Cyber Insurance Readiness Checklist for Renewals and First-Time Applications: Controls, Evidence, and Coverage

Q1: What Does Cyber Insurance Actually Require in 2026, and Why Do Claims Still Get Denied?

Cyber insurance in 2026 requires three non-negotiables for eligibility: multi-factor authentication (MFA) on all remote and email access, EDR (endpoint detection and response) on every endpoint and server, and immutable, restore-tested backups. Supporting controls like privileged access management, email authentication, incident response plans, patching, and vendor risk shape your premium. Claims get denied when your deployed reality fails to match what you attested on the questionnaire.

The fear nobody says out loud

I have sat across from a lot of CISOs who signed a policy and quietly wondered if it would ever pay. That fear is earned. As one practitioner I trust put it, “most people are afraid of cyber insurance either not picking up the tab,” because there are “consistent publications of insurance not paying out.”

Here is the hard part. The questionnaire is paper. The breach is real. Underwriters now look for the gap between the two, and that gap is where claims die.

Why “compliant” and “secure” are not the same thing

Good compliance does not mean you are secure. I have watched companies pass an audit on Friday and get ransomed on Monday, and the disconnect still surprises boards.

A signed policy describes controls you promised to run. A denied claim happens when a forensic team finds those controls were partial, misconfigured, or switched off. The document said yes. The server said no. This is why our incident response team starts every engagement by checking what is actually deployed.

What the threat data says you actually need

The control list is not arbitrary. It maps directly to how breaches happen.

• Ransomware appeared in 44% of breaches in the 2025 Verizon DBIR, which is why backups and EDR are gates.
• Stolen credentials drove 22% of breaches, which is why MFA sits at the top of every form.
• Vulnerability exploitation hit 20% of breaches, often on exposed edge devices, which is why patching matters.

Each required control answers a specific attacker move. That is the logic underwriters price against, and it mirrors the priorities in our cybersecurity budget planning for mid-market firms.

What real readiness looks like

Readiness is operational fidelity, rather than a binder of policies. It means MFA is actually deployed across 100% of accounts, your EDR console proves coverage, and you have a dated restore test you can hand over.

The gap most teams miss sits between an attested control and a deployed one. At UnderDefense, we map a client’s live stack to their policy language before the underwriter does, so the answer on the form matches the answer in the logs. The next section breaks down the exact controls they check first.

Q2: Which Security Controls Do Underwriters Check First (The Core Checklist)?

Underwriters check eight controls first: MFA on remote, email, and admin access; EDR on all endpoints and servers; immutable, restore-tested backups; email authentication (SPF/DKIM/DMARC at reject); privileged access management (PAM); a documented, tabletop-tested incident response plan; patch management with SLAs; and vendor risk management. Network segmentation and RMM (remote monitoring and management) hardening sit close behind. The first three are usually hard eligibility gates.

The eight controls, and why each one earns its place

Here is the checklist I would hand a CISO before they touch the application. Each control answers a real attacker move, so I have folded the “why” into the table below, which connects directly to our MDR service.

#	Control	What it is	Why underwriters care
1	MFA	A second login factor on remote, email, and admin access	Blocks stolen-credential attacks, which drove 22% of breaches
2	EDR	Software that detects and stops threats on endpoints and servers	Catches ransomware before it spreads
3	Immutable backups	Backups that cannot be altered, plus a dated restore test	The only real recovery path after lockout
4	Email authentication	SPF, DKIM, and DMARC set to “reject”	Stops spoofing and business email compromise
5	PAM	Tight control over admin accounts	Limits blast radius when one account falls
6	Incident response plan	A written, tabletop-tested playbook	Proves you can react, rather than improvise
7	Patch management	Fixing flaws on a clock, tied to CISA’s KEV catalog	Closes the 20% of breaches from exploits
8	Vendor risk	Checking your suppliers’ security	Third-party involvement hit 30% of breaches

The question underwriters should ask but rarely do

Here is where I get a little contrarian. The form asks, “Do you have MFA?” Almost everyone says yes. As one operator put it, the honest version is “do I have MFA on one account?” The right question is “what’s the deployment percentage you have?”

