Great Plains NetworkingGreat Plains NetworkingGet Support

90 Days to Prove Cyber Insurance Controls for Small Businesses

Learn which cyber insurance controls to document, including MFA scope, full network backup tests, external scans, and a 90 day readiness plan.

12 min readBy Great Plains Networking
90 Days to Prove Cyber Insurance Controls for Small Businesses — Great Plains Networking
cyber insurance security controls

90 Days to Prove Cyber Insurance Controls for Small Businesses

Technician checking recovered business network rack
Technician checking recovered business network rack

Insurers most often decide eligibility on a short list of cyber insurance security controls: multi-factor authentication on admin and cloud access, endpoint detection and response with 24/7 monitoring, immutable backups that have been tested across the full network, routine patching, centralized logging, and a written incident response plan. Underwriters check these through questionnaires and external scans. Your first step is an inventory and readiness audit.

TL;DR:

  • External scans track more than 40 signals, and underwriters weigh exposed ports, unpatched systems, and suspicious activity more heavily than positive controls.
  • A qualifying backup test restores the full network, including Active Directory, at least annually; single file restores do not prove business recovery.
  • When a scan finds a weakness, close it and preserve dated tickets or a confirming rescan; documented evidence can resolve findings without a premium change.
  • Start MFA with admin, privileged, email, and cloud accounts; then cover every endpoint and server with tamper resistant EDR monitored around the clock.

Table of Contents

Which cyber insurance security controls do insurers expect you to have?

A consolidated market list from AON's presentation to the Department of Labor covers vulnerability scanning and patch management, token-based MFA, EDR, email filtering with DMARC and DKIM, phishing exercises, identity and privileged access management, network segmentation, backup and disaster recovery testing, incident response plans, logging, encryption, and vendor continuity checks. Here is what "good enough" looks like for a small business.

  • MFA: Required on privileged and admin accounts, remote access, cloud applications, and access to backup consoles. Use an authenticator app or hardware token. Avoid SMS-only codes when you can.
  • EDR: An agent on every endpoint and server, with tamper protection turned on and someone watching the alerts around the clock, whether that is your vendor's operations center or a managed provider.
  • Backups: Immutable or off-network copies, plus a full-network recovery test at least once a year that includes Active Directory.
  • Patching and vulnerability management: A current asset inventory and a documented window for critical fixes. Thirty days is a common expectation for critical patches.
  • Email security: SPF, DKIM and DMARC records, cloud email protection with inbound scanning, and quarantine alerts someone actually reads.
  • Identity and privileged access: No local admin rights for everyday users, service account passwords held in a vault, and least-privilege roles.
  • Logging and monitoring: Centralized logs kept long enough for forensic work, reviewed by a SIEM or a managed logging service.
  • Network segmentation and remote access: No RDP open to the internet, and internet-facing services limited to what the business truly needs.
  • Vendor management: Written records of what your key vendors do to protect you and how they would keep serving you after an outage.

CISA's Cyber Essentials points the same direction: inventories, automatic updates, MFA for privileged and cloud access, protected backups, and exercised response plans.

How do underwriters measure your controls?

Underwriting used to rest on a static questionnaire. It is moving toward continuous assessment, and Marsh notes that insurers now rely on real-time network scans tracking more than 40 information signals. Insurers use external scanners such as SecurityScorecard, Bitsight and CyberCube to check what the questionnaire claims.

The weighting is lopsided. Analyst material presented to the NAIC shows that negative hygiene signals, such as open ports, unpatched systems and suspicious activity, carry more predictive weight than positive ones. A tidy answer on the form does not outweigh an exposed remote desktop port that a scanner can see from the outside.

Those scans do not stop at binding. Treat your external footprint as something you monitor weekly, not something you clean up before renewal.

When a scan flags something, documentation is your defense. A dated remediation ticket, a rescan showing the port closed, or a compensating control written down in plain language often resolves the finding without a premium change. Underwriters respond to evidence and timelines, not to assurances. The Indiana Cybersecurity Hub's underwriting resource shows how typical questionnaire categories map to each area: inventory, monitoring, patching cadence, MFA, EDR, training and vendor management.

What does "tested backups" mean to an insurer?

It means more than restoring one file. Marsh reports that insurers look for full-network recovery tests, including Active Directory, at least annually, and that single-file restores often fail to meet insurer standards. A file restore proves your backup software runs. It does not prove you can rebuild a working business after ransomware encrypts your servers and your identity system.

Underwriters care about Active Directory because every login depends on it. If you cannot recover identity, nothing else comes back in a usable state. Marsh's ransomware analysis makes the same point: real resilience requires recovery planning that understands system dependencies.

A practical full-network test looks like this:

  1. Define the scope: which servers, applications and identity systems must come back, and in what order.
  2. Restore into an isolated environment so production is never at risk.
  3. Rebuild Active Directory and confirm users can authenticate.
  4. Bring up dependent applications and check that they work end to end.
  5. Record the time it took (your recovery time) and how much data was lost (your recovery point).

Keep a short report with the scope, steps, outcome, those two measurements, and a list of what failed. That report is the artifact insurers ask for.

The most common failures are missing system state, backups that capture data but not the configuration around it, and dependencies nobody mapped, such as a licensing server or a DNS role. Fix them, retest, and file the new report. For deeper guidance, see our immutable backups walkthrough and our ransomware recovery plan.

How do you put the key controls in place?

Work in this order if your budget is limited. Each step produces evidence you can hand to an underwriter.

