Guide · Canadian organizations

The security controls cyber insurers ask about

What insurers look for on a cyber insurance application, why each control matters, what an honest "yes" really means, and the evidence to keep. Then a 26-point checklist to work through before your next renewal.

By Mohammad Elmallah, CISSP, CISM · Published October 8, 2026

Go to the checklist Take the free Cyber Essentials Assessment

The short answer

Insurers price cyber risk by asking about the controls that most often decide whether an attack succeeds and how bad it gets. Across the Canadian and insurer sources behind this guide, the same list keeps coming up: MFA, backups that survive an attack, endpoint protection and EDR, patching, tight administrator access, payment verification, training and a tested incident response plan. MFA is the most consistently required.

Most of these are features of tools you may already pay for. The harder part is making each one complete, with no gaps or exceptions, and keeping the evidence, because the application is a statement your insurer relies on when you make a claim.

Coalition 2025 claims report

60%

of Coalition's 2024 cyber claims began with business email compromise or funds-transfer fraud.

Coalition 2025 claims report

29%

of business email compromise events led to funds-transfer fraud, so payment controls matter as much as technical ones.

RIBO

MFA first

RIBO notes that most insurers require multi-factor authentication before they will issue a policy.

Coalition's figures cover its policyholders in the US, Canada, the UK and Australia. This guide is general information; your policy wording and your broker's advice come first.

Control by control

Ten controls, and what a real "yes" means

For each control: why insurers care (with the source), what a complete answer looks like, and the evidence worth keeping. Requirements differ between insurers and change at renewal, so treat this as the common core, not the full list for any one policy.

1Multi-factor authentication (MFA)

Why insurers care: RIBO notes that most insurers require MFA before they will issue a policy, and Canadian Underwriter reports that Canadian cyber insurers require it before a business qualifies for coverage. Get Cyber Safe, with the Insurance Bureau of Canada, recommends MFA on all accounts and devices. InsurersGet Cyber Safe + IBCCyber Centre
What a real "yes" means: MFA is enforced, not just available, on email and every cloud application, on all remote access (the Cyber Centre recommends a VPN with two-factor authentication), and on every administrator account, including cloud admin accounts. No exceptions for executives, shared mailboxes or old accounts.
Evidence to keep: An export of your MFA or conditional-access policies, and a dated list of any accounts not covered, with the reason and a fix date. ABISOL practice

2Backups that survive an attack

Why insurers care: A Hartford Steam Boiler cyber executive, quoted in Canadian Underwriter, lists backups among the basics carriers should confirm, including off-site, disconnected backups. The Cyber Centre's baseline says to back up essential data regularly, test restores, encrypt backups, restrict access to them, and keep long-term backups offline and ideally off-site. InsurersCyber Centre
What a real "yes" means: A copy of your critical data, including cloud email and files, is kept offline or otherwise out of reach of your normal admin accounts, and you have restored from it recently.
Evidence to keep: The date and result of your last restore test, how long it took, and what the backups cover. ABISOL practice

3Endpoint protection and EDR

Why insurers care: Marsh says insurers expect, at a minimum, endpoint protection and endpoint detection and response (EDR) on servers and laptops, to detect malicious programs and contain their spread. The Cyber Centre's baseline calls for anti-malware that updates and scans automatically. InsurersCyber Centre
What a real "yes" means: Every laptop, desktop and server reports to one console, and someone reviews and acts on its alerts, whether your team, your MSP or a managed detection service.
Evidence to keep: A coverage report from the console showing the number of protected devices against your asset list, and who responds to alerts. ABISOL practice

4Patching and unsupported systems

Why insurers care: Marsh notes that insurers focus on patch management because unpatched vulnerabilities are a leading cause of intrusions. The Cyber Centre's baseline recommends automatic updates, or replacing products that can no longer be updated. InsurersCyber Centre
What a real "yes" means: Operating systems, applications and network devices are patched on a defined schedule, critical fixes faster, and nothing internet-facing runs on software that no longer gets security updates.
Evidence to keep: A patch compliance report and a list of unsupported systems, each with a replacement or isolation plan. ABISOL practice

5Privileged (administrator) access

Why insurers care: Marsh says insurers consistently scrutinise privileged account management, because a compromised privileged account carries a high likelihood of significant harm. The Cyber Centre's baseline says to limit administrator accounts to administrative tasks and remove access that is no longer needed. InsurersCyber Centre
What a real "yes" means: Only a few named people hold admin rights, they use separate admin accounts protected by MFA, and admin access is reviewed regularly.
Evidence to keep: The current list of admin accounts, with owners and the date of the last review. ABISOL practice

