclusions, support hours, retention, testing and evidence outputs depend on the selected agreement. Review our published pricing, then confirm the exact control scope before relying on it in an application.
Confirm evidence outputs before selecting a service. A managed agreement does not by itself establish that a particular export, historical record or restore test exists. Identify who retains each record, the period it covers and how gaps or exceptions will be reviewed before answering the current questionnaire. Our cybersecurity hub covers each control in more depth if you want to go service by service.
What to gather 60 to 90 days before renewal.
Start before the broker sends final forms. A review package may include:
- Last year's completed application for comparison, while answering the current form from current evidence.
- An MFA policy export showing enforcement, not just availability.
- An endpoint deployment report reconciled to the in-scope inventory and documented exceptions.
- Backup restore test logs with dates and outcomes.
- A patch compliance report from your management tooling.
- Training enrolment and authorised simulation records for the period requested in the application.
- Your incident response plan with its last revision and test date.
- A hardware and software inventory flagging anything approaching end of life.
- Details of any monitoring or MDR arrangement, including retention periods.
- Honest disclosure of any incidents or near-misses since the last application.
Use the list to identify evidence gaps before submission. North Star can assess the agreed technical scope, propose remediation and document completed work; the broker, insurer and legal advisers remain responsible for interpreting the application and policy. Start with a cybersecurity assessment or call 672-983-1174.
Build a reviewable record, not a folder of screenshots.
There is no universal cyber insurance evidence pack. The current insurer application, requested period and proposed policy determine what is relevant. A practical working pack can use an index with one row per question or control and these fields:
- Requirement and source: quote or reference the application question, renewal request or policy wording being reviewed.
- Scope: identify the people, accounts, devices, systems and locations covered by the answer.
- Owner and review date: name who verified the evidence and when it was checked.
- Evidence location: link to the policy, configuration export, inventory, report, test record or signed service scope that supports the answer.
- Exceptions and next action: record exclusions, compensating measures, remediation owners and target dates without changing an answer beyond what the evidence supports.
Three useful renewal-readiness priorities
- Verify access: reconcile MFA enforcement for the exact email, remote-access and privileged-account scope named in the application.
- Reconcile protection: compare the current asset inventory with EDR or endpoint-control deployment and document every known exception.
- Prove recovery: retain backup configuration and dated restore-test results that show what was restored, when it was tested and whether follow-up work remains.
Store sensitive exports in an access-controlled location and give the broker or insurer only the records they request through an approved channel. Recheck the pack immediately before submission because users, devices, settings and service scope can change.
Use insurer wording first, then validate the security baseline.
This guide is not insurance or legal advice. For security planning, review the Canadian Centre for Cyber Security's Baseline cyber security controls for small and medium organizations and top measures for small and medium organizations. For insurance decisions, the current application and policy wording control.
Quick answers.
What does cyber insurance cover?
Coverage categories, limits, deductibles, exclusions, sub-limits, consent requirements and service providers vary by policy. Review the proposed wording with the broker, insurer and qualified legal counsel.
What controls does cyber insurance require in 2026?
Applications vary. Common evidence topics include identity and access, endpoint coverage, backups and restore tests, patching, awareness, incident planning, logging, monitoring and unsupported systems. The actual application controls.
Will cyber insurance cover ransom payments?
Ransom-payment wording, exclusions, consent requirements and sanctions issues vary. Confirm the current policy with the broker, insurer and qualified legal counsel before an incident.
How much does cyber insurance cost?
There is no reliable universal price range. Premiums, limits, deductibles and terms depend on the organisation, application, claims history, market and policy. Obtain current quotes from licensed brokers or insurers.
What happens if I answer the questionnaire inaccurately?
Inaccurate or incomplete answers may affect underwriting, coverage or claim handling under the policy and applicable law. Answer only from current evidence, retain dated records and seek broker or legal advice on disclosure.
What is the single most important control for cyber insurance?
There is no universal single control or automatic coverage rule. MFA is a common security and application topic, but the actual questionnaire and policy determine the required scope and evidence.
Can North Star help me meet the controls?
North Star can assess and implement supported controls and provide evidence for work included in the selected agreement. The insurer or broker decides whether that evidence satisfies an application; no service guarantees coverage or claim payment.
Want a score instead of a checklist? Take the free cyber insurance readiness scorecard: ten questions, instant fix-first list, nothing sent or stored.
More guides
Can your current answers be supported by evidence?
Request a scoped cybersecurity assessment to compare agreed technical controls with your current records and identify evidence or remediation gaps. Insurer, application and policy requirements vary; North Star is not an insurer or legal adviser and does not determine eligibility, coverage, discounts or claim outcomes.
Scope a Cybersecurity Assessment More guidesResearch expansion
Evidence before renewal
Prepare identity, MFA, endpoint, backup, email, vulnerability, training, incident-response, vendor, and recovery evidence before completing an insurance questionnaire. Answer using current operating evidence, not intended future controls.