How to Help MSP Clients Pass Cyber Insurance Audits

A client is three weeks from cyber insurance renewal when the underwriter asks for proof that MFA covers every user, EDR is active on every endpoint, backups have been tested, and employees have completed phishing training. The MSP has implemented most of those controls, but the evidence sits across several consoles, tickets, and policy documents. One uncovered administrator account and an incomplete device list can delay the application and put the requested coverage terms at risk.

This is the practical problem behind many cyber insurance audits. Even if security controls are in place, insurers also need current, consistent evidence that those controls are deployed and operating. MSPs can help clients prepare by treating audit readiness as an ongoing security-management task instead of a last-minute documentation exercise.

What Is a Cyber Insurance Audit?

A cyber insurance audit is an insurer’s assessment of an applicant’s security posture before issuing, renewing, or changing a policy. It may involve a questionnaire, an interview, supporting documents, external scans, or requests for technical evidence. The depth varies by carrier, client size, industry, requested limits, and claims history.

The review helps the insurer estimate the likelihood and potential cost of a claim. It also establishes what the client represented when coverage was placed. Questions commonly involve MFA, endpoint protection, email security, backups, incident response, privileged access, security awareness training, and vulnerability management.

MSPs should distinguish between having a control and proving its effective deployment. A policy that says MFA is required does not demonstrate that every administrator, mailbox, remote-access service, and applicable cloud account is protected. Audit-ready evidence connects the stated control to coverage data, configuration records, test results, and remediation history.

The MSP should also identify which evidence it owns and which records the client or another provider must supply. The MSP may manage identities, endpoints, email protection, and monitoring while the client retains responsibility for legal approvals, employee procedures, insurance communications, or business continuity decisions. Establishing that division early prevents the technical package from appearing complete even if a required governance document or third-party record is still missing.

How Cyber Insurance Audit Requirements Have Changed

Cyber insurance applications around 2019 to 2021 often relied heavily on self-attestation. Applicants answered whether controls were present, sometimes without providing detailed technical evidence. Ransomware losses and coverage disputes encouraged insurers to examine controls more closely. During the harder market that followed, insurers tightened both underwriting and coverage terms to manage ransomware exposure.

From 2022 onward, many insurers expanded technical underwriting. An underwriter may ask for screenshots, configuration exports, endpoint coverage figures, backup test records, or external-scan findings instead of accepting a simple yes-or-no response. The 2025 Marsh cyber insurance market update reports that carriers view 12 cyber hygiene controls as essential and continue evaluating how organizations improve those controls.

Three changes are especially relevant to MSPs:

• Ransomware losses contributed to higher premiums and tighter coverage terms. During the harder market, some insurers introduced ransomware sublimits, coinsurance, exclusions, or higher retentions. SMBs seeking coverage or better terms were increasingly expected to demonstrate effective ransomware controls.
• Evaluation is becoming less dependent on annual self-attestation. Some insurers supplement renewal questionnaires with external scanning, updated technical evidence, or continuing security monitoring. The extent of any ongoing policyholder obligation depends on the application and policy wording.
• The control set examined during underwriting has broadened. EDR, identity threat detection, and immutable or otherwise resilient backups increasingly appear alongside established expectations such as MFA, incident response, email security, and awareness training. Requirements still vary by insurer and risk profile.

These underwriting changes reflect developments in the threat environment. The 2026 Verizon Data Breach Investigations Report found that vulnerability exploitation was the initial access vector in 31% of breaches and that ransomware was involved in 48%. The prevalence of ransomware helps explain insurers’ continued attention to coverage terms and ransomware controls, while rapidly changing vulnerabilities make point-in-time attestations less informative.

What’s at Stake When MSP Clients Fail Cyber Insurance Audits

An unsuccessful review can affect more than the renewal schedule. The outcome depends on the carrier and policy terms, but weak controls or unsupported answers can change whether coverage is offered and how a later claim is handled.

