The Cyber Insurance Checklist: What SMBs Actually Need to Prove to Get Covered (Part 2 of 3)
In Part 1, we talked about how cyber insurance shifted from trust to proof. Insurers aren't just taking your word anymore. They want evidence. Real, timestamped, auditable evidence that your security controls actually work.
So what exactly are they looking for? And more importantly, what happens if you check "Yes, we have MFA" on your application when you've only got it enabled for some accounts?
Let's break down the 10 domains insurers scrutinize and the proof you'll need to back up your claims.
The 10 Insurable Domains (And What "Proof" Really Means)
Think of these as the foundation of your cyber insurance eligibility. Insurers assess each one individually, and weakness in any area can mean higher premiums or outright denial.
1. MFA and Identity Protection
This one's non-negotiable now. Multi-factor authentication isn't optional anymore. It's the baseline. But here's where SMBs get tripped up: having MFA available isn't the same as having it enforced.
What insurers want to see:
- MFA enrollment logs showing which accounts are protected
- Conditional access policies that block sign-ins without MFA
- Reports showing zero successful logins without second-factor verification
If you've got MFA turned on for admins but not for everyone else, that's a partial control. And partial doesn't count.
2. Endpoint Protection (EDR)
Traditional antivirus doesn't cut it anymore. Insurers want Endpoint Detection and Response (EDR) tools that can detect, investigate, and contain threats in real time.
What they're looking for:
- EDR deployment across all devices (laptops, desktops, servers)
- Activity reports showing the tool is active and scanning
- Evidence of threat detection and automated response capabilities
You can't just install it and forget it. Insurers want to see that it's actually working and producing security events.
3. Email and Web Security
Email remains the #1 attack vector for SMBs. Phishing, business email compromise, credential theft: it all starts in the inbox.
Proof needed:
- Advanced email filtering beyond basic spam protection
- DMARC, SPF, and DKIM policies configured and enforced
- Web filtering that blocks known malicious sites
- Logs showing blocked phishing attempts and quarantined threats
If you're relying solely on Microsoft 365's built-in protection, you're probably under-protected. We've written before about why native tools alone aren't enough.
4. Network Security
Firewalls, segmentation, and access controls prove you're not running a flat, wide-open network where attackers can move laterally.
What insurers check:
- Firewall configuration and rule sets
- Network segmentation policies
- VPN or Zero Trust access for remote workers
- Logs showing denied connection attempts
5. Patch Management
Unpatched vulnerabilities are low-hanging fruit for attackers. Insurers know this, which is why they want evidence you're keeping systems current.
Required documentation:
- Automated patch deployment schedules
- Reports showing patch compliance rates across all devices
- Evidence that critical patches are applied within 30 days
This is where "shared responsibility" in cloud environments trips up SMBs. Microsoft patches their infrastructure, but you're responsible for patching your endpoints and on-premises systems.
6. Backups and Recovery
Ransomware is still the biggest threat to SMBs. Your ability to recover without paying determines whether you stay in business.
What insurers demand:
- Automated, encrypted backups stored offsite or in the cloud
- Backup logs showing successful completion
- Restore test logs (proof you've actually tried recovering data)
- Immutable backups that attackers can't encrypt
Here's the thing: saying "we back up to OneDrive" isn't enough. You need versioning, offline copies, and evidence you've tested recovery.
7. Incident Response Plan
This is where SMBs often have nothing to show. An incident response plan isn't a wish list. It's a documented, tested playbook for when (not if) something goes wrong.
Proof required:
- Written IR plan with defined roles and escalation procedures
- Tabletop exercise records showing you've practiced
- Contact lists for legal, forensic, and breach notification teams
- Documentation of post-incident reviews
Insurers want to see that you won't just panic and wing it when attackers strike.
8. Security Awareness Training
Your employees are both your weakest link and your first line of defense. Insurers know attackers target people, not just technology.
What they're checking:
- Records of regular security awareness training
- Phishing simulation results and trends
- Documented policies around password hygiene, reporting suspicious emails, and data handling
One annual training video isn't going to cut it. Insurers want ongoing, measurable education programs.
9. Third-Party and Vendor Risk
Your security is only as strong as your weakest vendor. If a third party gets breached and they've got access to your systems, you're on the hook too.
Documentation needed:
- Vendor security assessments
- Contracts with security requirements and SLAs
- Evidence of ongoing vendor monitoring
- Lists of who has access to what data
This is especially critical for cloud environments where SaaS apps and integrations are everywhere.
