What underwriters look for in 2026
Cyber insurance underwriting has tightened significantly since 2023. Underwriters no longer accept self-attested questionnaires at face value; they want documented evidence of specific controls.
- Multi-factor authentication (MFA): Required on all remote access, email, and administrative accounts. Underwriters verify implementation, not just policy.
- Endpoint detection and response (EDR): Antivirus alone is no longer sufficient. Underwriters require active EDR on all endpoints with documented alert response procedures.
- Backup and recovery testing: Backups must be tested regularly, with documented recovery time objectives (RTO) and recovery point objectives (RPO).
- Incident response plan: A written, tested plan with defined roles, communication procedures, and escalation paths.
- Security awareness training: Documented annual training with phishing simulation results.
Organizations that cannot demonstrate these controls face premium increases of 30-100% or outright denial of coverage.
The five most common documentation gaps
Most businesses have implemented the required controls but cannot prove it to an underwriter. The gap is documentation, not capability.
- Gap 1: MFA coverage gaps. MFA is enabled on email but not on VPN, RDP, or cloud admin consoles. Underwriters check all access paths.
- Gap 2: No backup test records. Backups run nightly, but no one has tested a full restore in 12+ months. Without test records, underwriters assume the backups do not work.
- Gap 3: Outdated incident response plan. The plan was written three years ago and references employees who have left. Underwriters check for annual reviews.
- Gap 4: Missing training completion records. Training was conducted, but completion records were not retained. Without proof, underwriters treat it as not done.
- Gap 5: No vulnerability management cadence. Patches are applied reactively rather than on a documented schedule. Underwriters want to see a defined patching cadence with compliance metrics.
Closing these gaps typically takes 30-60 days of focused effort, well worth starting before the renewal window opens.
How to build a renewal-ready evidence packet
A structured evidence packet dramatically improves the renewal experience. Instead of scrambling to answer underwriter questions reactively, you present a complete package that demonstrates control maturity.
- Control inventory: A spreadsheet mapping each underwriter requirement to your specific implementation, with evidence links
- MFA audit report: Screenshots or admin console exports showing MFA enrollment rates and covered systems
- EDR deployment report: Endpoint coverage report from your EDR platform showing active agents on all devices
- Backup test log: Dated records of restore tests with results, including RTO/RPO measurements
- Incident response plan: Current version with review date, role assignments, and contact information
- Training records: Completion reports from your security awareness platform, including phishing simulation metrics
Presenting this packet proactively signals organizational maturity to the underwriter. Horizon Management used this same structured approach to achieve California healthcare compliance, reinvesting $84,000 in annual telecom savings into the security controls underwriters require.
When to start preparing
Start preparing your renewal evidence packet at least 90 days before your policy expiration date. This provides enough time to close gaps without rushing.
- 90 days out: Conduct an internal assessment against the underwriter's prior-year questionnaire. Identify documentation gaps.
- 60 days out: Close technical gaps (extend MFA coverage, run backup tests, update the incident response plan). Begin compiling the evidence packet.
- 30 days out: Complete the evidence packet. Review with your broker to ensure alignment with expected underwriter questions.
- At renewal: Present the completed packet alongside the application. Request premium credit for demonstrated improvements.
Organizations that follow this timeline consistently achieve better premiums and faster approvals. Those that wait until the renewal notice arrives spend more, get less favorable terms, and risk coverage gaps. A vCISO can manage this entire preparation cycle as part of ongoing governance.
