The cyber insurance MFA requirement is the one application question worth getting exactly right, because multi-factor authenticationis the control underwriters lean on more than any other. Stolen passwords are how a huge share of claims begin, and MFA is the cheapest, most effective thing standing between a stolen password and a breach. Carriers know it — so for many of them, MFA has moved from “preferred” to a flat condition of issuing the policy.
Where Insurers Expect to See It
“Do you have MFA?” is really shorthand for “do you have it everywhere that matters?” The baseline carriers ask about:
The MFA Coverage Underwriters Look For
- Email — every mailbox, no exceptions for owners or executives
- Remote access — VPN, remote desktop, and any way into the network from outside
- Privileged and admin accounts — the keys to everything else
- Remote access to backups — increasingly asked, because backups are the ransomware target
- Critical business applications — your line-of-business and financial systems
Why “Most Users” Fails
The most common MFA mistake isn't skipping it — it's rolling it out to most accounts and calling it done. The owner who finds the prompts annoying and turns them off. The shared service mailbox nobody wanted to reconfigure. The old admin account from a former IT vendor. Each of those is a way in, and an attacker only needs one. Underwriters treat partial MFA as a real gap precisely because a single unprotected account can undo the rest.
The Attestation Trap
There's a sharper edge here than just being declined. When you tick “yes, we enforce MFA” on the application, you're making a representation the carrier relies on. If a breach later starts at an account that wasn'tprotected, the insurer can reduce or deny the claim — the attestation didn't match reality. That's the quiet danger: being fully insured on paper while an over-optimistic MFA answer hollows out the coverage you're paying for. This is the same claims-time scrutiny that catches untested backups and partial EDR.
What “Good” Looks Like
Aim for MFA enforced on every account that can reach email, the network, or admin functions — with app-based or hardware factors on your highest-value logins, since SMS codes can be intercepted. Done properly, the same control that satisfies the underwriter is the one most likely to stop the breach in the first place. It's the cleanest example of insurance readiness and real security being the same work — which is the whole premise of cyber insurance readiness. The other control carriers hinge on is covered in the EDR requirement.
Make Your MFA Answer an Honest “Yes”
We enforce MFA across email, remote access, and admin accounts — and document the coverage so your application is backed by evidence, not optimism.
See Cyber Insurance Readiness