I have seen the same gap on penetration testing engagements. We find an eight-character lowercase password that contradicts the stated policy, and suddenly you have an implementation problem, rather than a policy problem.

Where a deployed control beats a checked box

A control only counts when it fires. Microsoft research found MFA cut compromise risk by 99.22%, but that number assumes real coverage and the right settings.

Where monitoring-only tools stop at deploying EDR, UnderDefense tunes detection with custom correlation rules through UnderDefense Agentic AI SOC, so the control you attest to is the control that actually fires. Treat SOC service coverage as more than a device count. The next question is how you prove all of this on paper.

Q3: How Do You Prove Each Control With Real Evidence (Not Just Paper Policies)?

Each control needs an artifact, rather than an assertion. MFA maps to an identity-provider coverage report showing enrollment percentage across Microsoft Entra ID or Okta. EDR maps to a console export of deployment coverage. Backups map to a dated restore-test log. Email maps to an external DMARC record at “reject.” Incident response maps to a signed plan plus the last tabletop after-action report. Assemble these into one evidence binder before the questionnaire arrives.

Why technologists hate this part (and why it still matters)

I will be honest about a bias I share with most engineers. As one practitioner said, compliance can feel like “a tedious, pointless exercise of producing paper,” and “us hardcore technologists, we’ve never liked to document anything.”

But the binder is what turns a yes/no into proof. When a claim is contested, the artifact is the difference between a payout and a denial. Paper does not protect you. Evidence does, which is the foundation of our compliance services.

The evidence binder, control by control

This is the table I wish more teams built before renewal season. The “where it lives” column is the part people skip, and it is the part that saves you at 5 p.m. on a deadline.

The Evidence Binder, Control by Control

Control	Evidence to show	Where it lives	How carriers verify
MFA	Coverage report with enrollment %	Entra ID / Okta admin console	May request export; checks login surfaces
EDR	Deployment coverage export	EDR console	External scan for agents
Backups	Dated restore-test log	Backup platform	Requested at renewal or post-claim
Email auth	DMARC record at p=reject	Public DNS	External DNS scan
PAM	Admin account inventory	IdP / PAM tool	Documentation request
Incident response	Signed plan + tabletop report	GRC repo	Requested post-claim

The inventory problem that breaks binders

Here is the quiet struggle behind every binder. You cannot prove coverage on assets you cannot see. The two things teams consistently get wrong are “having one good asset inventory and two good software inventory,” especially once cloud sprawl sets in.

UnderDefense assembles this evidence binder as a byproduct of monitoring. Coverage reports, detection logs, and restore validation come from the platform, so the proof is current rather than reconstructed the night before. Our cloud security services close the inventory gap that breaks most binders. Customers tell us this is exactly where the audit pain drops:

“They’ve also made our audit process much less painful. The reports from their platform give us clear evidence of our security controls and incident response capabilities. When auditors or clients ask questions about our security posture, we can pull up exactly what they need to see.”
Verified User in Marketing and Advertising, Small-Business UnderDefense G2 Verified Review

One warning before you submit. Misrepresenting a control, even by accident, is among the most common reasons claims get denied. Make the binder match reality.

Q4: What’s Different for First-Time Applicants vs. Renewals?

First-time applicants are graded on eligibility gates. Missing MFA, EDR, or tested backups often means no quote at all. Renewals are graded on trajectory. Underwriters compare this year’s deployment percentages and incident history against last year’s attestation, and gaps or a prior claim drive premium increases of 20% to 40% or non-renewal. First-timers prove a baseline exists. Renewers prove the baseline matured.

Two journeys, two scoreboards

A first application is a pass/fail door. A renewal is a performance review. Knowing which one you are in changes what you prepare and where you spend, which is why our virtual CISO advisory maps spend to the right journey.

