Cyber insurance carriers no longer accept “we have antivirus and a firewall” as a basis for coverage. Most now require, or price sharply against the absence of, a specific set of controls: multifactor authentication on email, remote access, and privileged accounts; endpoint detection and response with active monitoring; tested, isolated backups; a patching cadence; security awareness training; email filtering; a written incident response plan; and controls over privileged and vendor access. Answering “no” to these questions on a renewal application can mean higher premiums, exclusions, sublimits, or a declined policy. Answering “yes” inaccurately can mean a denied claim.

This article explains what carriers are asking for, why, and how to get from an honest “no” to a defensible “yes.”

Why the questions changed

A few years ago, a cyber insurance application was a short form and the coverage was inexpensive. Carriers priced the risk broadly because they had limited loss data.

Ransomware changed that. Losses rose sharply, and carriers learned that a small number of missing controls predicted most of the large claims. Their response was to shift from asking whether you had insurance-worthy intentions to asking whether you had specific, verifiable safeguards in place. Applications became longer and more technical. Underwriters began requiring evidence, and some now use external scanning to verify what applicants claim.

The result is that the insurance application has quietly become a cybersecurity standard for small and mid-sized organizations. Whether or not you buy the policy, the questions on the form describe what a reasonable organization is now expected to have.

For organizations in Puerto Rico, this matters in a second way. Many operate as contractors or subcontractors to federal agencies and large mainland companies. Those relationships increasingly carry their own security requirements, and the insurance controls overlap heavily with them. Meeting one set of expectations moves you most of the way toward the other.

The controls carriers expect

The specific wording varies by carrier and policy, but the following appear consistently across current applications.

Multifactor authentication (MFA)

What they ask: Is MFA enforced on all email accounts, all remote access to the network, and all administrative or privileged accounts? Some applications extend this to cloud services and backup systems.

Why: Stolen or guessed passwords remain the leading path into an organization. MFA blocks most of those attempts outright. Carriers view its absence as the single strongest predictor of a claim.

Common gap: MFA is enabled on email but not on VPN access, or on most accounts but not on the shared administrative logins that matter most.

Endpoint detection and response (EDR) with monitoring

What they ask: Is an EDR or MDR solution deployed on all endpoints and servers, and is it actively monitored, ideally around the clock?

Why: Traditional antivirus does not detect the behavioral patterns of a modern attack. Carriers want to know that if an attacker gets in, someone will see it and respond before it becomes a full encryption event.

Common gap: EDR is installed but generates alerts into a console no one reviews after hours or on weekends.

Backups that are tested and isolated

What they ask: Are backups performed regularly, stored offline or in an immutable form that ransomware cannot reach, encrypted, and tested through actual restoration?

Why: The decision to pay a ransom is almost entirely a function of whether the organization can restore without paying. Reliable backups convert a catastrophic claim into an operational inconvenience.

Common gap: Backups exist and run on schedule, but they are connected to the same network as production systems, and no one has performed a full restore test in over a year.

Patch and vulnerability management

What they ask: Is there a documented process to apply critical security patches within a defined timeframe, and are systems scanned for vulnerabilities on a regular schedule?

Why: Many breaches exploit vulnerabilities that were public, with patches available, for months. Carriers want to see that known weaknesses are closed systematically.

Common gap: Workstations update automatically but servers, network equipment, and line-of-business applications are patched only when someone remembers.

Security awareness training and phishing simulation

What they ask: Do all employees receive recurring cybersecurity training, and does the organization run phishing simulations?

Why: Business email compromise and phishing-initiated ransomware are among the most frequent and costly claims. Trained employees are a measurable control.

Common gap: Training occurs once at hire. No simulations are run. There is no record of completion.

Email security

What they ask: Is advanced email filtering in place for phishing and malicious attachments, and are email authentication standards (SPF, DKIM, DMARC) configured for your domain?

Why: Email is the primary delivery channel for attacks. Domain authentication also protects your customers and partners from being impersonated by someone pretending to be you.

Common gap: Basic spam filtering is on. DMARC is either absent or set to monitor only, providing no enforcement.

Privileged access and account management

What they ask: Are administrative accounts separated from daily-use accounts? Is access removed promptly when employees leave? Are service accounts and vendor accounts inventoried and controlled?

Why: Attackers seek administrative privileges. Excess and orphaned accounts give them a path.

Common gap: Former employees retain active accounts. Staff use administrator accounts for routine work. Vendors have standing remote access that no one reviews.

