Direct Answer
Cyber insurers typically expect a short list of IT basics: multi-factor authentication on email, remote access and admin accounts, endpoint protection on every device, regular and tested backups, documented patching, a written incident response plan and staff awareness training. The questionnaire is no longer a formality, because insurers increasingly want proof and incorrect answers can put a claim at risk. A device management platform like deeploi helps you enforce and show the device side: encryption, updates, endpoint protection and access removal when someone leaves.
Key Takeaways
- Most insurers ask for the same core controls: MFA, endpoint protection, tested backups, patching, device and access control, an incident response plan and staff training.
- Proof matters. Be ready to show that each control is actually in place, not just claim it.
- Answer the questionnaire honestly. If a control is only partly in place, close the gap first or describe it as it is.
- These basics overlap with NIS2 and customer security questionnaires, so one documented standard serves all three.
- Central device management covers a large part of the device questions. MFA settings, backups, email security and the incident response plan need their own owners.
Your insurance broker sends the renewal documents, and with them a cyber questionnaire. Is multi-factor authentication enforced for everyone? Is endpoint protection installed on every laptop? When was the last backup restore test? Nobody on your team is sure, and the person who set up IT left two years ago.
Cyber insurance applications used to be a short form. Today they often read like a light IT audit, and the answers decide whether you get cover, at what price and whether a claim is paid when it matters. This article explains which IT requirements insurers typically ask for, what proof they may want to see and how to prepare without an IT team. It covers the IT side only. For coverage details and premiums, talk to your broker. This is not insurance or legal advice.
Why do insurers ask about your IT?
Years of ransomware claims have taught insurers that a small number of missing controls cause most of the damage. Asking about them helps them decide who to insure, on what terms and at what price.
The threat is real in Germany. According to Bitkom’s 2025 study, 87% of companies with 10 or more employees were affected by data theft, espionage or sabotage in the past twelve months, with damage of 289.2 billion euros. For SMBs this means stricter questionnaires, more follow-up questions and, with higher coverage limits, sometimes a technical check by the insurer.
What IT requirements do insurers actually ask for?
Requirements and thresholds differ between insurers, so treat this table as the typical list, not a guarantee. Ask your broker for the questionnaire early.
The big three: MFA, endpoint protection and backups
Multi-factor authentication (MFA). This is the most common deal breaker. Insurers usually want MFA on email, remote access such as a VPN, admin accounts and cloud services, not just for some people. A frequent gap is the exception: MFA for most of the team, but not for the admin account or an old shared mailbox. Our guide to introducing two-factor authentication shows how to roll it out.
Endpoint protection. Many insurers now expect more than a classic antivirus scanner. They ask for endpoint detection and response (EDR), a tool that spots suspicious behaviour in real time, on every device. One unmanaged laptop can weaken an otherwise clean answer.
Backups. Insurers care about whether you can restore, not whether a backup exists. Typical expectations are regular backups, at least one copy that is offline or protected against changes (immutable) and a documented restore test. A backup that was never restored is a hope, not a control.
The rest of the list: patching, device control, email, incident plan and training
- Patch management: a defined process and timeframe for critical updates, plus a report with dates. “We patch regularly” is rarely enough. Read more about patch management.
- Device and access control: an inventory of devices, disk encryption, limited admin rights and access removed on the day someone leaves (automated offboarding).
- Email security: filtering for spam and phishing and correctly configured email authentication (SPF, DKIM, DMARC). Your email provider can usually confirm the settings.
- Incident response plan: a written plan with contacts, first steps and who decides. One page is better than none. Our IT security policy template includes a section on incidents.
- Staff awareness: regular training with records. Short sessions that people actually attend beat one long yearly presentation.
Why does proof matter more than the checkbox?
A tick in a questionnaire is a statement. Insurers increasingly ask you to back it up, and after an incident they may check whether the controls were really in place. If MFA was declared for all accounts but the breached account had none, the insurer has a reason to question the claim.
