Canadian Technology AssociationCyber Insurance Readiness Checklist
Exactly what underwriters check before approving your coverage in 2025
Why This Matters Now
In 2023-2024, cyber insurance underwriting became significantly stricter across Canada. Requirements that were "nice to have" are now **mandatory** for coverage approval. Companies failing even one requirement are seeing:
- • Premiums increase 200-400%
- • Coverage limits reduced to $100K (was $1-5M)
- • Ransomware coverage excluded entirely
- • Applications rejected outright
1Authentication & Access Control
Why it matters: 58% of breaches start with compromised credentials. MFA blocks 99.9% of automated attacks.
Multi-Factor Authentication (MFA) enforced for ALL users
CRITICALNot optional. Must be required via Conditional Access, not just 'encouraged'. Includes admins, regular users, and service accounts.
MFA enforced for ALL admin/privileged accounts
CRITICALGlobal Admins, Exchange Admins, Security Admins - zero exceptions. SMS is no longer acceptable; must use authenticator app or hardware token.
Password policy: Minimum 12 characters
Most insurers now require 12+ characters (was 8). Must include complexity requirements or use passphrases.
Privileged access workstations (PAWs) for admin tasks
Admins must use separate, locked-down devices for administrative work. No browsing/email on admin workstations.
Regular access reviews (quarterly)
Document who has access to what, remove terminated employees within 24 hours, review permissions every 90 days.
2Endpoint Protection & Management
Why it matters: Unmanaged devices are the #1 ransomware entry point. EDR detects threats that antivirus misses.
Endpoint Detection & Response (EDR) on ALL devices
CRITICALMicrosoft Defender for Business, CrowdStrike, SentinelOne, or equivalent. Basic antivirus is no longer sufficient.
Mobile Device Management (MDM) for all company devices
CRITICALIntune, Jamf, or equivalent. Must enforce encryption, PIN requirements, and remote wipe capability.
Full disk encryption on all laptops and desktops
CRITICALBitLocker (Windows), FileVault (Mac), or equivalent. Must be centrally managed and auditable.
Automatic security updates enabled
Windows Update, macOS updates must install within 30 days of release. No user override allowed.
BYOD policy prohibiting unmanaged devices from accessing company data
If allowing BYOD, must use MAM (Mobile Application Management) with containerization.
3Email Security
Why it matters: 91% of cyberattacks start with phishing. Advanced email security reduces risk by 80%.
Advanced anti-phishing protection (beyond basic Exchange Online Protection)
CRITICALMicrosoft Defender for Office 365 P1/P2, Proofpoint, Mimecast, or equivalent. Must include Safe Links and Safe Attachments.
SPF, DKIM, and DMARC configured and enforced
Email authentication to prevent spoofing. DMARC policy must be set to 'quarantine' or 'reject', not 'none'.
External email warning banners
Visual indicators when email originates outside your organization.
Attachment blocking for dangerous file types
Block .exe, .scr, .bat, .js, .vbs, .iso files from email. Use Safe Attachments for documents.
4Backup & Recovery
Why it matters: Ransomware destroys backups first. Immutable backups are your last line of defense.
Microsoft 365 data backup (separate from Microsoft)
CRITICALVeeam, AvePoint, Datto, or equivalent. Microsoft retention policies are NOT backups. Must backup Exchange, OneDrive, SharePoint, Teams.
Immutable/air-gapped backups (cannot be encrypted by ransomware)
CRITICALMust use immutable storage or offline backup copies that ransomware cannot reach.
Backup testing performed quarterly
Document successful test restores. Must prove you can actually recover data.
Retention: 30-90 days minimum
Most insurers require 30+ days of backup retention. 90 days preferred.
Off-site backup storage (different geographic location)
Protects against regional disasters (fire, flood, earthquake).
5Security Awareness Training
Why it matters: Employees are the weakest link. Regular training reduces phishing click rates by 70%.
Annual security awareness training for ALL employees
CRITICALKnowBe4, SANS, Microsoft training, or equivalent. Must be documented with completion tracking.
Phishing simulation testing (quarterly)
Send fake phishing emails, track who clicks, provide remedial training.
Training covers: phishing, password security, social engineering, ransomware
Must include real-world examples relevant to your industry.
New employee security training within first week
Part of onboarding process, before access to company systems.
6Incident Response Planning
Why it matters: Fast response limits damage. Companies with IR plans recover 50% faster.
Written Incident Response Plan (IRP)
CRITICALDocument who to contact, what steps to take, how to contain breaches. Update annually.
24/7 emergency contact information documented
IT provider, cyber insurance hotline, legal counsel, forensics firm.
Tabletop exercise performed annually
Simulate a ransomware attack with leadership team. Document lessons learned.
Cyber insurance policy number and contact readily accessible
Don't wait until you're breached to find this information.
7Network Security
Why it matters: Attackers scan for open ports and weak firewalls. Network segmentation limits lateral movement.
Firewall with Intrusion Detection/Prevention (IDS/IPS)
Modern next-gen firewall (Fortinet, Palo Alto, Cisco, WatchGuard). Must be configured properly, not default settings.
Remote Desktop Protocol (RDP) disabled or secured
RDP is a common ransomware vector. If required, must be behind VPN with MFA.
VPN for all remote access (no direct RDP/SSH)
Zero Trust VPN preferred. Split-tunnel VPN acceptable if properly configured.
Network segmentation (separate VLANs for different business functions)
Guest WiFi isolated from corporate network. Servers segmented from workstations.
Log retention: 90 days minimum
Firewall logs, authentication logs, security event logs. Required for forensics.
8Vendor & Third-Party Risk Management
Why it matters: 60% of breaches originate from third-party vendors. You're liable for their security failures.
Vendor security questionnaires for critical vendors
IT providers, cloud services, payroll processors. Ask about their MFA, backups, incident response.
Business Associate Agreements (BAAs) for vendors handling sensitive data
Required for PIPEDA compliance. Must define security responsibilities.
Vendor access review (quarterly)
Remove vendors who no longer need access. Ensure vendors use separate accounts, not your admin credentials.
Cyber liability insurance verification from critical vendors
Vendors should carry their own cyber insurance. Get Certificate of Insurance.
How Underwriters Score You
All "Critical" items passed:
Likely approved. Standard premiums. Full coverage available.
1-2 "Critical" items missing:
Conditional approval. 30-90 day remediation period. 50-100% premium increase. Ransomware coverage may be excluded.
3+ "Critical" items missing:
Application rejected outright. Must remediate before reapplying.
See Where You Stand
Get your free security score and see which requirements you're passing or failing.
Get Your Free Security Score →