Cyber Insurance Requirements for SMBs in 2026
What cyber insurance underwriters require in 2026 — and how MSPs can help clients qualify for coverage.
Cyber insurance has gone from "nice to have" to "required by clients, partners, and lenders." But qualifying for coverage in 2026 is significantly harder than it was even two years ago. Underwriters have gotten burned by ransomware claims and have dramatically tightened their requirements. Here's what they're asking for.
Universal Requirements (Every Underwriter)
MFA on everything: Multi-factor authentication on all remote access (VPN, RDP, cloud services), all email (especially admin accounts), and all privileged access. This is now non-negotiable. If you don't have MFA deployed across a client's environment, they will not qualify for cyber insurance.
EDR (not just antivirus): Underwriters specifically require "endpoint detection and response" — behavioral-based detection with automated response capabilities. Traditional signature-based antivirus does not meet this requirement.
Regular backups with offline/immutable copies: Backups must exist, must be tested, and must include at least one copy that cannot be destroyed by ransomware (offline, air-gapped, or immutable storage).
Patch management: Critical patches applied within 30 days. Some underwriters require 14 days for critical vulnerabilities.
Common Additional Requirements
Email security: Anti-phishing protections beyond basic spam filtering. URL rewriting, attachment sandboxing, and impersonation detection.
Security awareness training: Annual training for all employees with phishing simulation.
Privileged access management: No shared admin accounts. Local admin passwords managed centrally. Privileged access monitored and logged.
Incident response plan: Documented IR plan that's been tested or tabletop-exercised within the past year.
Network segmentation: Separation between user workstations, servers, and IoT/OT devices.
The MSP Opportunity
Cyber insurance requirements create a natural upsell path for MSPs. Many of your clients need to meet these requirements to get or renew their cyber insurance. Position your security services as "cyber insurance readiness" — deploy MFA, EDR, email security, security training, patching, and backup testing as a package that ensures your clients qualify for coverage. Some MSPs include a cyber insurance readiness report as part of their standard service offering.