Guide

The 2026 Cyber-Insurance Checklist: Do You Qualify?

Gone are the days when you could just fill out a form and buy Cyber Insurance. In 2026, insurers are bleeding money from ransomware claims, and they have tightened their standards dramatically.

By SecureBusinessHub Editorial, International cybersecurity desk — · 8 min read

Filing a simple form and getting cyber insurance is over. Insurers have lost too much money on ransomware claims in the SMB sector and have tightened their requirements significantly.

If these controls aren't in place, they'll deny your application or deny your claim after a breach.

1. MFA everywhere

No MFA on email and remote access means you're uninsurable. Full stop.

2. Offline backups

Insurers want evidence that if your network gets encrypted, you can recover without paying. That means offline or immutable backups not reachable by an attacker with admin access.

3. Patch management logs

Can you prove you applied critical patches within 30 days of release? If not, underwriters will call it negligence and decline the claim.

4. Employee training records

Did the employee who clicked the malicious link complete phishing awareness training in the last 12 months? You need records.

The forensics requirement

A clause that trips up many SMBs is the forensic mandate. After a breach, your insurer will likely require you to use one of their pre-approved forensic firms. If you start fixing servers before investigators arrive, you may inadvertently void your policy, leaving you to cover data recovery costs and legal fees out of pocket.

Software warranties vs. cyber insurance

Your EDR vendor's "$1M Ransomware Warranty" is not the same as cyber insurance. These warranties are hard to claim against and typically only cover the cost of the software itself. They don't cover business interruption, regulatory fines, or the PR fallout after a major leak.

Learn how to build a compliant infrastructure in our SMBs Security Checklist.

Cyber insurance is a contract that says they'll pay if you did your homework. Make sure you did.