What UK cyber insurers ask about EDR, MFA and backups

Renewal time used to mean checking the figure on the quote and signing. For cyber cover it now often means a questionnaire full of terms like EDR, MFA, immutable backups and privileged access, and a sinking feeling if you are the office manager who has been handed it.

This guide explains what those questions are getting at, what a good answer looks like, and what evidence to have ready. It is general guidance, not legal or insurance advice: your policy wording and your broker are the final word.

Why insurers ask so many security questions

Cyber insurance is now fairly common among UK businesses. In the government's 2026 Cyber Security Breaches Survey, 47% of businesses said they were insured against cyber risks in some way, rising to 55% of small and 61% of medium businesses. Most of that cover sits inside a wider policy: only 10% of businesses had a specific cyber security insurance policy.¹

Getting standalone cover usually means proving you have certain controls in place. In a 2025 study of 104 UK SMEs for the Department for Science, Innovation and Technology, 65% of insured SMEs said they had to meet specific security requirements to qualify, and half of those spent between £5,000 and £25,000 to meet them.² Endpoint protection and multi-factor authentication were among the measures asked about, alongside training, firewalls, encryption, incident response plans and vulnerability testing.²

The same study found SMEs had trouble "assessing whether outsourced IT meet technical requirements", and only 48% said their insurance provider had offered any help in meeting them.² Industry experts interviewed for the report described insurers tightening underwriting after a rise in ransomware, and starting to use tools such as vulnerability scans when assessing a business.²

In other words: you are likely to be asked, you may not get much help answering, and the insurer may check.

Endpoint protection and EDR

What the questions usually look like

Proposal forms vary, but questions about endpoints tend to cover:

• Do you have anti-malware on all laptops, desktops and servers?
• Do you use endpoint detection and response (EDR), and if so, which product?
• Is it deployed on 100% of devices, including servers?
• Who monitors alerts, and is that 24/7?
• How quickly are alerts responded to?

What the insurer is really asking

Basic antivirus blocks known bad files. EDR records what happens on each device so that suspicious behaviour (a script disabling backups, an unknown tool dumping passwords) can be spotted and stopped, even if the file itself looks harmless. Our guide to what EDR is covers this in more detail.

The follow-up question about monitoring matters as much as the product. An EDR alert at 3am on a Saturday that nobody reads until Monday is not much use against ransomware, which is why some forms ask whether you have a 24/7 managed detection and response (MDR) service. See our MDR explainer for what that involves.

A good answer, with evidence

Evidence to collect: a device list exported from your EDR console, the name of the product and plan, and a short note from your IT provider or MDR service confirming who monitors alerts and when.

On Coffee Cyber plans, every device gets CrowdStrike Falcon EDR. On Defend, alerts go to you or your IT provider. Defend Plus adds 24/7 threat hunting with written findings, and Complete adds CrowdStrike's own team investigating and removing threats for you. Be precise on the form about which you have. Microsoft Defender for Business also includes EDR if you are on Microsoft 365 Business Premium;³ the question then becomes who watches it. Our comparison guide goes through the trade-offs.

Multi-factor authentication (MFA)

What the questions usually look like

MFA questions have become more specific over time. Expect things like:

• Is MFA enforced for all users on email (for example Microsoft 365)?
• Is MFA required for remote access (VPN, remote desktop, remote support tools)?
• Is MFA required for admin accounts and cloud consoles?
• Is MFA used on your backup system?

Why it matters

Stolen passwords are a common way in, and phishing was the most common type of attack in the 2026 breaches survey, experienced by 38% of businesses.¹ MFA means a stolen password alone is not enough. Yet only 47% of businesses reported having any two-factor authentication for networks or applications.¹

The NCSC also recommends MFA on the accounts that manage your backups, with the MFA method kept off the device used to administer them.⁴ That catches out a lot of businesses: email has MFA, but the backup portal or the firewall login does not.