10. Governance and Compliance
This is the catch-all: policies, procedures, and proof that someone is actually in charge of cybersecurity.
What insurers look for:
- Security policies that are documented and enforced
- Evidence of compliance with relevant regulations (HIPAA, PCI-DSS, GDPR)
- Audit trails and access logs
- Designated security roles and responsibilities
If you don't have someone accountable for security, insurers assume you're winging it.
The Material Misrepresentation Trap
Here's where SMBs get into serious trouble: the application.
You're filling out the cyber insurance questionnaire, and you see questions like:
- "Do you have multi-factor authentication enabled?"
- "Do you have endpoint protection deployed?"
- "Do you maintain offsite backups?"
You think, "Well, we've got some MFA... most of our laptops have antivirus... we back up most things to OneDrive." So you check "Yes."
That's material misrepresentation. And it can void your entire policy.
Insurance contracts operate on a principle called "utmost good faith." If you say you have a control in place and the insurer discovers during a claim investigation that you only had partial coverage, they can deny the claim and potentially rescind the policy altogether.
This isn't about being dishonest. Most SMBs genuinely believe they're covered when they're not. But from an insurer's perspective, there's no difference between "Yes, we have MFA" and "Yes, we have MFA on 40% of accounts." One is a control. The other is a gap.
The fix: If your answer is "partial" or "in progress," check "No" and document what you're working on. Honesty protects you far more than optimism.
What Specific Proof Do You Actually Need?
Okay, so you've got the controls in place. Now you need to prove it. Here's what insurers are asking for during underwriting and claims:
MFA Enrollment Logs
- Screenshots or exports from your identity provider (Azure AD, Google Workspace, Okta)
- Reports showing percentage of users with MFA enabled
- Conditional access policy configurations
EDR Activity Reports
- Agent deployment status across all endpoints
- Threat detection summaries (what was blocked, when)
- Alerts and incident logs
Backup Restore Logs
- Proof you've successfully restored data in the last 90 days
- Backup completion reports showing no failures
- Offsite/cloud backup configurations
Email Security Logs
- DMARC enforcement reports
- Quarantine and block statistics
- Phishing simulation results
Training Records
- Attendance lists from security awareness sessions
- Completion rates and quiz scores
- Phishing simulation click rates over time
The Critical 365-Day Log Retention Requirement
Here's one that catches SMBs off guard: insurers now require at least 365 days of security log retention.
Why? Because when a breach happens, forensic investigators need to trace back months to understand how attackers got in, what they accessed, and what data was compromised. If you only keep 30 or 90 days of logs (which is the default in many systems), you've got a forensic blind spot.
What needs 365-day retention:
- Sign-in and authentication logs
- Email security logs
- Firewall and network traffic logs
- EDR event logs
- Administrative action logs
This is where Microsoft 365 and Google Workspace defaults fall short. Out of the box, M365 keeps most logs for only 90 days. You'll need to configure extended retention or export logs to a SIEM.
Can't prove what happened six months ago? Insurers may assume the breach was worse than it actually was and adjust your claim accordingly.
What Happens If You Can't Prove It?
Let's say you suffer a ransomware attack. You file a claim. The insurer's forensic team starts investigating and asks for your EDR logs, MFA enrollment reports, and backup restore tests.
If you can't produce them, here's what happens:
- Claim delay while they try to piece together what you actually had in place
- Reduced payout because they assume gaps in your controls contributed to the breach
- Denial if they determine you materially misrepresented your security posture during underwriting
The burden of proof is on you. Not being able to document your controls is nearly as bad as not having them in the first place.
How Black Clover Can Help You Build and Maintain This Proof
Here's the reality: most SMBs don't have the time, tools, or expertise to collect, organize, and maintain all this documentation.
At Black Clover Cyber Security, we help SMBs prove their controls before they need to file a claim:
- Continuous monitoring that generates the logs and reports insurers require
- 365-day log retention configured and maintained
- Quarterly security reviews that document your posture over time
- Pre-packaged evidence bundles ready for underwriting or claims
We're not just protecting you from threats. We're making sure you can prove you're protected when it matters most.
Ready to close the gaps? Let's talk about what proof you've got and what you still need. Reach out to Black Clover and we'll help you build a defensible, insurable security posture.
Next, in Part 3: the Cyber Insurance Action Plan, and how to turn your security into your greatest sales asset.
Disclaimer: This article is for informational purposes only and does not constitute legal, insurance, or professional advice. Consult with a qualified cyber insurance broker or attorney for guidance specific to your situation.