First-Time Applicants vs. Renewals

Dimension	First-time applicant	Renewal
What’s evaluated	Do the core controls exist	Did controls improve year over year
Eligibility gates	No MFA, EDR, or backups means no quote	Backsliding can trigger non-renewal
Premium drivers	Baseline maturity	Deployment %, incident history, prior claims
Timeline	Build evidence from scratch	Show the delta since last year
Common pitfall	Overstating partial coverage	Letting a control quietly lapse

A prior claim or a visible gap can push premiums up 20% to 40%, and in tough segments far higher.

The “one neck to choke” problem

Here is a belief I hold strongly. As a leader, when there is a problem area, “I want someone thinking about it holistically.” Fragmented tools across renewals leave seams, and seams are where attestations drift from reality.

I have watched the worst version of this play out. A CISO told me he was “being pressured by my general counsel and CEO to sign a letter saying we’re fully clean and recovered from this ransomware,” while he believed they were only halfway done. That is what renewal scrutiny looks like after an incident, and one accountable owner running continuous security monitoring prevents it.

Where a single accountable partner helps

Whether it is your first policy or your fifth renewal, UnderDefense gives you one accountable team owning detection, response, and the evidence trail across every cycle. Customers describe that continuity directly:

“Their adherence to SLAs gives me confidence in our infrastructure’s protection. As the Information Security Director, it lets me focus on strategy, knowing the day-to-day security is managed effectively.”
Oleg K., Director of Information Security, Mid-Market UnderDefense G2 Verified Review

Once you know which journey you are in, the next move is timing. The following section lays out the 90-day runway before your renewal date.

Q5: How Do Your Existing Frameworks (NIST CSF 2.0, ISO 27001, SOC 2) Map to Underwriting Controls?

Most underwriting controls already live inside frameworks you may hold. MFA, PAM (privileged access management), and access management map to NIST CSF 2.0 Protect and ISO 27001 Annex A access controls. Incident response maps to NIST SP 800-61. Backups and recovery map to CSF Recover. A SOC 2 Type II report or PCI DSS 4.0 attestation can supply much of the evidence, though each measures different things, so reuse the artifacts while answering the carrier’s specific questions directly.

Stop rebuilding evidence you already have

Here is a mistake I see at almost every renewal. A team treats the insurance questionnaire as a brand-new project, when half the answers already sit in their audit folders.

If you hold SOC 2 (a report on security controls) or ISO 27001 (an international security standard), you have done most of the work. The trick is mapping it, rather than redoing it, which is the core of our compliance services.

The crosswalk that saves you a week

This table is the one-page view I would put in front of a GRC (governance, risk, and compliance) lead before they start the form, alongside our compliance roadmap.

Underwriting Controls Crosswalk Across Frameworks

Underwriting control	NIST CSF 2.0	ISO 27001	SOC 2 / SP 800-61
MFA, access control	Protect (PR.AA)	Annex A 5.15, 8.5	CC6.1
PAM	Protect (PR.AA)	Annex A 8.2	CC6.3
Incident response	Respond (RS)	Annex A 5.24	SP 800-61
Backups, recovery	Recover (RC)	Annex A 8.13	A1.2
Patch management	Identify, Protect	Annex A 8.8	CC7.1

The board view hiding in NIST CSF

Here is a move I love for budget season. When you take NIST CSF, look at the risk families, and “allocate my budget dollars into those families,” that “one page visual can be really enlightening.” You might find you have “zero money being spent in a proactive capacity.”

That single page reframes a board conversation faster than any heat map, and it pairs well with our cybersecurity budget guidance for mid-market firms.

Where the mapping still needs a human

One honest caveat. Holding a framework eases the questionnaire, but it does not replace it. PCI DSS 4.0 became fully effective in March 2025, and carriers still ask their own pointed questions.

This is where UnderDefense’s virtual CISO service earns its keep, translating an existing ISO 27001 or SOC 2 program into the exact evidence an underwriter accepts. The next section explains why a clean framework still leaves a security gap.

Q6: Why Doesn’t ‘Yes/No’ Compliance Equal Real Security?

A “yes” to “Do you have MFA?” can hide a fleet of un-enrolled service accounts, missing impossible-travel rules, or an SMS fallback an attacker can phish. Underwriters score binary answers, while breaches exploit the gap between having a control and fully deploying and tuning it. Real security is measured by deployment percentage, detection tuning, and response speed: resilience that lets you predict, adapt, and recover.

