Cyber Insurance Readiness Checklist for Small Businesses
Last updated: October 2026
Cyber insurance applications used to feel like a short form. Many now read like a technical audit. Carriers ask whether multi-factor authentication covers email, remote access, and privileged accounts. They ask about endpoint detection, backup immutability, phishing controls, and whether anyone has ever restored from backup on purpose.
This article summarizes common controls. Requirements vary by carrier and by the size of your business. Jack Creager Tech Services is not an insurance agency and does not sell insurance. Talk to a licensed broker about coverage. Use this checklist to prepare the technical evidence they will ask you for.
Common controls insurers expect
- MFA everywhere it matters. Email, VPN or other remote access, and admin accounts at minimum. MFA on email alone is a frequent gap.
- EDR on endpoints. Modern endpoint detection and response on workstations and servers, not only consumer antivirus.
- Protected, tested backups. Off-site or immutable copies, plus proof that a restore was performed recently.
- Email security. SPF, DKIM, and DMARC configured; phishing protection enabled.
- Patching routine. A defined cadence for OS and critical apps, with ownership assigned.
- Written incident response plan. Even a short one-to-two page plan beats "we will figure it out."
- Security awareness training. A documented session so staff recognize phishing and know whom to call.
Printable checklist table
| Control | In place? | Evidence to keep |
|---|---|---|
| MFA on email | Yes / No / Partial | Admin screenshot of MFA policy |
| MFA on remote access | Yes / No / N/A | VPN or RMM MFA settings |
| MFA on admin accounts | Yes / No | List of privileged users |
| EDR deployed | Yes / No | Console showing device count |
| Backup restore tested | Date: ____ | Short restore report |
| Email auth (SPF/DKIM/DMARC) | Yes / No | DNS records summary |
| Incident response plan | Yes / No | PDF in shared drive |
| Staff training | Date: ____ | Attendance note |
Common mistakes
Partial MFA. Turning on MFA for some mailboxes while shared or admin accounts remain unprotected is a classic flag. Attackers target the exception.
Untested backups. A nightly job that has never restored a file is a hope, not a control. Ransomware operators know this and go after backup consoles.
Shared admin accounts. One password on a sticky note for "the IT login" fails both security and audit narratives. Use named accounts and a password manager.
Assuming the questionnaire is optional. Brokers can often still shop coverage, but gaps change premiums, deductibles, or eligibility. Preparing evidence early reduces last-minute scrambles before renewal.
How to use this before renewal
Start 60 to 90 days before your renewal date when possible. Inventory controls, fix the gaps that are cheapest relative to risk (usually MFA and email authentication), then schedule backup testing and a short staff session. Keep screenshots in a single folder. That folder becomes your Security Evidence Pack.
If you want a fixed-price readiness sprint that produces that pack for a Chicagoland small business, book a free IT checkup and bring your renewal date.