A few years ago, cyber insurance was easy to get and cheap. Not anymore. As cyberattacks have surged, insurers have tightened up dramatically — and now they expect you to have real security controls in place before they'll cover you. For Alberta small businesses, that's actually a good thing: the same controls that get you insured also keep you from needing to claim. Here's what you need to qualify.
Why insurers got strict
Insurers paid out heavily on ransomware and breach claims, and they responded the way any business would: by managing their risk. Today, getting (and keeping) cyber insurance usually means proving you've implemented specific security measures. No controls, no coverage — or much higher premiums.
The controls insurers commonly require
Requirements vary by insurer, but these show up on almost every application:
- Multi-factor authentication (MFA). This is the big one — often mandatory, especially for email and remote access. If you have MFA and little else, you're ahead of many applicants. See our MFA guide.
- Endpoint detection and response (EDR). Modern endpoint security that detects and stops threats, a step beyond basic antivirus.
- Secure, tested backups. Recoverable backups — ideally with offline or immutable copies — so you can restore after ransomware without paying. See why you still need to back up Microsoft 365.
- Email filtering. To stop the phishing that starts most attacks.
- Security awareness training. Evidence that staff are trained to recognize threats.
- Patching and supported software. Keeping systems current — running unsupported software like Windows 10 past its end of support is a red flag.
- Access controls. Individual accounts and least-privilege access.
If that list looks familiar, it's because it's the same set of cybersecurity essentials every business should have anyway.
Answer the questionnaire honestly
Cyber insurance applications include detailed security questionnaires. Answer them accurately — overstating your controls can void your coverage exactly when you need it. If you're not sure how to answer, that's a sign to get your security assessed first.
The controls pay off twice
Here's the thing: the measures that qualify you for insurance are the same ones that prevent the attack in the first place. So the effort isn't just about ticking an insurer's boxes — it genuinely lowers your risk, and it can lower your premiums too. Insurance is the safety net; the controls are what keep you off the ground.
The bottom line
Cyber insurance now demands real security — MFA, EDR, tested backups, email filtering, training, and patching. For an Alberta small business, putting those controls in place is what gets you covered, keeps premiums reasonable, and, most importantly, keeps you from ever needing to claim.
We help Alberta small businesses implement the controls insurers require — and answer those questionnaires with confidence. Learn more about our cybersecurity services, or book a free evaluation to see where you stand.