Cyber Insurance Requirements: What Carriers Ask You to Prove

Prices fell. Requirements did not.

Cyber insurance is cheaper than it was. The entry requirements are not lighter.

Marsh reports global cyber rates fell 4% in the second quarter of 2026, the twelfth straight quarterly decline. US cyber rates fell 2%. If your clients renewed at a lower premium this year, that is the market working normally.

What carriers did not drop is the control checklist. The questions about MFA, remote access and privileged accounts are the same ones they asked in 2022. What changed is how the answers are treated. A "yes" on the application is a statement of fact the carrier can test when a claim comes in. A control that exists and a control you can show are not the same answer at claim time.

That changes the renewal conversation with clients. The pitch is not that premiums are rising. It is that low-cost coverage comes with conditions, and evidence is what makes the policy pay.

You are on your client's application

MSPs used to help with the technical section. Current forms ask about the provider directly.

Tokio Marine HCC's NetGuard Plus new business application is a clear example. The January 2022 edition already asks for the name of an outsourced network security provider, whether MFA protects "all local and remote access to privileged user accounts," and whether any service provider with network access has had an unscheduled outage of more than four hours in the past three years. The March 2026 edition goes further. Its remote access MFA question covers "all employees and third parties" and names "any RMM (Remote Management and Monitoring) applications." It also asks who the main contact for the security provider is.

So your RMM is inside your client's MFA answer, your company's name goes to an underwriter, and an outage on your side becomes part of their risk.

The claims data explains why. At-Bay's 2026 InsurSec Report, based on more than 6,500 claims and 100,000 policy years, found:

VPNs accounted for 73% of ransomware attacks in 2025, up from 38% two years earlier.
VPNs and remote desktop (RDP) together triggered 87% of ransomware claims.
For businesses under $25 million in revenue, ransomware frequency rose 21% and severity rose 40%, to $422,000.
Third-party liability claims rose 70%, the largest increase of any incident type.

Remote access is what MSPs run, and third party is where MSPs sit.

Most of the questions ask one thing

Read the privileged access questions together and they reduce to one: if an attacker gets a credential in this environment, how much access does it carry, and for how long?

The problem underneath is standing privilege. An account holds admin rights all the time, whether or not anyone is doing admin work. A domain admin account sitting idle on a Tuesday afternoon. A technician account with permanent local admin on 900 endpoints. A service account from 2019 whose password has never changed.

That is how a phishing click becomes a ransomware event. Sophos's State of Ransomware 2026, a survey of 2,158 IT and security leaders at organizations hit by ransomware, found 79% of attacks started with compromised identities. A carrier can't patch your clients. It can ask whether a stolen credential carries standing admin rights, and it can ask you to prove the answer.

Five control areas and the proof behind each

The privileged access questions on the forms we reviewed fall into five areas. Each one has a specific artifact that backs it up. Each maps to a phase of the PAM journey to zero standing privilege.

MFA on privileged access (phase 5). Carriers ask whether MFA protects admin accounts on local and remote paths, including VPN, RDP and RMM. The proof is a policy export showing scope and an authentication log showing prompts on admin sessions, dated close to the application.
Privileged access management (phases 3, 4 and 6). Carriers ask whether a privileged access management tool controls access to privileged credentials. The proof is access grant records with timestamps and durations, an approval trail, and rotation records.
Separate and standing admin accounts (phases 1, 2 and 6). Carriers ask whether IT staff use separate credentials for admin work and who holds persistent admin access to machines other than their own. The proof is a privileged account inventory with an owner for each account, a stale account report, and an offboarding log showing the gap between termination and disablement.
Logging and audit trails (phase 7). Carriers ask whether access logs are kept, for how long, and whether privileged accounts are monitored. The proof is an export covering the policy period: who accessed what, when, approved by whom, for how long.
Local admin rights (phase 8). Carriers ask whether ordinary users hold local admin on their own devices. The proof is a report of local admin group membership across every endpoint, plus a log of approved exceptions.