• Insurers verify controls beyond questionnaires. A client that answers “yes” to MFA or EDR may be asked to show scope, enforcement, monitoring, and exceptions. Inconsistent answers slow underwriting and can reduce confidence in the rest of the application.
• A material gap can affect an otherwise active policy. If a loss involves a control the client inaccurately described or agreed to maintain, the insurer may investigate that representation. Depending on the wording and applicable law, the result could include a coverage dispute, reduced payment, rescission, or claim denial.
• SMB clients often lack internal evidence-management capacity. Records may be divided among the MSP, client management, a backup provider, and other vendors. Without a clear owner, assembling a reliable package takes longer, and omissions become more likely.
• Poor audit support can weaken the MSP relationship. A competitor that can document coverage, exceptions, remediation, and security outcomes may present a stronger operational case during renewal discussions or service reviews.

Controls Cyber Insurers Require MSP Clients to Have in Place

Requirements vary by insurer, policy, and risk profile. The following table summarizes controls that frequently appear in applications and the evidence an MSP should be prepared to provide.

Control	What The Insurer May Examine	Audit-Ready Evidence
MFA	Coverage for administrators, email, cloud applications, VPN, remote access, and other exposed services	Configuration exports, account coverage lists, conditional-access policies, and documented exceptions
EDR	Deployment across workstations and servers, active monitoring, and containment capability	Device inventory matched to EDR enrollment, coverage percentage, policy status, and recent alert or containment records
Immutable, tested backups	Separation from production access, protection from alteration, and the ability to restore critical systems	Backup architecture, immutability settings, restore-test results, recovery objectives, and corrective actions
Incident response plan	Defined responsibilities, escalation contacts, legal and insurer notification steps, and regular review	Approved plan, revision date, tabletop records, contact list, and lessons-learned actions
Email security and phishing training	Protection against phishing, BEC, malicious links, impersonation, and user-driven risk	Email-security configuration, phishing simulation results, training completion rates, and follow-up actions
Identity threat detection	Monitoring for account takeover, credential misuse, suspicious logins, and privilege changes	Identity alerts, investigation records, account actions, MFA posture, and remediation history
External exposure monitoring	Visibility into internet-facing assets, vulnerable services, email records, and leaked credentials	Asset inventory, scan results, risk findings, remediation tickets, and credential-response records

The controls in this table address risks reflected in recent cyber claims data. For example, Coalition’s 2026 Cyber Claims Report, based on claims from more than 100,000 global policyholders in 2025, found that BEC and funds transfer fraud accounted for 58% of all claims. It also found that attacks involving both encryption and data exfiltration accounted for 70% of ransomware claims and were more than twice as expensive as encryption-only events. The first finding supports close examination of email and identity protections. The second supports scrutiny of data protection, incident response, and tested recovery capabilities.

The MSP should confirm the actual application and policy wording before treating any checklist as complete. Some clients will also need evidence for patching, privileged access, encryption, logging, vendor risk, network segmentation, or regulatory obligations.

How MSPs Can Help Clients Pass Cyber Insurance Audits

MSPs are well placed to connect technical operations with the evidence an underwriter can review. A repeatable process also reduces the effort required across multiple client renewals.

• Map controls 90 days before renewal. Obtain the current application and compare every question with deployed controls, coverage data, and policy documentation. Record owners, evidence sources, exceptions, and remediation deadlines.
• Build an audit-ready evidence package. Use a consistent folder and naming structure for exports, screenshots, policies, test results, inventories, and tickets. Date each item and identify the system or client environment it represents.
• Close gaps before the audit window. Prioritize missing MFA, uncovered endpoints, failed backups, stale administrator accounts, unresolved exposures, and incomplete training. Retest the control after remediation rather than closing the task based only on configuration changes.
• Translate technical results into business language. Client-facing reports should explain the risk, control status, trend, and required action in words key decision makers can comprehend. This helps client leaders answer underwriting questions without interpreting raw alerts or console data.

Common Reasons Clients Fail Cyber Insurance Audits

Most failures come from incomplete coverage, weak documentation, or a mismatch between an application answer and the technical environment. A final review should compare every submitted answer with current evidence rather than relying on last year’s application.

