Cyber insurance MFA requirements: what small businesses should have in place before renewal
If you have filled in a cyber-insurance application or renewal recently, you have probably noticed that multi-factor authentication (MFA) comes up again and again. Carriers word their questions differently, and we can't tell you what your specific insurer will require. What we can do is walk through the areas where MFA questions commonly appear, how to check whether you are genuinely covered, and how to keep evidence so you can answer honestly.
Important: this is general information, not insurance or legal advice. Always read your own application and policy wording, and ask your broker when a question is unclear. Answering "yes" to a control you don't actually have can put a claim at risk.
Why insurers care about MFA
Most small-business incidents start with someone getting into an account they shouldn't: a reused password, a phished login, or an exposed remote-access tool. MFA adds a second check (an app prompt, a code, or a security key) so a stolen password on its own isn't enough. CISA describes MFA as one of the simplest, most effective steps an organization can take to protect accounts (see CISA's MFA guidance).
From an insurer's point of view, missing MFA on the most-attacked logins makes a costly claim more likely, which is why it shows up on so many applications.
The five places MFA questions commonly appear
1. Email (including web and mobile access)
Business email is where invoice fraud and account takeovers happen. A typical question asks whether MFA is enforced for all users on company email. "All" matters: one shared mailbox or a former employee's account left without MFA is a gap.
Check: in Microsoft 365 or Google Workspace, pull the per-user MFA or 2-Step Verification report and confirm every active account is enrolled and that enforcement is on, not merely available.
2. Remote access to your network
VPNs, remote desktop and remote-support tools are common ransomware entry points. Applications often ask whether every form of remote access requires MFA, and sometimes whether Remote Desktop Protocol (RDP) is exposed to the internet at all.
Check: list every way someone can connect in from outside: VPN, RDP gateways, remote-support tools your IT provider uses, and remote access built into firewalls. Each one needs MFA.
3. Administrator and privileged accounts
An attacker with an admin account can disable security tools and delete backups. Expect questions about MFA on admin accounts, including cloud admin portals (Microsoft 365, Google Workspace, your domain registrar, your accounting system).
Check: make a list of every account with admin rights, confirm each uses MFA, and make sure admins use a separate account for daily email and browsing.
4. Backups and critical cloud applications
Ransomware groups go after backups so you can't recover without paying. Some applications ask whether access to backup consoles is protected by MFA. The same logic applies to banking, payroll and line-of-business cloud apps.
5. Your IT provider's access
If a managed service provider (MSP) or outside IT person can log in to your systems, their access needs MFA too. A compromised provider can affect every client at once. Ask your provider to confirm this in writing.
Not all MFA is equal
Text-message codes are better than nothing, but they can be intercepted or phished. Authenticator-app push prompts with number matching are stronger. Phishing-resistant methods such as FIDO2 security keys and passkeys are strongest, and CISA recommends them for high-value accounts (see CISA's MFA guidance). A practical approach for a small business:
- Authenticator app with number matching for every user.
- Security keys or passkeys for administrators and anyone who approves payments.
- Block legacy email protocols (basic authentication, POP/IMAP) that can bypass MFA.
Write it down: policy plus evidence
When an underwriter or claims adjuster asks, "Is MFA enforced?", a screenshot and a written policy beat a verbal "I think so." Keep:
- A short, approved password and MFA policy stating which systems require MFA and which methods are allowed.
- Screenshots or exports showing MFA enforcement for email, remote access and admin accounts, dated.
- A list of exceptions (if any), who approved them and when they will be fixed.
A 30-minute MFA self-check before renewal
- Export your email user list and MFA status; fix any unenrolled accounts.
- List every remote-access path; confirm MFA on each.
- List admin accounts; confirm MFA and separate daily-use accounts.
- Confirm MFA on backup, banking and payroll logins.
- Ask your IT provider to confirm in writing that their access uses MFA.
- Save the evidence in one folder, dated, and note it in your readiness checklist.
If you want to skip the blank page, our Password & MFA Policy template gives you an editable policy to adopt, and the Cyber-Insurance Readiness Checklist tracks MFA alongside the other controls applications commonly ask about, with owner and evidence columns.