What cyber insurance requires from your IT provider in 2026

A few years ago, a cyber insurance application was a short form. Today it reads like a security audit. Carriers ask whether you use MFA, how your backups are protected, how fast you patch, and whether you have tested an incident response plan. Most small businesses hand those questions to their IT provider.

That makes your IT provider part of your insurance coverage, whether they realize it or not. Here is what carriers commonly ask for, the evidence your provider should be able to produce, and the questions to settle before your next renewal.

The controls carriers commonly ask about

Every carrier's form is different, and requirements change from year to year. These controls come up on most applications:

• MFA on email, remote access such as VPN and remote desktop, and every administrative account.
• EDR on computers and servers, rather than basic antivirus alone.
• Backups that are encrypted, kept offline or immutable so ransomware can't reach them, and restored on a test basis.
• Patching on a defined schedule, with no internet facing systems running unsupported software.
• Privileged access limited to a small number of separate admin accounts.
• Email security, including filtering and protection against spoofed senders.
• Security awareness training, often with simulated phishing.
• An incident response plan that has been written down and, increasingly, tested.
• Logging and monitoring that would show an attacker's activity.

Some forms also ask how quickly you could restore critical systems after an attack. That is a question about your RTO and RPO, and your IT provider should be able to answer it with numbers from an actual restore test, not a guess.

What your IT provider should be able to produce

Every yes on the application should have something behind it that you can hand to the carrier. Ask your provider for:

• A report showing MFA status for every user and admin account, including exceptions.
• The list of devices with EDR installed, and any that are missing it.
• The backup schedule, where copies are stored, how they are isolated, and the date and result of the last restore test.
• Patch compliance reports, and a list of any systems that can no longer be patched.
• The current incident response plan and the date it was last exercised.
• How long logs are kept, and where.

If your provider can't produce these, the honest answer on the application may be different from the one you have been giving. Our article on what insurers want in a penetration test report covers the testing side of the same question.

Why accuracy matters at claim time

The application is part of the policy. If a claim investigation finds that a control you said was in place wasn't, the carrier may dispute or deny the claim, or try to cancel the policy. In 2022, Travelers asked a federal court to rescind a policy after a ransomware claim showed MFA was not in place where the insured's application said it was. The insured agreed to the rescission.

The lesson isn't to fear the application. It is to answer it with your IT provider in the room, using evidence rather than memory, and to note exceptions instead of rounding up to yes.

What happens when you file a claim

Read the claim conditions before you need them. Many policies require prompt notice, require you to use the carrier's approved panel of response firms or get consent before hiring your own, and limit what is covered if you act first and call later. Put the carrier's claim number and those conditions in your incident response plan so whoever is on the phone at 2 a.m. knows them.

Your IT provider's role in that first hour matters too. Wiping and restoring systems before evidence is preserved can make it harder to show what happened, which can complicate the claim. Our incident response team images systems before anything is wiped, with chain of custody from the first image.

Questions to ask your IT provider before renewal

• Can you produce evidence for each security question on our application?
• Which accounts or devices are exceptions to MFA or EDR, and why?
• When did we last restore from backup, and how long did it take?
• Which of our systems are out of support or can't be patched?
• Who preserves evidence if we are attacked, and how?
• Are you on our carrier's approved vendor list, or do we need consent to use you?

Where our guarantee fits, and where it doesn't

Some IT providers now put their own commitments in writing. Ours has two parts. Under The Big Sky Guarantee, for certified clients we do the response work, including containment, forensics, eradication, recovery and rebuilding if needed, at no additional cost within defined service limits. The Big Sky Service Warranty provides eligible payments directly to the organization, up to $500,000 per covered incident, depending on plan.

Both apply only to certified clients on qualifying plans who keep the required controls in place, and eligibility requirements, service limits and exclusions apply. Neither is insurance, and neither replaces a cyber insurance policy. We recommend keeping one. The guarantee and warranty page explains how certification works.

Where to start

Pull last year's application and go through it with your IT provider line by line. Mark each answer as proven, partly true or not in place. Fix what you can before renewal, and answer the rest honestly. If you'd like help closing the gaps, our security operations team monitors around the clock and keeps the evidence carriers ask for.