The comfortable story we tell ourselves

Most boards believe a clean compliance report means the company is safe. I understand the appeal. The report is tidy, the auditor signed off, and everyone moves on.

That story gets the risk backwards. A passed audit describes a moment in time, while attackers work every other minute of the year, which is why we lean on continuous security monitoring.

The MFA example that exposes the gap

Take the most common question on any form. The honest version of “do you have MFA?” is often “do I have MFA on one account?”

The right question is “what’s the deployment percentage you have?” A control at 70% coverage with no impossible-travel rule still leaves a door open, even though the form says yes. Our penetration testing teams find these gaps constantly.

Why a measured imperfect control wins

Here is the part the category avoids. A control you measure beats a control you assume.

I borrow a mindset from AI testing. I would rather see where a model is biased so I can correct it, because the dangerous model is the one nobody is measuring. Security works the same way. Visibility into a flawed control beats blind faith in a clean checkbox. Peer-reviewed work backs this up: a Marsh analysis of eleven controls found MFA produced one of the smallest reductions in claims when deployment was inconsistent. Our SOC metrics approach is built on measuring what you actually run.

What to do with this on Monday

I told an insurance audience once that the industry is “so bad at evaluating and understanding the risk” because “you asked the wrong questions.” The fix is to measure what you run.

This is why UnderDefense reports deployment coverage and response times through UnderDefense Agentic AI SOC, the metric an underwriter should be asking for. Once you accept that, the 90-day runway below becomes your action plan.

Q7: What’s the 90-Day Readiness Timeline Before Your Renewal Date?

Start 90 days out: inventory assets, software, and current control coverage, then run a gap analysis against the carrier questionnaire. At 60 days, close the biggest gaps, finish MFA enrollment, fill EDR coverage on servers, and run a backup restore test. At 30 days, assemble the evidence binder and tabletop your incident response plan. At 14 days, review the completed questionnaire with your broker so no answer outpaces reality.

Why 90 days, and not 30

The reason teams miss renewals is simple. Implementing real change takes weeks, and a rushed form forces you to overstate coverage you have not finished.

Speed of change is the hidden variable here. If it takes your team weeks to deploy a control, you need the runway, so start early and work backwards from the renewal date with help from our incident response team.

The four phases, with the artifact each produces

Here is the playbook I would run with a CISO. Each step ends in something you can hand an underwriter.

1. 90 days out: Build a clean asset and software inventory, then map current control coverage. Artifact: a gap analysis against the questionnaire.
2. 60 days out: Close the big gaps. Finish MFA enrollment, fill EDR coverage on servers, and run a real backup restore test. Artifact: a dated restore-test log.
3. 30 days out: Assemble the evidence binder and run an incident response tabletop. Artifact: a signed after-action report.
4. 14 days out: Review the completed questionnaire with your broker. Artifact: a verified, submission-ready form.

One detail underwriters forget about

A practical tip from the trenches on data retention. Plan for at least 40 days of immediate online retention, and keep “about six weeks of data on hand on fast storage.”

Investigations need rapid access to recent logs. If your retention window is too short, your forensic story has a hole in it right when you need proof, which is why we run managed SIEM coverage with the right retention built in.

Where the runway gets shorter

Teams running UnderDefense Agentic AI SOC compress this 90-day scramble, because asset visibility, EDR coverage, and detection evidence stay live and current. The onboarding speed is something customers call out directly:

“The speed of onboarding was a delightful surprise. In times where integrating new systems can take weeks, UnderDefense had us up and running in no time.”
Valeriia D., Marketing Specialist, Mid-Market UnderDefense G2 Verified Review

Once the form is ready, you still need to know what the underwriter can check on their own. That is the next section.

Q8: Do Underwriters Really Verify Your Controls, and What Can They See Without Asking?

Increasingly, yes. Before quoting, carriers run external scans that detect deployed EDR agents, your DMARC and SPF DNS records, and exposed remote-access ports such as RDP (remote desktop protocol). Internal controls like backup configuration, MFA coverage, and access management may be requested as documentation at renewal or scrutinized forensically after a claim. Misrepresenting a control ranks among the most common reasons claims get denied, so attestation must match what scans and logs reveal.