Written incident response plan

What they ask: Does the organization have a documented incident response plan, and has it been tested or exercised?

Why: Carriers have found that organizations with a plan contain incidents faster and incur lower costs. A plan also ensures the carrier is notified within policy requirements, which protects the claim.

Common gap: A template downloaded from the internet, unfilled, or a plan that names people who no longer work there.

Additional questions appearing more frequently

• End-of-life software: Are any systems running operating systems or applications the vendor no longer supports?
• Remote desktop exposure: Is remote desktop protocol accessible directly from the internet?
• Segmentation: Are critical systems separated from general user networks?
• Vendor and supply chain risk: Do you assess the security of vendors with access to your systems or data?
• Data inventory: Do you know what sensitive data you hold and where it lives?

What happens when the answers are wrong

Two failure modes matter.

Honest “no” answers lead to higher premiums, reduced limits, ransomware sublimits or exclusions, or a declined application. Some carriers will offer coverage contingent on implementing specific controls within a defined period.

Inaccurate “yes” answers are more dangerous. The application is part of the insurance contract. If a claim investigation reveals that MFA was not actually enforced on remote access, or that backups were never tested, the carrier may reduce or deny the claim on the basis of misrepresentation. Organizations have paid premiums for years only to discover, at the worst possible moment, that the coverage did not hold.

The person filling out the application is often a business leader or finance manager relying on what IT told them. That is understandable, and it is exactly where the risk sits. The answers need to be verified, not assumed.

How to prepare before renewal

Start 90 days out. Most controls on the list can be implemented in that window if the work begins early. Starting the week the application arrives leaves only the choice between honest gaps and hopeful answers.

Audit against the application itself. Use last year’s form, or a current one from your broker, as a checklist. For each question, identify who verified the answer and what evidence exists.

Prioritize by underwriting weight. MFA, EDR with monitoring, and isolated tested backups carry the most weight with underwriters and prevent the most loss. If resources are limited, these three come first.

Document as you go. Screenshots of MFA policies, EDR deployment reports, backup restore test logs, training completion records, and a dated incident response plan are what an underwriter or claims adjuster will ask for. Build the file now.

Involve your broker. Brokers see what carriers are declining and why. They can tell you which controls are becoming mandatory in your market and which carriers are more flexible.

Treat the controls as a program, not a renewal project. Carriers now ask these questions every year, and the list grows. Controls that are stood up for the application and then neglected will fail the next scan, the next renewal, or the next claim.

Frequently asked questions

Is cyber insurance still worth buying if we implement all of this?

Yes. The controls reduce the probability and severity of an incident. Insurance covers the residual: forensics, legal costs, notification obligations, business interruption, and recovery. The two work together, and the controls make the insurance both obtainable and affordable.

Can a small organization realistically meet these requirements?

Yes, but rarely with internal resources alone. The monitoring, testing, and training components in particular require specialized tools and staff time that small teams do not have. Most organizations meet the standard through a managed provider that operates the controls and produces the evidence.

What if our carrier does not ask all these questions yet?

They will. The direction across the industry is toward more specific requirements and more verification. Meeting the fuller list now avoids a scramble later and improves your position with customers and regulators as well.

Do these requirements overlap with federal contractor obligations?

Substantially. MFA, endpoint monitoring, patching, training, access control, and incident response appear in federal cybersecurity frameworks as well. Organizations in Puerto Rico that serve federal agencies or prime contractors will find the insurance checklist and the contract requirements reinforce each other.

Turning the application into a program

Bonneville Group’s Managed IT practice was built to give Puerto Rico organizations the controls on this list without requiring them to hire a security team. We operate as an outsourced fractional IT department, and our cybersecurity program runs on Defendify, a platform that consolidates 13 security tools across three layers: detection and response, policies and training, and assessments and testing.

In practical terms, that means managed detection and response with 24/7 monitoring, security awareness training and phishing simulations with completion records, vulnerability scanning and penetration testing on a schedule, a maintained incident response plan, and posture reporting that answers your insurance application with evidence rather than assumptions. Because we also manage the network, endpoints, and infrastructure, MFA enforcement, patching, backup isolation, and access control are handled in the same program by the same team.

If your renewal is approaching, or if you are not confident that last year’s answers would hold up in a claim, we will review the application with you line by line and show you exactly where you stand. That review is the right first step whether or not you ever engage us further. We are glad to schedule it whenever it is useful to you.