None of these requires a new security control. Each one is a report, an export or a log. Either it already exists in a system you run, or it doesn't exist at all. If it exists, your answer holds up. If it doesn't, your answer is a claim.

The four tests evidence has to pass

The applications we reviewed ask for answers, not documents. The request for proof usually comes later, when a claim is filed. An adjuster isn't judging whether your security is good. They are checking whether a specific answer was true on a specific date.

Timestamped. It shows what was true during the policy period. A screenshot taken after the incident proves you fixed it.
Attributable. It ties actions to a named person. Shared technician accounts fail this test.
Scoped. It covers everything the answer claimed. "MFA is enforced" and "MFA is enforced on 94% of admin accounts" are different answers.
Produced on demand. You can pull it together in hours. If it takes a three-day project across four tools, you don't have evidence yet.

Three ways a missing answer costs money

These three cases show three different outcomes. The difference matters, because brokers and clients who know the cases will check.

The policy is voided. In Travelers v. International Control Services (C.D. Ill., 2022), the insured answered "yes" to requiring MFA for administrative or privileged access. Travelers alleged MFA protected only the firewall, and that intruders reached a server it didn't protect. The parties agreed to rescind the policy and treat it as void from the start, and the court dismissed the case in August 2022. There is no ruling on the merits.
The loss falls outside the policy. The City of Hamilton, Ontario, was hit by ransomware in February 2024. Its insurer declined the claims, and a city staff report quoted the policy: no coverage was available "for any losses where the absence of MFA was the root cause." The city disputes that missing MFA caused the breach.
The provider is sued. In ACE American Insurance Co. v. Congruity 360 and Trustwave (D.N.J., filed September 15, 2025), the carrier said it paid more than $500,000 after a ransomware attack on its insured. It then sued the client's IT infrastructure provider, alleging it "never established nor enforced MFA to log into the network" as its contract required, along with the client's security monitoring provider. In June 2026 the court dismissed the claims against the monitoring provider and most of the claims against the infrastructure provider, but let the contract claim over MFA go ahead. That claim is unproven.

The third case is the one for MSPs. The client was paid, and the carrier then went after the provider whose contract covered the control that failed. If your name is on the application, you are easy to find.

What to do before the next renewal

These steps don't require a new product. They require a schedule and a paper trail.

Run the 90-day test this week. Pick one client. Ask a technician to export every privileged access event from the last 90 days, with the approver and duration for each, without help. Time it. That is your real answer to "can you provide logs of privileged access."
Build an evidence pack 90 days before each renewal. Privileged account inventory, MFA enforcement scope, the privileged access audit trail, the local admin report, the offboarding log. Review the gaps while there is still time to close them.
Answer from configuration, not memory. If a form asks something you can't literally confirm, answer "no" and add a note describing the control you do have. Underwriters can work with a "no" that has context. A "yes" that turns out to be wrong can void the policy.
Put responsibilities in writing, per client. For each control, list who enforces it, who owns the exceptions, and who produces the evidence. Offboarding causes a lot of disputes: you act, but the client has to tell you first. Keep a timestamp on every termination notice.
Keep a copy of every application you help with. Date it, and save the evidence behind each answer at the time you gave it.
Ask your own broker one question. Does your errors and omissions or tech liability coverage respond to a subrogation claim from a client's insurer? That is a different case from a client suing you directly.
Get ahead of the help desk. None of the carrier forms we reviewed asks how you verify a caller before a password or MFA reset. It is a likely next question: the joint CISA and FBI advisory on Scattered Spider describes attackers using social engineering to get IT help desk staff to reset passwords and MFA tokens. Write down your process and make each verification leave a record. See how MSPs stop help desk social engineering.

An MSP that can hand a client a dated evidence pack at renewal is doing work the broker can't do and the client can't do alone. It also has a budget attached, because the client pays the premium either way. It can be priced as a recurring service tied to the renewal date.

