To get through your cyber insurance renewal without risking your coverage, answer every question truthfully, match each claim to what’s actually in place, and use the next 30 days to tighten backups, two-step login, wire verification, device security, and vendor checks—then document what you did.
Why Cyber Insurance Renewal Forms Got Longer
Carriers rewrote their applications after three big losses in 2023–2024. The MOVEit supply‑chain breach surfaced on May 28, 2023, when Progress Software received unusual activity reports. The Cl0p group had been abusing a new flaw in MOVEit Transfer as early as February. By late 2023, more than 2,650 organizations and over 66 million people were affected, with totals still climbing into 2024. That experience changed how insurers probe third‑party software risk.
In February 2024, the Change Healthcare ransomware event stalled U.S. healthcare claims for weeks. The attacker got in on February 12 and launched ransomware on February 21. HIPAA Journal reported a missing multifactor step at a key entry point. Industry estimates put insurance losses from that one incident at over $250 million, which led to tougher questions about immutable backups and incident response.
Also early in 2024, an Arup deepfake wire fraud case showed how convincing synthetic audio and video can be. A finance employee in Hong Kong sent $25.6 million across 15 transfers after a video call with AI‑generated “executives.” The issue went undetected for about a week. Now, out‑of‑band callbacks for wires appear on nearly every application.
If you handle sensitive payments or data—e‑commerce with cardholder info, healthcare with PHI, firms that move client funds, or real estate escrow—expect the longest questionnaire. Those are the areas where carriers took the hardest hits.
What Carriers Now Ask About Backups
The single “do you back up?” checkbox is gone. Today’s forms ask if backups are immutable or air‑gapped, when you last tested a restore, and whether domain admin credentials could delete those backups.
Look for language like: “Are backups stored immutably or air‑gapped, tested for restoration in the past 12 months, and inaccessible to domain administrator credentials?”
Immutable means no one can change or erase the backup during a set retention period—even with stolen admin rights. Air‑gapped means the copy sits somewhere your production network cannot reach. The CISA Stop Ransomware Guide calls for immutable, tested backups as a baseline, which mirrors most insurers’ expectations.
“Microsoft 365 backup” by itself doesn’t clear the bar. Built‑in Microsoft 365 retention is not what carriers mean, and any third‑party copy that relies on the same identity as your production tenant can be wiped by a compromised global admin.
The strongest response mentions a platform using object lock or write‑once‑read‑many storage, an immutability window of at least 14 days (30 days is now preferred), separate credentials from your normal admin accounts, and a recent, documented restore test. A weaker response—like daily copies to a NAS on the same network with no recent restore test—often triggers follow‑ups and sometimes a premium change. If immutability is unclear, you risk sub‑limits or even non‑renewal.
Two‑Step Login Now Has Multiple Checks
What used to be one checkbox for two‑step login (multi‑factor authentication, or MFA) is now a series. You’ll see questions about enforcement on email, VPN, remote desktop, all admin accounts, and privileged service accounts. A clean pass expects “yes” across the board.
Text message codes are seen as the weakest option because of SIM‑swaps and phone network flaws. Many carriers ask if you use an authenticator app, a hardware key, or a push with number matching instead of SMS. Still using SMS for admin accounts? Plan on follow‑up questions or pricing impact.
You may also see “privileged access management” (PAM). This is a toolset that keeps powerful admin credentials out of ordinary password vaults, rotates them when used, and records sessions—so a stolen admin password can’t lurk undetected for weeks.
Stronger answers describe a vault that rotates credentials on use and logs every session. Weaker answers—like shared admin passwords in a regular password manager with annual rotation—usually trigger underwriting scrutiny. Shared admin accounts that never rotate and don’t track who used them are most likely to lead to sub‑limits or a non‑renewal.
Will you be denied if two‑step login isn’t everywhere? Not always. Expect higher premiums, reduced ransomware limits, or exclusions for incidents tied to the unprotected doorway.
Wire Transfers: Callback Rules and Deepfake Awareness
After the Arup case and a wave of business email compromise losses, applications now ask about callback verification. Before sending any wire above a set amount (often $10,000 or $25,000), the approver must call a previously verified phone number—not the number in the request—to confirm.
Expect wording like: “Do you require out‑of‑band verification using a previously known phone number for all funds transfer requests above [threshold], including those appearing to be from executives?”
Many forms also ask if your team has been trained on AI voice cloning and deepfake video risks. Firms that move client funds—accounting, law, and real estate—get the most attention here.
A strong answer cites a written wire policy with callback verification to a verified number above a named threshold, dual approval, and annual social‑engineering training that includes deepfakes. “We usually verify” without a policy is flagged for follow‑up. Email‑only approvals are now frequently declined for coverage.
EDR, MDR, And Why Antivirus Alone No Longer Passes
Traditional antivirus looks for known bad files. Endpoint Detection and Response (EDR) watches what programs do on each computer or server and flags things like file encryption attempts or privilege escalation. Managed Detection and Response (MDR) adds a 24/7 team to watch alerts and act when something fires at 2 a.m. on a Sunday.
