If you went through cyber insurance renewal in the last year, you already know — it’s not the same conversation it used to be. The questionnaire is longer. The questions are harder. And the broker who used to call once a year now wants documentation.
There’s a reason. Insurers paid out a lot on ransomware claims. They’re tightening up, and the result lands on SMBs the hardest.
What Underwriters Actually Want to See
Most renewal questionnaires now ask about the same core controls. MFA on email, MFA on remote access, MFA for admin accounts. Endpoint detection across every device. Backups that are tested, immutable, and stored somewhere a ransomware actor can’t reach. A documented incident response plan. Phishing training for employees, with proof it actually happens.
That’s the short list. Some carriers add more — vulnerability scanning, patch cadence, vendor management, privileged access controls. None of it is unreasonable. But if you’re answering “no” or “not sure” to more than a few of these, your premium is going up, your coverage is shrinking, or both.
Where SMBs Usually Get Tripped Up
The questionnaire isn’t the problem. The proof is. Saying you have MFA is one thing. Showing the carrier a report that confirms it’s enforced across every account is another. The same goes for backups, training records, and incident response readiness.
Carriers have started asking for evidence, not assurances. If your IT provider can’t produce it quickly, that’s a gap.
What You Can Do Before Your Next Renewal
Pull your last questionnaire and treat it like a gap list. Anything you answered “no” or “partially” to is a project. Some of these — MFA, EDR, basic backup hygiene — are quick wins. Others, formal IR plans, vendor risk programs, take longer but matter more.
The underlying point is simple. Cyber insurance is moving toward the same set of expectations that the broader security industry has been pushing for years. Carriers want to see minimum standards for a defensible cybersecurity program. If you meet them, renewal gets easier. If you don’t, it gets expensive.
One Last Thing
The companies that handle renewal well don’t scramble in the last 60 days. They treat the questionnaire as a year-round program, not a once-a-year form. The work isn’t dramatic. It’s just steady.
Defensible helps SMBs prepare for cyber insurance renewal so the answers line up with what’s actually in place. Talk to an expert.
