Cybersecurity
Cyber insurance requirements for small businesses in BC: a practical checklist
Cyber insurance applications now read like a security audit. Insurers want to know whether you use multi-factor authentication, endpoint detection and response, protected backups, patching, staff training and an incident response plan. Here's what each question means and how to answer it accurately.
This article explains common technical requirements. It isn't insurance or legal advice. Your broker and policy wording decide what applies to you.
The controls insurers ask about most
| Requirement | What it means in practice |
|---|---|
| Multi-factor authentication (MFA) | Required for email, remote access (VPN, remote desktop) and admin accounts. "Most users" usually isn't enough; insurers often ask about all users and all remote access. |
| Endpoint detection and response (EDR) | More than basic antivirus: software that detects suspicious behaviour, can isolate a computer, and is monitored by someone. |
| Backups | Regular backups of critical data, with at least one copy offline, offsite or immutable, plus evidence of test restores. |
| Patching | Operating systems and software updated within a set time, especially critical security updates; no unsupported systems facing the internet. |
| Email security | Spam and phishing filtering, and often SPF, DKIM and DMARC on your domain. |
| Security awareness training | Regular staff training on phishing and fraud, sometimes with simulated phishing tests. |
| Privileged access | Separate admin accounts, limited to the people who need them, protected by MFA. |
| Incident response plan | A written plan for who does what during a cyber incident, including contacts for your insurer's breach hotline. |
| Payment verification | A documented callback process before changing payee bank details, to reduce funds transfer fraud. |
How to prepare for your application or renewal
- Get the questionnaire earlyAsk your broker for the application a month or more before renewal, so there's time to close gaps.
- Check, don't guessHave each control verified on your actual systems. "I think we have MFA" often turns out to mean "some users have MFA on some apps".
- Close the gaps that matter mostMFA everywhere, EDR on every computer and server, and protected, tested backups usually come first.
- Keep evidenceScreenshots of MFA enforcement, EDR coverage reports, backup and restore test logs, and training records.
- Write the incident planOne or two pages is enough for most small businesses, as long as people know where it is.
A useful baseline
If you want a free, Canadian framework to work from, the Canadian Centre for Cyber Security's baseline controls for small and medium organizations cover nearly everything insurers ask about, from incident response and patching to MFA, training, backups and access control.
How Star X helps
We go through your insurance questionnaire with you, verify each control, fix what's missing, and give you the documentation to back up your answers. For most small offices, the typical gaps can be closed in a few weeks. See cybersecurity services or call (778) 312-2227.
Questions we hear a lot
Still unsure? Call (778) 312-2227 and ask a technician directly.
Why do insurers ask so many technical questions?
Because ransomware and email fraud claims have been expensive, insurers price and approve policies based on the controls known to reduce those losses. Missing controls can mean higher premiums, exclusions or a declined application.
What happens if we answer a question incorrectly?
Answers on the application are part of the policy. If a claim reveals a control you said you had wasn't in place, the insurer may dispute or reduce the claim. Speak to your broker about your specific policy.
How long does it take to meet typical requirements?
For a small office, MFA, EDR and backup improvements can often be done in one to three weeks. Training and an incident plan can run alongside. We can prioritize what your renewal date requires.
Stop fighting your IT. Hand it to us.
Call now for urgent problems, or book a free, no-obligation IT assessment for your office.