Cyber Insurance Renewal Calendar: What to Fix 90, 60, and 30 Days Before Renewal

If your cyber insurance renewal is less than 90 days away, stop treating the questionnaire like paperwork. Treat it like an evidence request. The best renewal work happens before the carrier asks the questions: find the weak answers, fix what you can, and package proof before underwriting turns into a deadline problem.

That does not mean building a huge compliance program overnight. For most small businesses, the renewal calendar is a focused 90/60/30-day project:

• 90 days out: find the gaps and collect baseline evidence
• 60 days out: fix the yes/no controls that underwriters care about
• 30 days out: package proof, answer carefully, and prepare for follow-up

The control list is not mysterious. CISA, NIST, and the FTC all point small organizations toward the same operating basics: know what matters, use MFA, patch systems, back up critical data, train people against phishing and fraud, and plan for response and recovery.

Sources: CISA StopRansomware Guide, NIST Small Business Cybersecurity Corner, FTC Cybersecurity for Small Business

This article does not sell insurance and does not promise a premium reduction. Obsidian Ridge helps small businesses build the evidence behind the answers. The insurer decides the policy terms.

Why renewal work starts before the questionnaire arrives

Cyber insurance questionnaires are difficult when the business has to discover its own environment while answering them.

That is the real renewal trap. The problem is not one hard question. It is a stack of questions that sound simple until someone asks for proof:

• Do all administrator accounts have MFA?
• Are all servers covered by endpoint detection?
• When was the last backup restore test?
• Is remote desktop exposed to the internet?
• Who can approve a vendor bank-detail change?
• When did you last test the incident response plan?

If the first honest answer is "we need to check," the renewal is already late. The 90-day calendar creates enough time to check, fix, and prove.

For a deeper control-by-control view, see the live guide to what cyber insurers require in 2026 and the 2026 cyber insurance questionnaire breakdown. This article is the working calendar around those controls.

90 days before renewal: find the weak answers

At 90 days, do not start with tool shopping. Start with an evidence inventory.

Create one folder for the renewal and collect five things:

1. Your last application or renewal questionnaire
2. Your current policy and any security conditions
3. A list of systems that hold business-critical data
4. The current user and admin account list
5. Screenshots, exports, or reports for the controls you already claim

Then run a control pass against the questions most likely to matter.

MFA

Confirm MFA is enforced on:

• Microsoft 365 or Google Workspace
• Administrator accounts
• Remote access
• Backup consoles
• Banking, payroll, and accounting platforms
• Password managers

Do not rely on "people can turn MFA on." Underwriters care whether it is enforced.

Endpoint coverage

Export the endpoint list from your EDR, MDR, or antivirus console. Compare it against the real device list:

• Workstations
• Laptops
• Servers
• Remote machines
• Old devices still used for business

The dangerous gap is almost always a server, a shared workstation, or a computer that belongs to a person nobody thought about.

Backups

Write down:

• What is backed up
• Where it is stored
• Who can delete it
• Whether MFA protects the backup console
• Whether a restore has been tested
• How long the last restore took

If the answer is "we think backups run every night," you do not have evidence yet. You have a belief.

Remote access

Look for:

• Exposed RDP
• Old VPN accounts
• Remote support tools left behind by vendors
• Admin portals with password-only access

Remote access is one of the fastest places for a renewal review to become uncomfortable.

Incident response

Find the plan, then ask the harder question: when was it tested?

NIST's incident response guidance is written for structured response work, but the small-business version is simpler: one named owner, one call list, one containment path, one communication path, and one recovery owner.

Source: NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile

60 days before renewal: fix the yes/no gaps

At 60 days, stop collecting and start closing the gaps that can change the application answer.

The priority is not "everything." The priority is the controls that are most likely to create underwriting friction.

Fix MFA enforcement

Start with the systems that can reset other systems:

• Email
• Admin consoles
• Backup tools
• Remote access
• Password managers

If a system supports stronger MFA than SMS, prefer that. But do not let perfect become the reason a key account is still password-only.

Confirm servers are covered

Many businesses have endpoint protection on employee laptops and forget servers. That is a problem because servers hold the data ransomware wants.

If servers are not covered, decide quickly:

• Add them to the existing tool
• Document why they are not compatible
• Segment them and monitor another way
• Replace unsupported systems if they are exposed or business-critical

The worst answer is silent non-coverage.

Test one restore

Backups are not proven until something comes back.

At 60 days, pick one meaningful restore test:

• A business-critical file share
• A database backup
• A practice-management export
• A line-of-business application folder

Record the date, system, person, steps, result, and time to restore. This becomes renewal evidence and a better recovery plan.

