Cyber Insurance Requirements for WV Businesses: The IT Controls Your Insurer Will Ask About
November 15th, 2026
Cyber insurance has changed from a policy a business bought and filed away to an underwriting process that looks a lot like a security audit. Insurers received years of ransomware claims, and they responded by requiring the controls that prevent the losses they were paying for. For a West Virginia small business, that means the application is now a list of technical questions, and the answers have consequences.
The questions are specific: Do you require multi-factor authentication? Is your endpoint protection actively monitored? Are backups immutable, and have you tested a restore? Can you produce evidence? A business that answers yes without the control in place is not just at risk of a denied claim. It may be at risk of having the policy voided for misrepresentation.
This article covers the controls insurers most often ask about, what proof looks like, and how to prepare before renewal.
Why the Questions Got Harder
Ransomware claims changed the math for carriers. A single incident can produce ransom, recovery, legal, notification, and business interruption costs that far exceed years of premiums. Insurers now know which controls reduce the frequency and severity of those claims: multi-factor authentication, endpoint detection, patching, segmented networks, tested backups, and monitoring. They price and underwrite accordingly.
The result is a market where a business with strong controls can still buy coverage, sometimes at a better rate, while a business without them may face exclusions, higher deductibles, lower limits, or a declined application.
The Controls Insurers Ask About Most
Multi-factor authentication
This is usually the first question and often the one that matters most. Insurers want MFA on email, remote access, and every administrative account. Some applications specifically ask whether MFA is required for all users, whether it can be bypassed, and whether legacy authentication protocols are blocked.
What proof looks like: a screenshot or report from Microsoft 365 or Google Workspace showing MFA enforced for all users and legacy authentication disabled. A policy that says employees should use MFA is not the same as enforcement.
Endpoint detection and response
Basic antivirus is no longer enough. Insurers increasingly ask for endpoint detection and response, or EDR, that is centrally managed and monitored. Some policies specify that alerts must be reviewed, not just generated.
What proof looks like: the product name, the number of endpoints covered, and who monitors the alerts. If nobody reviews them, the control is incomplete.
Backups that survive an attack
Insurers ask whether backups exist, whether a copy is kept offline or immutable, how often backups run, and when a restore was last tested. The key question is not whether a backup exists. It is whether the backup would survive an attacker with access to the network.
A cloud backup tied to the same administrator account as the rest of the environment does not satisfy the intent of the question. Immutable storage, separate credentials, and documented restore tests do. We covered the technical side in cloud backup that survives ransomware.
Patch management
Insurers ask how often operating systems, applications, and network equipment are patched, and whether critical patches are applied within a defined window. Most want to see a scheduled process, not a habit of updating when someone remembers.
What proof looks like: a patch report showing compliance rates and the dates critical updates were applied.
Email security
Phishing remains the most common way into a small business network. Insurers ask about email filtering, link and attachment scanning, impersonation protection, and phishing training. Some ask whether external email is flagged and whether DMARC is configured for the company domain.
What proof looks like: the email security platform in use, filtering settings, and training completion rates. Our article on business email compromise protection covers what the layered version looks like.
Least privilege and administrative controls
Insurers want to know whether employees have only the access they need, whether administrators use separate accounts, and whether privileged access is limited. A network where every user is a local administrator is a harder risk to underwrite.
What proof looks like: a list of administrative accounts, the process for granting elevated access, and confirmation that daily work is not done from an administrator account.
Remote access controls
Remote desktop protocol exposed directly to the internet is a known ransomware entry point. Insurers ask how remote access is provided, whether it requires MFA, and whether RDP is exposed. The expected answer is a VPN or zero-trust remote access service with MFA, and no direct RDP exposure.
Network segmentation and firewalls
Insurers may ask whether the network is segmented, whether the firewall is current and supported, and whether guest and business traffic are separated. Segmentation limits how far an attacker can move after the first machine is compromised.
Monitoring and logging
Questions about 24/7 monitoring, log retention, and alerting are increasingly common. Some insurers require a managed detection and response service for larger policies. For smaller businesses, the practical version is centralized logging and someone who reviews the alerts.
Incident response plan
Insurers want to know whether the business has a written incident response plan, who calls whom, and whether the plan has been tested. A plan that lives in a binder nobody has opened does not count for much.
What proof looks like: the plan itself, the last tabletop exercise date, and the contact list for legal, insurance, and IT.
Employee training and asset inventory
Phishing awareness training, acceptable use policies, and a current inventory of hardware and software show an insurer that the business knows what it owns and is managing the human side of risk. These are lower-cost controls that support the technical ones.
What "Documented" Actually Means
Insurers are not asking whether you believe the control exists. They are asking whether it can be demonstrated. In practice, that means:
- Configuration screenshots or exported reports, not verbal descriptions
- Dates: when MFA was enforced, when the last patch was applied, when the last restore test happened
- Named responsibility: who reviews alerts, who approves access, who tests the plan
- Consistency: the answer on the application matches what the environment actually does
This is why the application should be filled out by someone who can see the systems, not only by whoever handles the insurance relationship. A well-meaning yes to a question about monitoring can become a coverage problem if the monitoring is not real.
Common Mistakes on the Application
- Claiming controls that are planned but not deployed. Intent is not a control. Wait until it is in place, or disclose the gap and ask how it affects the policy.
- Confusing antivirus with EDR. They are different products and insurers know the difference.
- Calling a backup tested because the job log is green. A restore test is the evidence. A successful backup job is not.
- Assuming Microsoft 365 defaults are enough. Default settings often leave legacy authentication open and MFA unenforced for some accounts.
- Letting the policy renew without reviewing the answers. Your environment changes during the year. The application should change with it.
How to Prepare Before Renewal
Start with the questionnaire itself. Most insurers will provide it before the renewal date, and that document is the best gap list available. Map each question to a control, then to evidence.
Where a gap exists, decide whether to close it or disclose it. Closing it is usually cheaper than discovering after a claim that the policy does not respond. A managed IT provider can produce the reports, enforce the settings, and document the controls in the format an underwriter expects.
It also helps to involve your insurance agent early. Requirements vary by carrier, industry, revenue, and policy size. An agent who writes cyber policies in West Virginia can tell you which controls the market is currently asking for, and what evidence the carrier will accept.
A Policy Is Not a Security Plan
Cyber insurance transfers some of the financial risk. It does not prevent an incident, restore your data, or keep your business running while the claim is processed. The controls insurers require are the same controls that reduce the chance you will need to file a claim at all. That is the useful part of the exercise.
If your renewal is coming up and you are not sure whether your environment matches the answers on your application, iTech can review it. We provide Managed IT Services in Parkersburg WV, including the security and backup controls insurers ask about, and we can help you prepare the documentation. Contact us to schedule a cyber insurance readiness review. You can also read about endpoint security for more on the underlying controls.
Posted in: IT Solutions