  1. Roll out MFA to the highest-risk accounts first. Start with admins, privileged users, email and cloud consoles, then remote access and backup systems. Prefer authenticator apps or hardware keys over SMS.
  2. Deploy EDR everywhere. Require full coverage, tamper resistance, and telemetry that a managed security team can monitor around the clock. An agent nobody watches satisfies a form but not an underwriter.
  3. Build an asset inventory and a patch policy. You cannot patch what you have not listed. Set a written timeline for critical fixes and record when each one lands. Where patching is not possible, CISA's CPG 2.0 calls for compensating controls, so document those too.
  4. Lock down email. Publish SPF, DKIM and DMARC, turn on cloud email protections, and configure quarantine policies so suspicious messages are held and someone reviews them.
  5. Remove local admin rights and vault service accounts. Enforce least privilege, and keep a list of every privileged account so you can answer the MFA scope question precisely.
  6. Centralize logs. Send endpoint, firewall, identity and email logs to one place, set a retention period, and write down who watches them. Our partners at Netverge cover what good monitoring and escalation look like in their network incident response guide.

Pro Tip: Keep one shared folder with a dated screenshot or report for every control above. When the insurer's follow-up questions arrive, you can respond with the relevant evidence.

If your team is small, a managed provider can cover the gaps that are hardest to staff: round-the-clock monitoring, patch reporting and recovery testing. Attackers also work through the people you trust, so make sure your phishing training and vendor reviews are scheduled, not aspirational.

What evidence should you gather for the application?

Insurers move faster when each answer points to a document. Map every questionnaire item to an artifact before you submit.

  • MFA scope: An exported list of admin and privileged accounts showing MFA enforcement, plus the policy that applies to remote and cloud access.
  • Backups: Your most recent full-network recovery test report, with recovery time and recovery point results.
  • Patching: A recent vulnerability scan summary and the remediation tickets for its critical findings.
  • Incident response and continuity: A written plan, a summary of your last tabletop exercise, runbooks, and a current vendor contact list.
  • Penetration testing: An executive summary of results and fixes, not the full technical report. Share the detail only under a confidentiality agreement.

Before final inspection, run your own external scan, close open ports and stale services, and rescan to confirm. A clean second scan that you can show tells the underwriter you find problems before they do.

What does continuous monitoring mean for your policy?

Some insurers now run what the NAIC working group describes as an "active insurance" model: the insurer provides continuous monitoring and support during the policy term, and businesses using it can see fewer claims than the market average. The scoring behind it draws on the 40-plus signals mentioned earlier, such as exposed services, patch status and signs of prior compromise.

The practical effect is that your policy can change while it is in force. A new negative finding may bring a remediation request first, and if it is ignored, a premium change or a mid-term endorsement. The NAIC working group minutes note that insurers value alerts and engagement as a way to improve resilience, so a prompt reply counts in your favor.

What does continuous monitoring mean for your policy? — overview diagram
What does continuous monitoring mean for your policy? — overview diagram

To stay ready, scan your own perimeter on a schedule, route insurer alerts to a person who will act on them, close findings within a stated window, and keep a running log of improvements. That log helps at renewal, because improved controls have helped some organizations lower premiums and raise coverage limits, as the NAIC cybersecurity insurance report describes.

What should you do in the next 30, 60 and 90 days?

  1. Days 0 to 30: Inventory devices, accounts and data. Turn on MFA for admin and cloud accounts. Deploy EDR. Confirm that backups exist and where they live.
  2. Days 31 to 60: Patch critical assets. Run an internal and external vulnerability scan. Configure email security and begin phishing training.
  3. Days 61 to 90: Run a full-network recovery test. Formalize your incident response plan and hold a tabletop exercise. Assemble the evidence folder for your application.
  4. Decide on help: Bring in a managed IT provider if you lack staff for 24/7 monitoring, need proof-of-test artifacts, or want someone to produce an insurer-ready evidence package.

Where small businesses fall short, and why oversight matters

The gaps I see most often are the same ones every time: no reliable inventory, backups that have never been restored as a whole, and MFA that covers email but skips admin consoles or relies on text messages. None of these is expensive to fix. They simply go unowned until a questionnaire asks about them.

My editorial view is that insurers reward owned, documented controls more than expensive ones. Even part-time, virtual CISO-level oversight tends to make a business more attractive to underwriters, because someone is accountable for minimizing privileged service accounts and for coordinating a tested response plan with the insurance program. A small shop with a modest toolset and a written, tested process often looks stronger on paper than a larger one with better tools and no records.

— Nicholas

How can we help you meet insurer expectations?

Greatplainsnetworking
Greatplainsnetworking

Insurers want controls that are running, watched and documented, and that is what we build for small businesses across Norman, Moore and Oklahoma City. Our work includes:

Start with the audit, or request the free network assessment from our home page.

FAQ

How does cyber insurance work?

You pay a premium for coverage that can include first-party costs, such as your own response and recovery, and third-party liability. The Insurance Information Institute notes that insurers sometimes provide access to pre-vetted vendors and response services. Your approved controls influence both your price and your limits.

How do you control cyber attacks?

No approach prevents every attack, as Triple-I guidance notes. You reduce risk by keeping security software and hardware updated, backing up data regularly, following cloud best practices, and working with IT security vendors. The controls in this article are the practical version of that advice.

What are cybersecurity frameworks?

A framework is a structured set of practices for managing cyber risk. CISA's Cyber Essentials and its Cybersecurity Performance Goals are two free starting points for small organizations. Underwriting questionnaires tend to mirror them.

What are the three types of security controls in cyber security?

They are preventive, detective and corrective. Preventive controls, like MFA and patching, stop incidents. Detective controls, like logging and EDR monitoring, spot them. Corrective controls, like tested backups and incident response plans, limit the damage and restore operations.

Sources

Recommended

Free Network Assessment

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

Related reading