Getting cyber insurance used to be straightforward. Fill in a form, answer a few questions, get a quote.

That’s changed.

Insurers like CFC are no longer just selling policies. They’re assessing how likely you are to claim and that means digging into your cyber security in detail.

If you’ve seen a modern application form, you’ll know exactly what I mean.

Why CFC (and others) are asking tougher questions

Cyber attacks are getting more frequent and more expensive. Insurers have paid out heavily over the past few years, especially around ransomware and business interruption.

So underwriting has shifted from:

• “Do you have antivirus?”
  to:
• “Show us how you actually prevent, detect and recover from attacks.”

CFC themselves highlight that cyber threats are evolving quickly and businesses need stronger controls to reduce risk.

At the same time, insurers now assess your overall cyber security posture before offering or renewing cover.

What CFC is really checking (in plain English)

CFC’s application process and supporting material show a clear pattern:

They’re not just ticking boxes.
They’re testing whether your business can:

• stop common attacks
• detect threats early
• recover quickly
• prove it

Let’s break that down.

1. Identity & access (MFA is no longer optional)

One of the first things insurers look for is how you control access.

Typical expectations:

• MFA on email accounts
• MFA on remote access (VPN, RDP, cloud apps)
• MFA on privileged/admin accounts

Across the industry, MFA is now considered a baseline requirement for cover.

Why? Because most breaches start with stolen credentials.

If MFA isn’t enforced properly, you’re seen as high risk.

2. Endpoint protection (and not just antivirus)

Insurers are moving away from basic antivirus questions and toward:

• Endpoint Detection & Response (EDR)
• Coverage across all devices
• Ability to isolate compromised machines

Modern underwriting expects visibility and response, not just prevention.

If you can’t say:

“Yes, every device is protected and monitored”

…you’ll struggle.

3. Patch management & vulnerability control

This is one of the most common failure points.

Insurers want to know:

• How quickly you patch critical vulnerabilities
• Whether you run vulnerability scans
• Whether unsupported (end-of-life) systems exist

Timely patching is now a core underwriting expectation.

If systems are outdated or unmanaged, insurers see that as an open door.

4. Email security & human risk

Email is still the main entry point for attacks.

So insurers are asking about:

• Email filtering solutions
• Phishing simulations
• Staff awareness training
• MFA on email accounts

Employee error is a leading cause of breaches, which is why training and phishing protection are now standard requirements.

5. Backups (and proving they actually work)

It’s not enough to say:

“We have backups”

Insurers want detail:

• Where backups are stored (cloud, offline, immutable)
• Whether they are protected (e.g. MFA, segregation)
• How often they are tested
• Whether full restores are possible

This is critical because ransomware often targets backups directly.

6. Monitoring & incident response

This is where insurers are getting more serious.

They’re looking for:

• Monitoring (SOC, SIEM, or managed detection)
• Incident response plans
• Ability to respond quickly to threats

Many policies now expect a documented incident response plan as part of baseline security.

7. Evidence (this is the big shift)

This is the part most businesses underestimate.

It’s no longer:

• “Do you have MFA?”

It’s becoming:

• “Show us where it’s enabled”
• “Show us coverage reports”
• “Show us backup test results”

Underwriting is moving from trust → proof.

And that affects:

• pricing
• acceptance
• claims later on

What happens if you don’t meet these requirements?

It’s not always an outright “no”.

More often, you’ll see:

• higher premiums
• exclusions in the policy
• limited cover for ransomware or business interruption
• difficult renewal conversations

In some cases, failure to meet requirements can impact claims outcomes if controls weren’t in place.

The reality for most SMEs

Most businesses fall into one of these:

• “We have some of this, but not everywhere”
• “We think we have it, but not sure”
• “Our IT provider handles that… probably”

That’s exactly where insurers are focusing.

What this means for your business

Cyber insurance is no longer just a financial product.

It’s now closely tied to:

• your cyber security maturity
• your ability to evidence controls
• your ability to respond to incidents

Strong security doesn’t just reduce risk – it directly affects your ability to get cover and what you pay for it.

The takeaway

If you’re applying for cyber insurance today, expect questions around:

• MFA coverage
• endpoint protection
• patching
• backups
• monitoring
• incident response

And expect to back those answers up.

Because insurers like CFC aren’t just asking:

“Are you secure?”

They’re asking:

“Can you prove it?”