6Email security and payment verification

Why insurers care: In Coalition's 2025 claims report, 60% of 2024 claims began with business email compromise or funds-transfer fraud, and 29% of business email compromise events led to funds-transfer fraud. The RCMP advises a two-step verification process for payment requests, not relying on email alone, and dual approval for wire transfers. The Cyber Centre's baseline adds email filtering and DMARC. RCMPCyber Centre
What a real "yes" means: Any new payee or change to banking details is confirmed by phone, using a number you already had, before money moves, and larger payments need two people. Your domain publishes SPF, DKIM and DMARC records.
Evidence to keep: The written payment-change procedure, a record that staff follow it, and your DMARC record. ABISOL practice

7Security awareness training

Why insurers care: Get Cyber Safe and IBC recommend training staff on their cyber security responsibilities, and Marsh names staff training among the assurances a security leader can give insurers. The Cyber Centre's baseline covers spotting malicious emails and links. Get Cyber Safe + IBCInsurersCyber Centre
What a real "yes" means: Everyone, including leadership, completes training at least yearly, and new staff are trained when they start.
Evidence to keep: Completion records and, if you run them, phishing simulation results. ABISOL practice

8A tested incident response plan

Why insurers care: Canadian Underwriter reports that Canadian cyber insurers require a cybercrime or data breach response plan, and the Hartford Steam Boiler executive advises arranging breach response providers in advance and practising the plan regularly. The Cyber Centre's baseline calls for a written plan with a hard copy available. InsurersCyber Centre
What a real "yes" means: A short written plan names who decides, who to call (insurer hotline, breach counsel, forensics, your bank) and how you notify clients and regulators, and you have walked through it in the last year.
Evidence to keep: The plan, its last review date, and notes from the last exercise. ABISOL practice

9Logging and monitoring

Why insurers care: Get Cyber Safe and IBC recommend detection through logging tools and alerts, so an attack is noticed early. Get Cyber Safe + IBC
What a real "yes" means: Sign-in and security logs for email, cloud, endpoints and firewalls are kept, and someone is responsible for watching the alerts.
Evidence to keep: Where logs are kept and for how long, and who reviews alerts. ABISOL practice

10Vendors, MSPs and cloud services

Why insurers care: The Cyber Centre's baseline says to secure cloud and outsourced IT: ask providers for independent assurance reports, use two-factor authentication on cloud admin accounts, encrypt data stored outside your organization, and understand how and where providers handle your data. Cyber Centre
What a real "yes" means: You know which providers can reach your data or systems, how they protect it, and what their contract says about security and incidents.
Evidence to keep: A list of key providers with their security documents and the relevant contract terms. ABISOL practice

ABISOL practice

How to answer the application

Answer from evidence, not memory. Before you tick "yes", look at the console, the policy export or the restore log. If the person filling in the form has not checked, it is a guess.
Read each question on its own. "MFA for email", "MFA for remote access" and "MFA for administrators" are separate questions with separate answers.
Describe partial controls accurately. "In place for all staff except two service accounts, to be fixed by March 31" is a better answer than an unqualified yes.
Keep a dated evidence file. Screenshots and reports from the week you applied, filed with the application. If you ever claim, you will want to show what was true then.
Re-check before every renewal. Controls drift: new staff, new systems, exceptions that were meant to be temporary.

This is work ABISOL does as a fractional CISO: checking each control, closing the gaps, and building the evidence file before the application goes in. Sector guides: RIBO cyber security for brokerages · OSFI B-13 for mutual insurers.

Questions people ask

Will these controls lower our premium?

They can help. Get Cyber Safe and IBC note that insurers want to gauge risk, and that strong risk management may let them offer coverage at a lower premium. The price still depends on the insurer, your sector and the market at renewal. Ask your broker which controls carry the most weight with the markets you are quoting.

Which controls are mandatory?

It varies by insurer and changes over time. The controls in this guide come up repeatedly in Canadian and insurer sources, with MFA the most consistently required. Your broker can tell you which ones are firm requirements for the policies you are considering, and some policies make specific safeguards a condition of coverage.

We answered "yes" but it is only partly true. What now?

Talk to your broker before renewal, or as soon as you notice. An application is a statement the insurer relies on, so describe partial controls accurately, with dates for finishing them. Then close the gap and keep the evidence.

Is MFA on email enough?

Usually not. Get Cyber Safe and IBC recommend MFA on all accounts and devices, and the Cyber Centre adds remote access and cloud admin accounts. Insurers often ask about each of these separately, so read every MFA question on the application on its own.

Does cyber insurance replace security work?

No. Get Cyber Safe and IBC describe a cyber policy as just one component of an overall risk mitigation strategy. Insurance pays for some of the cost of an incident; the controls are what make one less likely and less damaging.

We are a small organization. Is this realistic?

Yes. The Cyber Centre wrote its baseline controls for small and medium organizations with limited budgets, and most of these controls are features of tools you may already pay for, such as Microsoft 365 or Google Workspace. The work is turning them on, checking them and keeping the evidence.

Sources

Read on October 8, 2026. If a source has changed since, the source wins.