Where Panthera fits

Panthera is a PAM platform built for MSPs. It covers the eight phases of the PAM journey in one place. It is not a governance, risk and compliance (GRC) platform, it doesn't manage a compliance program, and it doesn't fill out applications. It enforces privileged access controls and keeps the record of them.

A few questions show where that matters on a renewal:

Could you list every privileged account in a client's Active Directory, Entra ID and local Windows admin groups today, including service accounts and the ones nobody remembers? Panthera's discovery builds that inventory, human and non-human accounts included.
If a technician's admin account were disabled until the moment it was needed, and needed an approval to turn on, what would an attacker get by stealing it? Panthera's just-in-time accounts stay disabled until a technician activates one, and a second approval can be required first.
When did each privileged password last change? Panthera stores credentials in a zero-knowledge vault and rotates them on a schedule or on demand.
When an underwriter asks for logs of privileged access, where do they come from? Panthera logs privileged account usage, including who asked for access and who approved it, and the privileged-access evidence your auditors and insurers ask for is generated for you, on demand.

It won't cover backups, EDR or phishing training, which carriers also ask about. It covers the privileged access questions.

Frequently asked questions

What do cyber insurance carriers require from MSPs in 2026?

The applications we reviewed ask for MFA on all remote access, with one 2026 form naming RMM tools, and MFA on privileged accounts. Several also ask whether a privileged access management tool controls admin credentials, whether ordinary users hold local admin rights, and how long access logs are kept. Some ask for the name of the outsourced network security provider.

Can a cyber insurance policy be voided over an MFA answer?

Yes. In Travelers v. International Control Services (2022), the parties agreed to rescind the policy after the insurer alleged MFA protected only the firewall, although the application said MFA covered administrative and privileged access. The court dismissed the case, so there is no ruling on the merits.

Can a client's insurer sue the MSP?

It can try. In ACE American Insurance v. Congruity 360, filed in 2025, the carrier paid its insured and then sued the IT provider, alleging it failed to set up MFA as its contract required. In June 2026 the court let that contract claim go ahead and dismissed most of the others. The case is ongoing.

What evidence should an MSP keep for a client's cyber insurance renewal?

A dated privileged account inventory, an MFA policy export showing scope, a privileged access audit trail for the policy period, a local admin membership report, and an offboarding log with timestamps. Build it 90 days before renewal.

Does privileged access management help with cyber insurance?

It helps with the privileged access questions: time-bound admin access, credential management, rotation and audit trails. It doesn't cover backups, EDR or training. The value is being able to show the control, not only describe it.

This article is not legal or underwriting advice. Answer every application question based on your own environment.

Sources: Marsh Global Insurance Market Index, Q2 2026 (July 23, 2026); Tokio Marine HCC NetGuard Plus application NGP-NBA (1.2022), questions 5.b, 7.g, 7.h, 7.l and 10.c; Tokio Marine HCC NetGuard Plus application NGP-NBA (3.2026), questions 8.a(2), 8.c, 12.b and 13.b–c; At-Bay Cyber Ransomware Supplemental Application AB-CYB-RSA (06/2026), questions 10–12; Travelers Multi-Factor Authentication Supplement CYB-14306 (Rev. 03-23); Chubb Cyber Enterprise Risk Management proposal form (09/22), questions 8 and 10; Coalition cyber application (2022); At-Bay 2026 InsurSec Report release (April 22, 2026); Sophos, State of Ransomware 2026 release (July 2026); Travelers v. International Control Services, C.D. Ill. 2:22-cv-02145, docket and complaint (July 6, 2022); Insurance Journal on the Travelers v. ICS stipulation (August 30, 2022); CBC on the City of Hamilton claim (July 31, 2025); ACE American Insurance Co. v. Congruity 360, D.N.J. 2:25-cv-15657, docket, complaint (September 15, 2025) and opinion (June 24, 2026); CISA and FBI advisory AA23-320A, Scattered Spider (updated July 29, 2025).