Does My Small Business Need Cyber Insurance?

Does my small business need cyber insurance?

You need to consider cyber insurance when a security incident could create a bill your business cannot absorb on its own. Start with four pressure points: the information you hold, the systems you rely on, the promises in your contracts, and the cash available when normal work stops.

The scale of the threat is not abstract. The FBI Internet Crime Complaint Center received 859,532 suspected internet-crime complaints in 2024, with reported losses exceeding $16 billion. Its report identified phishing/spoofing, extortion, and personal data breaches as the categories with the most complaints. For a restaurant taking online orders or a fashion retailer managing customer accounts, email and customer information are operational assets, not back-office details.

Use a simple decision test. If a breach would require legal help, customer notification, forensic work, data recovery, or lost income during an interruption, price the policy against that exposure. The Federal Trade Commission describes those as typical first-party cyber costs. It also describes third-party costs such as payments to affected consumers, litigation, regulatory inquiries, settlements, damages, and judgments.

The coverage-fit question: ask, “If our email, ordering system, customer records, or a vendor holding our data were compromised tomorrow, which costs would land on us?” Then ask a broker or insurer whether the proposed policy addresses data breaches, network attacks, vendor-held data, worldwide incidents, and terrorist acts. The FTC recommends checking each of those items.

Do not treat this like an ordinary purchase where the lowest price settles the decision. The same careful term-by-term reading that helps a buyer avoid losing return options on a clearance purchase applies here: a policy that excludes the event most likely to hurt your business is not a bargain.

What security controls do cyber insurers require?

Cyber insurers commonly assess whether you can prevent, detect, contain, and recover from an incident, with MFA, endpoint protection, backups, patching, and incident response forming the practical control set.

Think of the application as an evidence test, not a vocabulary test. Saying “we have backups” is weak. Saying “our backups are protected, restoration-tested, and separated from ordinary access” is stronger because it describes a recoverable process. The Cybersecurity and Infrastructure Security Agency names MFA, patching, tested backups, formal staff training, and a written incident-response plan as core elements of a small-business cybersecurity program.

A 2024 CRC Insurance Services application illustrates the specificity. It asks about MFA for email, remote access, VPN or network authentication, privileged users, and mission-critical systems. It also asks whether endpoint detection and response covers 100% of the environment, whether backups use protections such as immutability and restoration testing, and whether critical systems follow a formal 30-day patching cadence with critical and zero-day patches applied within seven days.

The evidence folder drill: create one folder for the policy application and put the proof beside every answer. Include an MFA export, endpoint coverage report, backup restoration test, patch report, incident-response plan, and exercise notes. This reduces re-explaining at renewal and makes it less likely that an optimistic answer becomes an inaccurate attestation.

Backups deserve special scrutiny. The joint CISA, FBI, NSA, and MS-ISAC ransomware guide recommends offline, encrypted backups of critical data and regular testing of their availability and integrity in disaster-recovery scenarios. Accessible backups can be found, deleted, or encrypted by ransomware; a schedule without a successful restoration test is not proof that recovery will work.

Is MFA required to get cyber insurance?

MFA is often a required or heavily weighted control for cyber insurance, especially for email, remote access, VPNs, privileged accounts, and systems that handle critical business activity.

The precise requirement belongs in the insurer's application and policy terms, not in guesswork. The CRC application asks applicants to identify systems where MFA is enforced, while the NAIC report identifies two-factor authentication and timely patching as examples of controls an insurer may require. The NAIC also warns that failure-to-maintain-security exclusions are common and that some endorsements can reduce coverage when known vulnerabilities are not patched promptly.

Use the “enforced, not encouraged” standard. Weak version: “Staff can use MFA.” Strong version: “MFA is technically required for every account that accesses email, remote systems, administrative functions, and critical systems.” CISA specifically advises technical enforcement rather than voluntary enrollment and says the most important step is ensuring all staff use MFA for key systems, especially email.

Make the rollout concrete. First, inventory the accounts that can access email, payment-related systems, ordering tools, remote access, cloud storage, and administration. Next, enable MFA and remove exceptions that no longer have a documented business need. Then review for non-compliant accounts regularly. That sequence lowers the gap between what your application says and what your configuration proves.

Before you request quotes, run one short tabletop exercise this week: “A staff email account is compromised on a busy service day. Who isolates access, who calls the insurer, who communicates with customers, and where is the offline contact list?” CISA recommends leadership approval of the incident-response plan, quarterly review and exercises, and review after incidents or near misses. The result is not paperwork. It is a rehearsed first hour when the stakes are high.