Insurance stopped taking your word for it
Cyber insurance used to be a form you filled in and a box you ticked. After years of rising ransomware payouts, that era is over. Insurers now underwrite on actual controls, and at claim time they check whether the controls you attested to were really in place. Answer the questionnaire loosely and you risk a higher premium, reduced cover, or — worst of all — a denied claim exactly when you need to be paid.
For Georgia small businesses this is a real shift. The questionnaire has teeth now, and the answers have to be provable, not aspirational.
The controls insurers now expect
The specifics vary by insurer, but the same core controls appear on nearly every 2026 questionnaire. If you cannot demonstrate these, expect friction:
- Multi-factor authentication on email, remote access and administrative accounts
- Monitored endpoint protection — not just antivirus that is installed and forgotten
- A regular patching process for operating systems and key software
- Off-site, ransomware-resistant backups with limited retention windows closed
- Evidence of a tested restore, often within the last 90 days
The one question most businesses fail
There is a single question that trips up more businesses than any other: have you tested a restore in the last 90 days? Most owners have a backup running and assume that is the same as being able to recover. It is not. An untested backup routinely turns out to be incomplete, misconfigured or corrupted — and the discovery happens mid-crisis.
Our clients answer that question with a yes and a document, because we run a real restore every quarter and hand over a written report. That report is precisely the artifact an insurer wants to see.
How to actually prove it
Proving your controls is a documentation exercise as much as a technical one. You need a record that MFA is enforced, that endpoints are monitored, that patching happens, and that a restore was tested and succeeded. Assembled after the fact under deadline pressure, this is miserable. Maintained as a matter of routine, it is a formality.
That is the whole idea behind our cyber-insurance evidence pack: the proof is generated continuously, so renewal is a formality rather than a fire drill.