Applications now ask whether EDR covers 100% of your computers and devices, including servers, and whether a round‑the‑clock security operations center responds to alerts. The MDR question is often a simple yes/no—with a pricing gap between them.
If you don’t have MDR yet but plan to, say so with dates. Underwriters can work with a specific, near‑term plan (for example, “MDR go‑live in Q2; vendor selected”). Vague intentions don’t help.
Questions About Your Software Vendors
Supply‑chain risk used to be one checkbox. After MOVEit and Change Healthcare, many carriers now include a full vendor section.
Common ask: “List your top five software vendors with access to sensitive data and confirm whether each provides a SOC 2 Type II report or equivalent.” If you’ve never requested a SOC 2 from your practice management vendor, it’s time.
You’re not expected to audit every control. Insurers want to see you know your top vendors, what data they hold, and that you’ve asked for basic assurances like SOC 2. An honest status—“we identified our top five and requested three SOC 2 reports; two pending”—is better than confidence that falls apart later.
Avoid The Costly Mistake: Misrepresentation And Rescission
Cyber applications function like warranty statements. If a forensic review after a claim shows your environment didn’t match what you attested to, the insurer can rescind the policy.
Rescission treats the policy as if it never existed: the claim is denied, and any earlier payouts that term can be clawed back. In some cases, courts have held that the insurer doesn’t need to prove the misstatement caused the loss; the misstatement alone is enough.
The fix is straightforward. If a question asks about two‑step login on all admin accounts and you have a gap, disclose it and give a remediation date. Carriers generally prefer honest gaps with a plan over polished answers that fail in a forensic check.
Checking “no” or “in progress” may raise premiums or tighten terms. That cost is predictable. Misrepresentation discovered after an incident can void coverage entirely—leaving you with the full bill.
The 30‑Day Pre‑Renewal Checklist
Work through these in order. Most organizations around Panama City can tackle them within a month.
- Week 1. Confirm two‑step login on email, VPN, remote desktop, every admin account, and any service accounts that support it. Move admins off SMS to an authenticator app or hardware key.
- Weeks 1–2. Ensure backups are immutable or air‑gapped. Perform a test restore and keep dated notes/screenshots.
- Week 2. Write a one‑page wire policy requiring callback to a previously verified number for transfers above your chosen threshold. Have every approver sign it.
- Weeks 2–3. Verify EDR is on every computer and server. If you only have traditional antivirus, get EDR/MDR quotes now so you can give a real deployment timeline.
- Week 3. Identify your top five software vendors and request SOC 2 (Type II) or equivalent attestations. Track responses.
- Weeks 3–4. Update your incident response plan and run a one‑hour tabletop with leadership. Keep notes—that’s proof it was tested in the past 12 months.
- Week 4. Complete the application honestly. Flag anything not yet fixed, with a specific date to close the gap.
Frequently asked questions
What does rescission mean on a cyber policy?
It means the insurer voids the policy from the start due to a material misstatement. The current claim is denied, and prior payouts that term can be recovered.
Will my policy be denied if I don’t have two‑step login everywhere?
Not necessarily. Expect higher costs, lower ransomware limits, or exclusions tied to the unprotected entry point. Gaps on admin or service accounts are the most common.
What’s the difference between EDR and MDR on the form?
EDR (Endpoint Detection and Response) is the software that watches behavior on each device. MDR (Managed Detection and Response) adds a 24/7 team to monitor and respond. Many carriers now want both and ask about them separately.
Why did renewal applications get longer?
Specific 2023–2024 losses drove the change: the MOVEit breach, the Change Healthcare incident, and the Arup deepfake wire fraud. Those events reshaped questions about backups, two‑step login, vendor risk, and wire verification.
Can a claim be denied if I answered wrong?
Yes. A material misrepresentation can lead to rescission, which voids coverage retroactively. In many cases, insurers don’t have to prove the misstatement caused the loss.
What does “immutable backup” mean on the application?
A copy that can’t be changed or deleted for a set time, even with stolen admin rights. Common approaches include cloud object lock and write‑once‑read‑many storage. Most carriers look for at least 14 days, with 30 days preferred.
Sources and further reading
- Cybersecurity Dive: MOVEit breach timeline — timeline of the 2023 vulnerability and the scale of impact.
- Fortune: Arup deepfake $25M fraud — how the January 2024 Hong Kong deepfake scam unfolded.
- HIPAA Journal: Biggest healthcare data breaches of 2024 — analysis of the February 2024 Change Healthcare incident and its impact.
- CISA: Stop Ransomware Guide — federal guidance aligned with what insurers now ask.
If your cyber insurance renewal is coming up and the checklist feels bigger than the calendar, we can help you prioritize what’s doable now for your Bay County office. Let’s talk—get in touch.
—