The questionnaire is not the finish line

Many teams treat the form as the last step. It is the first one. Carriers now scan the outside of your network before they quote.

They can see exposed RDP ports, your public DNS records, and often whether EDR agents are live. Exposed edge devices and VPNs drove 22% of exploit-based breaches in the 2025 Verizon DBIR, so underwriters look there first, much like our attack surface management work does.

Where attested controls fall apart

Here is what surfaces when you actually run a test. On a pentest, we find “an eight-character lowercase password,” and if that contradicts the stated policy, “now you have an implementation problem.”

I have watched this go further. In one case, a flaw in an email server’s memcache component let an attacker redirect logins to their own server, and “more than 10 credential pairs were captured, including the administrative one.” The policy looked fine on paper. The implementation did not, which is why our web app penetration testing goes past surface scanning.

Why “we tested it once” is not proof

A note on testing honesty. When I validate an attack path, I run each test case “somewhere between five and 15 times” to confirm a true positive against a false one.

One clean run is not evidence. UnderDefense surfaces these implementation gaps through our MDR service before an underwriter’s scan, or an attacker, finds them. The next section weighs which security model actually satisfies a carrier.

Q9: Monitoring-Only Tools, Traditional MDR, or AI SOC + Human Ally: Which Satisfies Underwriters and Reduces Loss?

Monitoring-only tools and legacy MSSPs (managed security service providers) send alerts but leave you to investigate and respond, which underwriters increasingly treat as insufficient because alerts alone fail to shrink loss. Traditional MDR (managed detection and response) adds response, yet often prices by device count without custom correlation. An AI-SOC-plus-human-ally model detects, adds context, and responds fast. The claims data rewards this: managed detection-and-response users saw a 97.5% lower median claim value than endpoint-only setups.

The Blockbuster problem in security tooling

Here is my honest read after years of this. We have a lot of “Blockbuster video cyber security companies” that will struggle in two to three years, the way Netflix made the video store obsolete.

The reason is simple. A tool that only raises alerts pushes the hardest work, the response, back onto a lean team. That gap is exactly where claims grow, and it is the gap our MDR service was built to close.

Three models, side by side

This table compares the three options on the dimensions an underwriter and a CFO both care about. For a deeper breakdown, see our guide to MDR services.

Comparing Three Security Models on Underwriter-Relevant Dimensions

Dimension	UnderDefense Agentic AI SOC + Human Ally	Traditional MDR / MSSP	Monitoring-only tools
Detection	✅ Vendor-agnostic across your stack	✅ Strong on its own agents	✅ Alerts only
Response	✅ Concierge analysts act with context	❌ Often hands back alerts	❌ You respond alone
Pricing	✅ Transparent, plan-based	❌ Per-device, opaque	✅ Cheap upfront
Data ownership	✅ You keep your SIEM and data	❌ Frequent vendor lock-in	✅ Varies
SLAs	✅ 2-minute Alert-to-Triage, 15-minute critical escalation	❌ Vague response windows	❌ None

Why response speed shows up in claims

The scoreboard is brutal. If your team works 9 to 5 and attackers work 24/7, you will get your “butts kicked.”

A Sophos study of 282 insurance claims found that organizations using managed detection and response had a 97.5% lower median claim value than endpoint-only setups. The difference is the humans operating the response around the clock, rather than just the sensor on the box, a point we explore in our piece on whether AI kills or saves your SOC team.

What the human layer actually does

Automation handles routine triage at scale. Humans handle the edge cases that fool a model. Across alert data, roughly 28% of investigated alerts turned out legitimate, so the noise is real and the judgment matters.

UnderDefense Agentic AI SOC pairs that automation with concierge analysts, and customers feel the shift from noise to clarity:

“The biggest win for me was getting actual control over our security alerts. Before the guys from UD stepped in, we were getting bombarded with alerts. Their team cleaned up our configurations and got the noise under control within the first week.”
Verified User, Small-Business UnderDefense G2 Verified Review

“I used to work with many MDR solutions in the past, and so far Underdefense is the best one!”
Inga M., CEO, Mid-Market UnderDefense G2 Verified Review

The model you pick changes your loss math, which leads straight to the cost question.