For the deeper version, see Backups Are Not Recovery.

Clean up remote access

Disable what is not needed. Add MFA where remote access remains. Remove old vendor accounts. If RDP is exposed, treat that as urgent.

CISA's ransomware guidance repeatedly emphasizes reducing attack paths before an incident, not after.

Source: CISA StopRansomware Guide

Write the payment-change rule

Business email compromise does not always need malware. It needs one rushed payment change.

Write a short rule:

No vendor bank-detail change, urgent invoice, or funds-transfer request is approved from the first email alone. Verify through a known phone number or known secondary channel before approval.

That rule belongs in the renewal file because it is both a real control and a practical fraud reducer.

30 days before renewal: package the evidence

At 30 days, the work shifts from fixing to packaging.

Create a simple evidence pack:

• MFA evidence: screenshots or exports showing enforcement
• Endpoint evidence: device coverage report, including servers
• Backup evidence: restore-test log and backup configuration screenshot
• Patch evidence: recent update or vulnerability management report
• Incident response evidence: one-page plan and test notes
• Training evidence: staff training or phishing simulation records
• Payment control evidence: written callback and dual-approval rule
• Remote-access evidence: VPN, zero-trust, or firewall configuration notes

The evidence pack does not need to be theatrical. It needs to be honest and easy for an underwriter, broker, or leadership team to understand.

This is where a lot of applicants lose time. They may have a control, but the proof lives in five portals, two inboxes, and someone's memory.

7 days before renewal: do not improvise

The last week is for review, not reinvention.

Do three things:

1. Re-read the application for wording traps.
2. Match every strong answer to evidence.
3. Mark uncertain answers for broker discussion instead of guessing.

Do not say "yes" because the answer should be yes. Do not round up from partial deployment to full deployment. Do not copy last year's answer if the environment changed.

The application is part of the risk record. A cleaner answer is not useful if it is not true.

What to avoid

Avoid these renewal mistakes:

• Waiting for the questionnaire before starting
• Claiming MFA when only some users have it
• Claiming backups without a restore-test record
• Forgetting servers in the endpoint count
• Treating OneDrive, Google Drive, or Dropbox sync as a full backup strategy
• Saying "we have an incident response plan" when nobody knows where it is
• Assuming the MSP has evidence ready without asking
• Promising business outcomes you do not control

That last point matters. Better preparation can improve the quality of an application, but nobody outside the insurer controls premium, binding, exclusions, or claim decisions.

The best renewal question to ask your MSP

Ask this:

"Can you give me the evidence pack behind our cyber insurance answers?"

That one question separates an operating partner from a tool installer.

You are not asking for a marketing deck. You are asking for proof:

• Where MFA is enforced
• Which endpoints and servers are covered
• When backups were restored
• Who owns incident response
• How payment changes are verified
• What remote access exists

If the answer takes weeks, you have learned something useful before the insurer does.

Where Obsidian Ridge fits

Obsidian Ridge helps small businesses make the renewal process evidence-backed instead of panic-driven. The Cyber Insurance Readiness Sprint is built for this exact job: map the questionnaire, close priority gaps where possible, and produce a signed evidence pack tied to the carrier's questions.

The promise is the deliverable, not the insurer's decision:

7 days. Flat fee. Signed evidence pack mapped to your carrier's questionnaire - delivered, or we keep working at no additional cost until it is. We don't control underwriter decisions. We control whether you walk in with the evidence they ask for.

If you want to self-assess first, start with the free Cyber Insurance Readiness Questionnaire. If the renewal is inside 90 days and the evidence is scattered, Talk with us.

FAQ

When should I start preparing for cyber insurance renewal?

Start 90 days before renewal if possible. That gives you one month to find gaps, one month to fix the controls that matter, and one month to package evidence and answer carefully.

What are the most important renewal controls?

For most small businesses, start with MFA, endpoint coverage, backups, remote access, incident response, patching, email security, payment verification, and training records.

What if renewal is only 30 days away?

Focus on evidence and the highest-risk gaps. Prove MFA, endpoint coverage, backups, and remote-access status first. Do not invent maturity you cannot support.

Can Obsidian Ridge guarantee lower premiums?

No. No security provider should promise an underwriting outcome. Obsidian Ridge can help build the evidence pack and close practical gaps; the insurer controls pricing and policy terms.

What should I ask my broker?

Ask what controls the carrier is most sensitive to this year, whether any prior answers created concern, and what evidence would help underwriters understand your current posture.

Sources and references

• CISA StopRansomware Guide
• NIST Small Business Cybersecurity Corner
• FTC Cybersecurity for Small Business
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile