What Controls Do Cyber Insurers Require in 2026? The 10 That Decide Your Application

If you want to know what controls cyber insurers require in 2026, skip the brochures and read the application language. Current SMB applications and ransomware supplementals converge on the same ten control areas, which carriers break into roughly two dozen specific application questions (the granular, question-by-question walkthrough is the 2026 questionnaire breakdown). In 2026, the security-control questionnaire is the underwriting decision. A wrong answer on a critical line can decline the application up front or quietly become a claim problem after a loss.

Below are the ten controls underwriters actually score, in their own language: what they ask, what answer passes, and the quiet disqualifier — the response that looks survivable to you but reads as a hollow control to the person pricing your risk.

Obsidian Ridge does not sell insurance. We help regulated SMBs — dental practices, law firms, accounting firms — pass underwriting honestly and operate the controls behind the answers. If you'd rather work the list yourself first, the free 2026 Cyber Insurance Readiness Questionnaire is this exact checklist as a downloadable worksheet.

Why the questionnaire became the underwriting gate

Before 2021, a cyber application was firmographics and a short security checkbox. After the ransomware surge, carriers rebuilt the application around the controls that actually change loss outcomes, and made them mandatory rather than informational. The questionnaire is now detailed enough to separate a control that exists from one that works — and the answers you give become conditions the carrier can hold you to when you file a claim. That is the part most applicants miss: the questionnaire is not a formality you complete to get a quote. It is the contract's first draft.

The 10 controls underwriters actually score

1. Multi-factor authentication — on everything, not just the VPN

Applications break MFA out by system: remote access and VPN, RDP and RD Gateway, web email (the webmail portal and the mailbox app), privileged and service accounts, cloud, and the backup console itself.

What passes: MFA enforced across all of those with modern factors.

The quiet disqualifier: MFA on the VPN but not on webmail or the admin console — the per-system breakdown exists to surface that gap. Several carriers also exclude static factors like certificates or pre-shared keys from what they count as MFA.

2. Endpoint detection — on servers, not just laptops

Carriers ask for the product and vendor of your endpoint stack and how widely it is deployed.

What passes: EDR or managed detection and response on substantially all workstations and servers, tied to continuous monitoring.

The quiet disqualifier: "substantially all workstations but not servers" is a selectable answer on some forms — choosing it tells the underwriter your servers are bare, which is precisely where ransomware does its damage. Unmonitored EDR does not count as EDR. This is the control behind our managed detection and response service.

3. Backups — immutable or MFA-locked, and actually restored

Carriers probe whether backups are offline or air-gapped, immutable, MFA-protected, encrypted, and recoverable within three days.

What passes: backups that are immutable or MFA-gated, encrypted, and test-restored within the last 12 months.

The quiet disqualifier — three traps: a plain cloud sync that is neither immutable nor MFA-protected; a "syncing service" like DropBox, OneDrive, SharePoint, or Google Drive presented as backup (ransomware encrypts those alongside production); and backups that have never been integrity-tested for malware before restore. Untested backups score zero.

4. Privileged access — separate accounts, vaulted, monitored

Carriers ask whether admins use separate accounts for administrative versus day-to-day work, whether local admin credentials are unique per machine, and whether a password vault manages privileged accounts.

What passes: separate admin accounts, a credential vault, least privilege, and MFA on privileged login.

The quiet disqualifier: one account used for both web browsing and domain administration is a selectable, failing answer. A vault that stores credentials but does not monitor privilege usage is the weaker tier.

5. Email security — a gateway, not a spam filter

Carriers distinguish basic filtering from a secure email gateway with URL rewriting and attachment sandbox detonation before delivery, plus external-sender tagging and SPF enforcement.

What passes: a real secure email gateway with SPF strictly enforced.

The quiet disqualifier: ordinary email filtering does not satisfy this — one carrier's own glossary states filtering "does not protect against more targeted and sophisticated email attacks." SPF left in monitor-only mode also fails.

6. Patch and vulnerability management — and no exposed end-of-life software

Carriers ask your timeframe to install critical patches, a separate and faster timeframe for zero-days, and the status of any end-of-life software.

What passes: critical patches inside roughly 30 days, a faster lane for zero-days, and no internet-facing EOL software.

The quiet disqualifier: EOL software is acceptable only if it is segmented, not internet-facing, and under purchased extended support. "No formal patch management program" and "beyond one month" are literal selectable answers that fail.

7. Incident response — written, and tested

Every form that asks pairs the existence of an incident response plan with whether it has been tested, and asks for named responsibilities.

What passes: a written plan with named action items and roles, tested in the last 12 months.

The quiet disqualifier: "we have a plan" is never enough — one carrier asks for the actual date of your last test, which exposes a plan tested years ago or never.

8. Network exposure — no flat networks, no naked RDP

Carriers decompose remote desktop into internal versus external, standard port 3389 versus non-standard, and MFA versus password-only — and ask about IDS/IPS, protective DNS, and segmentation between IT and operational technology.

What passes: no externally exposed RDP without MFA, IT and OT separated, and internet-facing systems in a DMZ.

The quiet disqualifier: externally exposed RDP on port 3389 with password-only authentication is the single most diagnostic answer in the whole application. A flat network where operational technology shares a segment with IT is a selectable, failing answer.

9. Funds-transfer controls — out-of-band, every time

Carriers ask whether you verify funds-transfer requests and vendor bank-detail changes through a separate channel, whether you require dual authorization, and at what threshold.

What passes: out-of-band verification on every payment-change and vendor-bank-change request, plus dual authorization above $25,000.

The quiet disqualifier: $25,000 is the common trigger, but some carriers set no dollar floor at all — verification is required on every request, so a "we verify over $X" policy fails. Confirming a change by replying to the same email also fails the definition of out-of-band.

10. Security awareness — simulated, and including the people who move money

Carriers ask how often you run social-engineering training, whether you run phishing simulations (asked separately from training), and whether finance and accounts-payable staff are trained specifically.

What passes: continuous training plus phishing simulations for all staff, finance included.

The quiet disqualifier: "never / not regularly" is a literal checkbox on some forms, classroom training without simulation is the weaker answer, and training that skips the people who actually wire money is the gap that matters most.

The threshold-killing trifecta

Three of those ten answers act as auto-decline signals, called out specifically by major reinsurers in their 2026 underwriting guidance: missing MFA on administrator accounts, EDR on workstations but not servers, and backups that have never been restore-tested. If you fix nothing else before you apply, fix these three. They are the difference between a quote and a declination, and between a paid claim and a denied one.

What this means for your vertical

The ten controls are universal, but the exposure that drives your premium is not.

• Law firms — the lawyers' cyber application asks your current professional-liability carrier and policy number up front, splits phishing training by financial versus non-financial staff (trust-account and IOLTA fraud is the exposure), and requires backups that are cloud, MFA-protected, daily, and three-day-restorable — all of it, or the answer is No. See the law-firm program.
• Dental and medical practices — carriers proxy HIPAA risk through PHI record counts rather than HIPAA-named questions, and they care whether EDR covers the practice-management server, not just the front-desk PCs. See the dental program.
• Accounting and tax firms — client-fund handling and filing-season volume make out-of-band funds-transfer verification and finance-staff training the controls that carry the most weight. See the accounting program.
• Real estate, title, and escrow — the heaviest funds-transfer exposure of all: a business-email-compromise wire diversion is the most common claim, so the no-dollar-floor verification controls are make-or-break.

The downloadable questionnaire covers twelve verticals in this detail, including manufacturing, retail, construction, nonprofits, and auto dealerships.

Get ahead of the questionnaire

The questionnaire tells you where you stand. Closing the gaps is the work — and the harder part is producing the evidence underwriters accept: the access-control export, the server-coverage attestation, the restore-test log, the out-of-band payment procedure, the tested incident response plan.

Two ways forward:

1. Self-assess first. The free 2026 Cyber Insurance Readiness Questionnaire is this control list as a worksheet — the real questions, what passes, the quiet disqualifiers, and notes for twelve SMB verticals. Score yourself before an underwriter does.
2. Get the evidence packet built. The Cyber Insurance Readiness Sprint is a fixed-scope engagement that turns your environment into the documentation a carrier accepts, so the application becomes a paperwork step instead of a months-long scramble. It is carrier-neutral. See pricing or read how the Huntress partnership underpins the controls.

You do not need to guess what cyber insurers require in 2026. The answer is on the application, and now it is on your desk.