YOUR RENEWAL QUESTIONNAIRE IS LONGER THIS YEAR. THAT IS NOT JUST EXTRA PAPERWORK.
For most of the last decade, cyber insurance underwriting ran on trust. You filled out an application, you checked some boxes, and a carrier wrote a policy. Underwriters now treat the application as the start of a technical review rather than the end of one, and they want evidence behind the answers.
The first thing almost every one of them looks at is multi-factor authentication.
Marsh, one of the largest insurance brokers, publishes a list of twelve cyber hygiene controls that carriers treat as essential to insurability. MFA sits at the top of it.
On the application, that control rarely shows up as a single yes or no. It breaks into three parts, and underwriters want a yes on all three:
Read the footnotes on your questionnaire. Carriers define MFA differently, and some now specify stronger, phishing-resistant methods for administrative accounts at higher limits. Those definitions sit in the fine print, and they decide whether your answer is accurate.
Marsh's own research found that MFA delivers its benefit when it is implemented fully rather than partially. That is the same thing an underwriter is measuring. Not whether you have it. Whether you finished.
Answering yes when the reality is partial is the version that hurts most. If something goes wrong later and the compromised account turns out not to have had MFA on it, the conversation is no longer about coverage. It is about whether your application was accurate.
The application is written for an office. Your operation is not an office.
Here is where we usually find the gaps in a co-op or a plant:
Shared accounts on the floor. One login used by whoever is on shift. MFA either breaks the workflow or gets bypassed, so it never gets turned on.
Seasonal and temporary users. During planting, harvest, or a production ramp, accounts get created fast and cleaned up slowly. Those accounts tend to sit outside whatever policy covers everyone else.
Service accounts and app passwords. The integration someone set up two years ago, running on a password that never expires and never sees a second factor. Underwriters ask about these specifically now.
Systems that predate modern authentication. Older line-of-business and plant systems were built before any of this existed. The usual workaround is an exception, and exceptions have a way of becoming permanent.
Vendor and remote support access. Equipment vendors who dial in to a machine or a controller often come through a path nobody is enforcing MFA on, because the vendor set it up and nobody revisited it.
Break-glass admin accounts. The emergency account, deliberately excluded so it works when everything else does not. That one is on the form by name.
None of these mean you are careless. They mean MFA is quick to turn on and slow to finish, and the finishing is what the carrier is asking about.
If you research this topic, you will run into a widely repeated statistic about what share of denied cyber claims involved organizations without proper MFA. The carrier that figure is credited to has stated publicly that they never published any data on claim denials.
We are an IT company writing about insurance, which puts us in the same category as most of the sites repeating it. So our standard here is simple. If we cannot point you to the source, we leave it out. You will not find a scary number in this article. You will find what is on the form.
Turn every yes into a percentage. Not “we have MFA.” Instead: enforced on 100% of remote access, 100% of cloud email, and 96% of privileged accounts, with three service accounts excepted and documented. A documented 96% holds up better than an undocumented 100%, because the second one falls apart the moment anyone checks.
Pull the exceptions list. Export enrollment from your identity provider and look at who is not covered. That list is your real answer, and most teams have not opened it in a year.
Ask your broker what evidence the carrier wants. More carriers want exports and policy screenshots rather than attestation. Knowing the format in advance is the difference between a clean renewal and a scramble.
Give yourself sixty days. Closing gaps on shared accounts and older systems is a project, not a setting. It usually changes how people log in, which takes longer than the technical work does.
MFA gets the most attention because it is the eligibility gate. It is not the only control underwriters score. Expect questions on all of these, and expect to supply evidence rather than assurances:
Endpoint detection and response. Carriers want EDR on every workstation and server, with monitoring behind it. Traditional antivirus does not answer this question.
Backups that have been restored. Not whether backups run. Whether someone has restored from them recently, how long it took, and whether the copies are isolated enough to survive an attack that reaches your network.
Privileged access management. How many admin accounts exist, whether they are separate from the daily-use accounts those same people read email from, and how they are monitored.
A written incident response plan. Who gets called, in what order, with what authority. Underwriters increasingly ask whether anyone has practiced it.
Security awareness training. Documented participation, not a one-time video. This shows up as a standard data point on renewal applications now.
Remote access hardening. Whether RDP is exposed to the internet, and what sits in front of it if it is.
Each of these is a project of its own. The useful move is to find out which ones you would currently fail before an underwriter does it for you.
When we work renewal prep with a client, we start by pulling actual coverage numbers instead of asking what they believe is in place. Those two answers differ more often than not.
The rest is unglamorous: closing gaps on shared and seasonal accounts, finding a path for systems that will not support modern authentication, getting service accounts under control, and documenting what is left so the submission holds up under questions.
We will say the part that gets skipped. Some of this changes how your people log in, and that is a conversation with your operations team, not only your IT team. It's better to address this before the end of the year than during a claim.
If your renewal is coming up and you are not sure where you might be falling short, let's take a look.