Incorrect or incomplete answers can have serious consequences. In Germany, insurance contract law expects you to answer risk-relevant questions truthfully, and some policies contain obligations such as keeping backups or applying updates. Depending on the case, a breach of these duties can reduce or remove the payout. Ask your broker or a lawyer how this applies to your policy.
Three practical rules:
- Do not tick “yes” for something that is only partly in place. Close the gap first or describe it as it is.
- Keep your evidence in one folder: screenshots of settings, reports with dates, the restore test record, the incident plan and training records.
- Re-check before every renewal and after bigger changes, such as a new tool or a new location.
How do you prepare before the questionnaire arrives?
- Get the questionnaire early. Ask your broker for the current version, or a sample, before the renewal date.
- Take stock. List all devices, accounts and tools, including old accounts and shared mailboxes.
- Close the gaps in order. Start with MFA everywhere, then endpoint protection on every device, a backup restore test, documented patching and clean offboarding.
- Write a one-page incident response plan. Name who to call, who decides and what to do in the first hour.
- Collect the evidence. Put settings, reports and records into one folder with dates.
- Name one owner. One person answers the questionnaire and keeps the folder current.
How does central device management help with the answers?
Many questions are about devices, and that is where central management helps most. With a platform like deeploi you can:
- keep one inventory of all devices, with the owner and status of each
- enforce disk encryption, password rules and screen lock policies on every managed device
- apply security updates automatically and see which devices are behind
- run endpoint protection on all managed devices (deeploi works with WithSecure)
- lock or wipe a lost device remotely
- deactivate accounts and wipe devices on the last working day through automated offboarding
That turns many answers into facts you can show instead of statements you hope are true. deeploi is also ISO 27001 certified, GDPR compliant and hosted in the EU, which is useful when an insurer or broker asks about your IT provider.
Be clear about the limits. Device management does not replace your MFA settings in Google Workspace or Microsoft 365, your backup solution, your email security settings, your incident response plan or staff training. Those need an owner too. And no tool makes you insurable on its own, because the insurer makes that decision.
What about NIS2 and customer security questionnaires?
The same basics answer three audiences: insurers, NIS2 and your customers’ security questionnaires. If you build one documented standard, you can reuse the same evidence for all of them instead of answering the same questions three times.
Conclusion
Cyber insurance helps with the financial fallout of an incident, but it does not replace security, and it only works if the controls you declared are in place when something happens. The good news for SMBs: the requirements are a short, familiar list. Start with MFA, endpoint protection and tested backups, document your patching and your incident plan, and keep the proof in one place.
If you would rather not collect device evidence by hand, deeploi manages encryption, updates, endpoint protection and offboarding from one platform. Book a demo to see how it works.
Book a demo and see how deeploi helps you prepare for your next cyber insurance questionnaire
Frequently asked questions
What IT requirements do cyber insurers ask SMBs for?
Typically MFA on email, remote access and admin accounts, endpoint protection on every device, regular and tested backups, documented patch management, device and access control, a written incident response plan and staff awareness training. Exact requirements differ by insurer.
Can a small company without an IT team get cyber insurance?
Yes, if the basic controls are in place and you can answer the questionnaire truthfully. Without an IT team, central device management and an external IT partner help you meet the device-related requirements and document them.
What happens if I answer the questionnaire incorrectly?
Incorrect or incomplete answers can affect your cover or a later claim. The exact consequences depend on your policy and the circumstances, so ask your broker or a lawyer. The safest approach is to answer truthfully and close gaps before you apply.
Is antivirus enough, or do I need EDR?
Many insurers now ask for more than classic antivirus and expect endpoint detection and response (EDR) or similar protection on every device. Check the wording of your questionnaire, and ask your broker if you are unsure.
How can I show an insurer that my devices are secure?
With a device inventory that shows owner, encryption and update status, a report on endpoint protection coverage and records of how you remove access when someone leaves. A device management platform can provide much of this.
