The Cyber Insurance Readiness Checklist

Why this checklist exists

Coalition's 2026 Cyber Claims Report calls 2026 the "Year of Technical Validation." Insurers no longer ask "do you have these controls?" — they ask "can you prove they were enforced at the time of the incident?" Chubb, Beazley, and Travelers 2026 policies now include Condition Precedent clauses that void coverage if the forensics don't add up.

Your enterprise clients are asking the same questions through vendor-risk questionnaires. This is the checklist that lets you walk into any of those conversations ready.

What's inside

1. Multi-Factor Authentication — on every account that touches data, enforced by policy, with phishing-resistant methods preferred
2. Endpoint Detection & Response — managed EDR/XDR, not basic antivirus, with 24/7 monitoring
3. Email authentication — SPF, DKIM, and DMARC (at least p=quarantine) — post Microsoft's May 2025 enforcement
4. DNS filtering — office and remote, with category policies and log retention
5. Automated, immutable backups — with a restore test logged in the last 12 months
6. Team password manager — with sharing governance and offboarding workflow
7. Acceptable Use Policy — signed by every employee, including AI and device clauses
8. Security awareness training — annual minimum, with simulated phishing and retained records
9. Privileged access management — no shared admin accounts, just-in-time elevation for cloud roles
10. Incident response plan — written AND tested in the last 12 months, with insurer hotline as step one