Worth Watching: Cyber Insurance Gets Harder
Renewal questionnaires increasingly ask for evidence of MFA coverage, tested backups, and timely offboarding, not simply confirmation that controls exist.
CareScope Editorial/September 2, 2026/2 min read
The short version
- Questionnaires now ask which systems have MFA, not whether you use MFA.
- Backup questions are shifting to "when did you last restore?" rather than "do you back up?"
- Inaccurate answers create coverage disputes at exactly the wrong moment.
Why it matters
A questionnaire answered optimistically is a coverage problem waiting for a claim. Underwriters are asking narrower questions and comparing answers to what they find after an incident.
Two shifts are worth noting. First, control questions have become specific: which systems are covered by multi-factor authentication, how quickly access is removed after termination, whether administrative accounts are separated. Second, backup questions increasingly ask about the last successful test restore, not the backup schedule.
The practical risk is not the premium. It is answering yes to something that is mostly true, then having that answer examined during a claim.
The CareScope take
Before your next renewal, walk the questionnaire with whoever administers your systems and answer from evidence. If an answer would need to be "partly", fix the gap or disclose it — a restore test and an MFA coverage list are a week of work, and they are the two things most likely to be checked.
Sources
- Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information — HHS Office for Civil Rights
- Health Industry Cybersecurity Practices (HICP) — HHS 405(d) Program
- Cybersecurity Framework — NIST
CareScope cites primary sources — regulators, standards bodies, and published research — wherever a claim depends on them. Reporting is editorially independent and is not legal advice.
insurance · controls · backups
