The application is the audit now
Five years ago, getting cyber insurance meant filling out a questionnaire and writing a check. Today, carriers are denying renewals, raising premiums 50-100%, and requiring proof of specific controls before they'll even quote.
If you're a vCISO or MSP helping clients get covered, you already know this. The underwriting process has become a de facto security audit — and your clients are failing it.
The good news: the controls carriers want are the same controls you should be implementing anyway. The challenge is proving them quickly and consistently across multiple clients.
What carriers check in 2026
We've analyzed application requirements from major carriers (Coalition, At-Bay, Corvus, Chubb, Travelers, Hartford) and worked with dozens of MSPs through the underwriting process at BlueRadius. Here's what they consistently require:
Tier 1: Non-negotiable (instant denial without these)
Multi-Factor Authentication (MFA)
- Required on: email, VPN, RDP, privileged accounts, cloud admin consoles
- Carriers verify: enrollment percentage, not just "we have it available"
- What they want to see: IdP report showing 95%+ enforcement (Okta, Entra ID)
- Common failure: MFA enabled but not enforced — users can skip it
Endpoint Detection & Response (EDR)
- Required on: all endpoints, including servers
- Carriers verify: deployment coverage percentage, not just "we bought CrowdStrike"
- What they want to see: agent deployment report showing 95%+ coverage
- Common failure: EDR on workstations but not servers, or 60% deployment
Backup & Recovery
- Required: offline/immutable backups with tested recovery
- Carriers verify: backup frequency, retention, and whether you've actually tested a restore
- What they want to see: backup job reports + last restore test date
- Common failure: backups exist but haven't been tested in 12+ months
Tier 2: Strongly affects pricing
Email Security
- DMARC enforcement (p=reject or p=quarantine)
- Anti-phishing training with simulated campaigns
- Inbound email filtering beyond basic spam
- Carriers check DNS records directly — they'll look up your DMARC policy
Vulnerability Management
- Regular scanning (monthly minimum, weekly preferred)
- Defined SLAs for patching critical vulnerabilities
- Evidence of remediation, not just scan reports
- Mean time to remediate (MTTR) under 30 days for critical
Privileged Access Management
- Limited admin accounts (not everyone is a domain admin)
- Separate admin credentials from daily-use accounts
- Session recording or monitoring for privileged access
Tier 3: Differentiators that lower premiums
Incident Response Plan
- Written plan with defined roles, communication procedures, and escalation paths
- Annual tabletop exercise documented
- Retainer with an IR firm (or documented internal capability)
Security Awareness Training
- Regular training (quarterly minimum)
- Phishing simulation results showing improvement over time
- Policy acknowledgment records
Network Segmentation
- Critical systems isolated from general network
- Documented network architecture
- Micro-segmentation for sensitive data stores
Third-Party Risk Management
- Vendor inventory with risk tiers
- Assessment process for critical vendors
- Contractual security requirements
How to prove it without scrambling
The mistake most organizations make is treating insurance applications as a one-time scramble. They dig through systems, screenshot dashboards, export CSVs, and cobble together a package that satisfies the underwriter — then do it all again at renewal.
The better approach: build a continuous evidence pipeline that keeps proof current year-round.
Map controls to evidence sources
Every control the carrier checks can be automatically evidenced from tools you already have:
| Carrier Requirement | Evidence Source | What to Pull |
|---|---|---|
| MFA enforcement | Okta, Entra ID | Enrollment report, policy config |
| EDR coverage | CrowdStrike, SentinelOne | Agent deployment %, last check-in dates |
| Backup testing | Veeam, Datto, Azure Backup | Last successful restore test |
| Vulnerability scanning | Tenable, Qualys | Scan coverage, MTTR metrics |
| Email security | M365, Google Workspace | DMARC policy, phishing sim results |
| Access reviews | Okta, Entra ID | Privileged role audit, last review date |
| Training completion | KnowBe4, Proofpoint | Completion rates, phish-prone % |
| Incident response | GRC platform | IR plan document, tabletop exercise log |
Keep evidence fresh
Carriers don't want a point-in-time snapshot from six months ago. They want to know your current state. That means:
- Automated collection: Pull evidence from integrations on a schedule — daily or weekly, not annually
- Expiration tracking: Flag evidence older than 90 days as stale
- Continuous compliance: Don't just prove you had MFA last quarter — prove you have it right now
This is where a GRC platform with deep integrations pays for itself. Instead of manually assembling proof for each renewal, the evidence is already collected, mapped, and current.
The vCISO advantage
If you're a vCISO or MSP managing multiple clients, cyber insurance readiness is a revenue opportunity, not just a compliance checkbox.
What your clients are dealing with:
- Renewal denied or premium doubled
- Application questions they don't know how to answer
- Carrier asking for evidence they can't produce
- 30-day deadline to implement controls or lose coverage
What you can offer:
- Pre-underwriting assessment: identify gaps before the application
- Rapid remediation: deploy MFA, EDR, backup within weeks
- Evidence package: ready-to-submit proof of every control
- Continuous monitoring: keep the client insurable year-round, not just at renewal
BlueRadius works with MSPs and vCISOs to build exactly this kind of practice — combining strategic advisory with the technical implementation that carriers require. Whether you need help structuring your cyber insurance readiness offering or need a platform to manage evidence across clients, the goal is the same: make your clients insurable and keep them that way.
The framework shortcut
Here's something most people miss: if your client already has SOC 2 or ISO 27001 compliance, they've already satisfied 80%+ of what carriers check. The controls overlap almost entirely.
| Carrier Requirement | SOC 2 Control | ISO 27001 Control | NIST CSF |
|---|---|---|---|
| MFA | CC6.1 | A.9.4.2 | PR.AC-7 |
| EDR | CC6.8, CC7.1 | A.12.6.1 | DE.CM-4 |
| Backups | CC7.5, A1.2 | A.12.3.1 | PR.IP-4 |
| Vuln Management | CC7.1 | A.12.6.1 | DE.CM-8 |
| Incident Response | CC7.3, CC7.4 | A.16.1.5 | RS.RP-1 |
| Training | CC1.4 | A.7.2.2 | PR.AT-1 |
| Access Reviews | CC6.2, CC6.3 | A.9.2.5 | PR.AC-1 |
If you're already managing compliance frameworks for your clients, you're sitting on the evidence carriers need. The work is done — you just need to package it for the underwriter.
Bottom line
Cyber insurance isn't going away, and the requirements aren't getting easier. The carriers that survived the ransomware wave of 2021-2023 learned their lesson: they need verified controls, not self-reported checklists.
For MSPs and vCISOs, this is an opportunity. Your clients need help getting insured and staying insured. The controls carriers require are the same controls you're implementing. The evidence they want is the same evidence you're collecting.
Build the pipeline once, keep it current automatically, and every renewal becomes a non-event instead of a fire drill.
Need help building a cyber insurance readiness practice? BlueRadius partners with MSPs and vCISOs on strategic advisory and technical implementation. Or start a free trial of Radius360 to manage evidence collection and compliance across all your clients.