A good answer, with evidence

• "All users" has to mean all users, including shared mailboxes that people sign in to, the managing director, and the old account the bookkeeper uses once a month. If there are exceptions, say so and explain them.
• Enforced, not optional. "Users can turn it on" is not the same as "required". Ask your IT provider whether it is enforced by policy.
• Evidence: a screenshot or export from Microsoft 365 (or your identity provider) showing MFA enforced, plus a list of other systems (VPN, backup, firewall, accounting software) and whether each has MFA.

Backups

What the questions usually look like

• How often do you back up critical data?
• Are backups kept offline, or separated from your main network?
• Are backups encrypted and protected from deletion?
• When did you last test a restore?
• How long would it take to recover your key systems?

What good looks like

The NCSC's ransomware guidance recommends offline backups kept separate, ideally offsite, multiple copies using different solutions and locations, and regularly testing that you can restore.⁴ Its advice on offline backups explains why: "With at least one backup offline at any given time, an incident cannot affect all of your backups simultaneously", and ransomware incidents have also compromised connected cloud storage that held backups.⁵

So when the form asks about separation, it is checking whether an attacker who gets into your network could also delete or encrypt your backups. A USB drive plugged in permanently, or a NAS sitting on the same network with the same admin password, would not pass.

Microsoft 365 is not a backup on its own

It is easy to assume that because email and files live in Microsoft 365, they are backed up. Keeping a service available is not the same as keeping a separate copy you control. If an attacker uses a compromised account to delete or encrypt mailboxes and files, a separate backup is what gets them back. If the form asks whether you back up cloud data, check with your IT provider what is actually in place for mailboxes, OneDrive, SharePoint and Teams.

Evidence to collect

• A summary of what is backed up, how often and where to.
• Confirmation that at least one copy is offline, immutable or otherwise protected from deletion by a compromised admin account.
• The date and result of your last test restore. If you have never tested one, do that before renewal.

Other questions you are likely to see

Insurers rarely stop at the big three. Common extras include:

• Patching: do you install security updates promptly? Cyber Essentials sets this out as one of its five technical controls.⁶
• Admin rights: do staff work day to day without admin rights?
• Email security: filtering, and a process for checking changes to supplier bank details.
• Training: do staff get phishing awareness training?
• Incident response plan: only 25% of businesses have a formal one.¹ Even a two-page plan that lists who to call, including your insurer's helpline, is a big step up.
• Suppliers and outsourced IT: who has remote access to your systems, and is it protected by MFA?

Cyber Essentials and insurance

Cyber Essentials covers five controls: firewalls, secure configuration, security update management, user access control and malware protection.⁶ It is a good foundation and many questionnaire answers will overlap with it.

It is not a shortcut to cheaper cover, though. Experts interviewed for the DSIT study said Cyber Essentials or ISO 27001 do not automatically lower premiums: they signal a basic level of insurability, and insurers still apply their own criteria to individual controls.²

There is one direct link. Any UK organisation with turnover under £20m that certifies its whole organisation is entitled to cyber liability insurance arranged by IASME, including 24/7 incident response support.⁷ Check the terms and limits before treating it as a replacement for a full policy. Our Cyber Essentials page has more.

Filling in the form: a practical checklist

1. Get the questions early. Ask your broker for the proposal form a month before renewal, not a week.
2. Send it to whoever runs your IT. Ask them to answer each technical question and confirm the answers in writing.
3. Answer what is true today, not what you plan to do. If something is in progress, say so and give a date.
4. Do not guess. Under the Insurance Act 2015, you must make a fair presentation of the risk before the contract is entered into.⁸ If you are unsure what a question means, ask your broker in writing.
5. Keep an evidence folder with the device list, MFA screenshots, backup summary, last restore test and incident response plan.
6. Fix the gaps that matter most first. EDR on every device, MFA everywhere it is asked about, and a tested offline backup cover a large share of most questionnaires.
7. Note your insurer's incident helpline in your incident response plan. If something does happen, call them early. Our had a breach page covers the first steps.

If ransomware is the main worry behind your insurer's questions, our ransomware page explains how endpoint protection and backups work together, and our cyber insurance page covers how our plans relate to insurer requirements.

Common questions