# What security controls do cyber insurers usually require?

A short list comes up in most application forms, although each insurer sets its own. Expect questions about multi-factor authentication (MFA) for e-mail, remote access and administrator accounts; backups kept offline or immutable and tested by a restore; timely patching, especially of systems reachable from the internet; endpoint detection and response (EDR) on laptops and servers; e-mail filtering and staff awareness training; restricted administrator rights; an incident response plan; and some form of monitoring with a named person who responds. Answer for the whole company, not the best-run part, and write down the evidence behind each “yes”. The form is part of the contract, so a wrong answer weighs more than a missing control you disclosed. NetSenX covers part of the monitoring question: on every plan, Free included, it detects beaconing to command-and-control servers, scanning, lateral movement and unusual outbound data volume on the segments it watches. It is not MFA, EDR or a backup, and does not replace them.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Cyber insurance](https://netsenx.com/en/faq/insurance) · https://netsenx.com/en/faq/what-security-controls-do-cyber-insurers-require

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Is multi-factor authentication mandatory for cyber insurance?](https://netsenx.com/en/faq/is-mfa-mandatory-for-cyber-insurance)
- [Do cyber insurers require endpoint detection and response on every device?](https://netsenx.com/en/faq/do-insurers-require-edr-on-every-endpoint)
- [What do cyber insurers ask about ransomware protection?](https://netsenx.com/en/faq/what-do-insurers-ask-about-ransomware)
- [Why was our cyber insurance renewal declined or made more expensive?](https://netsenx.com/en/faq/why-was-our-cyber-insurance-renewal-denied)
- [Do cyber insurers require round-the-clock security monitoring?](https://netsenx.com/en/faq/do-insurers-require-24-7-monitoring)