Q10: How Much Do Control Gaps Cost: Premiums, Sublimits, Denied Claims, and the Ransom Question?

Missing controls raise premiums 20% to 40%, trigger ransomware sublimits (coverage caps below your policy limit), push you into surplus-lines pricing at two to three times standard, or cause non-renewal. The worst case is a denied claim. Average ransomware recovery ran about $1.4 million, and U.S. breach costs hit an all-time high of $10.22 million in 2025. Whether to pay a ransom stays a gray decision that depends on tested backups, downtime cost, and legal exposure.

The cascade most teams underestimate

A control gap rarely shows up as a flat “no.” It shows up as a worse deal.

• Premiums climb 20% to 40% on visible gaps or a prior claim.
• Ransomware coverage gets capped with a sublimit below your full limit.
• You may land in surplus lines at two to three times standard pricing, or face non-renewal.

What the numbers say about exposure

The exposure dwarfs the control spend. Average ransomware recovery cost roughly $1.4 million in recent data, and that is before reputation damage.

The 2025 IBM Cost of a Data Breach report put the global average at $4.44 million and the U.S. average at an all-time high of $10.22 million. I like a “fortress balance sheet” framing for this, a balance sheet built to manage risk and have a real conversation about what cyber can actually cost you. Our ransomware rescue case study shows that math in the real world.

The ransom question stays gray

People want a yes or no on paying. The honest answer is that it is “not binary,” but “a very gray area.”

If you have tested, recoverable backups, you rarely need to pay. If you do not, you feel forced to. I think of the practitioner who admitted his family “lost all of the family data for the past 20 years” because a home backup was never exercised. The lesson scales to the enterprise. In the 2025 Verizon DBIR, 64% of ransomware victims did not pay, and the median payment fell to $115,000. A tested ransomware response plan is what keeps that decision in your hands.

Resilience beats the 100% myth

No one wins cybersecurity outright. You build resilience: the ability to predict, adapt, and recover.

UnderDefense’s transparent MDR pricing lets you model control spend against exposure honestly, with no device-count surprises at renewal. The cheapest control is the one that keeps a claim from ever being filed, which is exactly where your Monday plan starts.

Q11: Your Monday-Morning Cyber Insurance Readiness Action Plan

Start this week. Confirm MFA deployment percentage rather than a yes/no, export EDR coverage across endpoints and servers, run and date a backup restore test, verify DMARC sits at “reject,” and pull your last incident-response tabletop report into the evidence binder. Then hand your policy to your security team and ask the question most companies never do: whether you truly meet every control in it, with proof.

Five moves before your next coffee refill

None of this needs a new budget. It needs a few hours and the will to look honestly.

1. MFA: Pull the coverage report and find your real deployment percentage. Artifact: an enrollment export.
2. EDR: Export agent coverage across endpoints and servers. Artifact: a deployment list with gaps flagged.
3. Backups: Run a restore test today and write down the date. Artifact: a dated restore log.
4. Email: Check that DMARC is set to “reject.” Artifact: a DNS screenshot.
5. Incident response: Find your last tabletop report. If there is none, schedule one with our incident response team. Artifact: an after-action note.

The one question that changes everything

Here is the move I would make if I ran your security program. Take your cyber insurance policy, hand it to your technology team, and say, “we need to make sure we meet this.”

If they have not done that exercise, you may have a problem hiding in plain sight. The gap between the policy and the deployment is where claims quietly die, a theme we return to often in our compliance services.

Where UnderDefense fits

Hand us your policy, and UnderDefense will map every control to live evidence, then tell you honestly where the gaps are before your underwriter does. You can start that conversation through our team, or explore the UnderDefense Agentic AI SOC platform that keeps the evidence current.

I am curious which control you will find weakest when you actually measure it, because in my experience, it is rarely the one teams expect.