To qualify for or renew cyber insurance, a 10 to 50 person insurance agency should be ready to show 8 controls: multifactor authentication, endpoint detection and response, email security, tested backups, patching, security awareness training, admin account controls, and an incident response plan. Applications vary by carrier, but these come up again and again.
Answering "yes" isn't the hard part. The hard part is making sure every "yes" is actually true, and having the proof ready if a carrier asks for it, or if you ever need to file a claim.
Your agency sells this coverage, so your team already knows these applications. This post is about the other side of the form: what has to be in place behind each answer.
The 8 Controls, and What "Yes" Actually Means
"We have MFA" and "we have backups" are the kind of answers that cause problems later. Here's what each "yes" should mean:
- Multifactor authentication: required on every email account, and turned on for remote access, admin accounts, and every other system that supports it. Not "most users."
- Endpoint detection and response: every computer and server monitored around the clock, with real people reviewing alerts, not just antivirus installed and forgotten.
- Email security: filtering for phishing and impersonation, plus a call-back step before anyone acts on changed payment instructions.
- Tested backups: copies that can't be altered by ransomware, stored separately, and actually restored on a schedule to prove they work.
- Patching: updates applied on a set schedule, with critical security patches pushed right away.
- Security awareness training: ongoing training and phishing tests for every employee, with results you can show.
- Admin account controls: admin rights limited to the people who need them, admin passwords rotated, and a former employee's access shut off on their last day.
- Incident response plan: a written plan for who does what, and who gets called, if something happens.
Proof, Not Checkboxes: What to Have Ready at Renewal
For our agency clients, the evidence behind most of these answers is produced as part of everyday service:
- Backups: a full restore test of every backup every other week, with a screenshot of the restored system as proof. Backup status is reviewed every business morning.
- Training: weekly simulated phishing emails and short weekly training modules, with each employee's score reviewed with management every quarter.
- Patching: updates tested on a small group first and rolled out after 3 days; critical patches pushed immediately; every change logged.
- Vulnerabilities: monthly vulnerability scans and a vulnerability report every quarter.
- Monitoring: 24/7 managed detection and response through a human-staffed Security Operations Center.
Does Ohio's or Indiana's Insurance Data Security Law Apply to Your Agency?
Both states have adopted insurance data security laws, and both exempt smaller licensees from the written information security program requirements.
- Ohio: Under Ohio Revised Code 3965.07, a licensee is exempt from the information security program requirement if it meets any one of three tests: fewer than 20 employees, under $5 million in gross annual revenue, or under $10 million in assets at fiscal year-end. That exemption covers the program requirement only, not the law's notification requirements.
- Indiana: The Indiana Department of Insurance lists exemptions for licensees with fewer than 50 employees, or under $5 million in gross annual revenue, or under $10 million in year-end assets.
Here's how that plays out at three agency sizes:
- 12-person Ohio agency: exempt from Ohio's program requirement on employee count alone. The carrier still asks all 8 questions at renewal.
- 35-person Ohio agency with $6 million in revenue: over the employee and revenue tests, but still exempt if its assets are under $10 million. An Ohio agency has to exceed all three tests before the program requirement applies.
- 40-person Indiana agency: under Indiana's 50-employee threshold. The carrier's questions still apply.
In other words, being exempt from a state requirement doesn't exempt you from your carrier's application. These laws can change, and exemptions have conditions, so confirm your agency's obligations with your attorney.
Where Agencies Get Tripped Up
- MFA on email, but not everywhere else. Remote access and admin accounts are often the gaps.
- Backups that run but have never been restored. A backup job that says "successful" isn't proof the data comes back.
- Former employees' accounts still active. Especially producers who left on good terms.
- Answers that were true last year. Systems change, and the application should reflect what's in place today.
An inaccurate answer on an application can become a problem at the worst possible moment: after a claim. For more on that, read cyber insurance isn't a checkbox.
Who's Responsible for What
- Your IT provider: putting the technical controls in place, keeping them working, and producing the evidence.
- Your agency: answering the application accurately, verifying payment and banking changes by phone with a known contact, and deciding your legal obligations with your attorney.
- Your carrier: underwriting, pricing, and coverage decisions.
How We Help Agency Clients Through Their Cyber Insurance Application
When an agency client's cyber insurance application or renewal arrives, we go through it together. We take each cybersecurity question and explain what the carrier is asking, how it applies to the protections already in place at the agency, and how to answer it accurately.
Because we manage those protections every day, we can answer the technical questions from what's actually in place, not from guesswork. If a question shows a gap, the agency hears about it before the application is submitted, not after a claim.
The agency still signs the application, and its answers remain its own. Our role is to make sure the people signing understand what they're attesting to.
Why Insurance Agencies Work With Tomorrow's Technology Today
- We require every client to carry at least $2 million in cyber liability coverage, and we carry $2 million in professional and cyber liability coverage ourselves. If we're asking you to be protected, we hold ourselves to the same standard.
- Supporting independent insurance agencies since 2011
- 24/7 managed detection and response and security awareness training included in every plan
- Every backup restore-tested every other week
- Every technician is security-trained to CJIS standards and background-checked
- Our agreements commit us to notify you within 72 hours of confirming unauthorized access to your data in our care
- Owner Lisa Niekamp-Urwin wrote Sitting Duck: Why Your Business Is a Cybercriminal's Ideal Target, a #1 Amazon Best Seller, and is a past president of InfraGard Toledo
See what managed IT includes and what it costs for a 10 to 50 person agency, the 7 layers of protection an agency actually needs, and how we support independent insurance agencies across Ohio and Indiana.
Renewal coming up? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.