1. MFA excludes administrators, legacy protocols, remote-access tools, or some cloud services.
2. EDR deployment figures do not match the current endpoint inventory.
3. Backups exist, but immutability or successful restoration has not been demonstrated.
4. The incident response plan is outdated, untested, or missing insurer-notification procedures.
5. Phishing training was assigned, but completion and follow-up records are incomplete.
6. External exposures or leaked credentials remain open without documented acceptance or remediation.
7. Evidence is outdated, inconsistent across tools, or collected after the application was submitted.

Where Most MSP Clients Underestimate Cyber Insurance Audit Requirements

Clients often understand the purpose of a control but underestimate the scope and evidence that underwriting may require. MSPs can address these assumptions before renewal.

Common Gap	What The Client May Assume	What May Need To Be Demonstrated
Incomplete MFA coverage	Protecting most employees and the primary email service is sufficient	Enforcement across administrators, remote access, applicable cloud services, and exceptions
Untested or mutable backups	Successful backup jobs prove recoverability	Immutability or isolation, access controls, recent restore testing, and documented recovery procedures
Missing incident response documentation	The MSP will handle an incident if one occurs	Named roles, escalation paths, insurer and legal notification steps, exercises, and review dates
Controls without consolidated evidence	Console access proves the environment is protected	Current exports or reports that connect control status, coverage, findings, and remediation to the insured organization

How Guardz’s Client Security Report Helps MSPs Present Evidence to Underwriters

Most MSPs already operate security controls, but the evidence is often distributed across products and difficult for a nontechnical reviewer to interpret. The Guardz Client Security Report turns client-level security activity into a shareable PDF with AI-generated insights. Its summary includes the security score, threats contained, high-risk users, and an executive insight, giving underwriters and client leaders a concise view of posture and recent outcomes.

The report can serve as the front layer of an evidence package. The security score summarizes overall posture, threat-containment data demonstrates response activity, the high-risk-user count focuses attention on identity and human risk, and the executive insight translates findings into business language. 

Guardz can supplement this summary with CSV exports containing issue-level detections and compliance-mapping results. These outputs can help document findings and remediation status, but they do not replace insurer-requested configuration records, device inventories, backup test results, training records, or incident response documentation.

Evidence expectations still differ among insurers. If an underwriter requests tenant-level MFA settings, a complete EDR device list, detailed phishing completion records, or a signed incident response plan, the MSP should include those underlying artifacts with the report. Through these capabilities, the report makes the client’s security posture and the MSP’s work easier to review.

From Security Gaps to Audit Readiness With Guardz

Audit readiness is easier when MSPs can identify risks, preserve evidence of security activity, and explain results from a connected platform. Guardz supports this workflow in four ways.

• Unified identity, endpoint, email, data, and exposure controls. Guardz connects ITDR, endpoint security, email protection, cloud data protection, security awareness, phishing simulation, and external exposure findings. MSPs can review control status, risks, and remediation activity in a consistent client view.
  
• Prospecting Report surfaces external gaps before the audit window opens. The Guardz Prospecting Report scans public-facing assets for application, network and IT, and compromised-credential findings. MSPs can use the results to prioritize remediation before renewal.
  
• Agentic MDR supports evidence of continuous monitoring. Guardz combines AI triage with human-led MDR. AI agents prioritize and enrich alerts, while the Guardz SOC monitors endpoint activity and ITDR incidents and investigates or escalates activity. The resulting records can help demonstrate ongoing monitoring.
  
• Posture scores and remediation insights help organize evidence around insurer requirements. The Client Security Report presents a security score, threats contained, high-risk users, and an executive insight. MSPs can pair that summary with the control-specific records requested by the insurer.

Guardz, therefore, helps MSPs organize and explain the Guardz-managed evidence supporting an insurer’s review.

Conclusion

Cyber insurance audit readiness depends on control coverage and credible evidence. MSPs can improve both by starting early, mapping each requirement to a technical owner, resolving exceptions, and keeping evidence current as controls, risks, and insurer requirements change.

A unified reporting process also helps the MSP communicate value. Client leaders and underwriters receive a clearer account of what is protected, what has been detected, what was remediated, and what still requires attention. Guardz supports that process by connecting security posture, threat activity, and client-facing reporting while keeping the MSP responsible for insurer-specific evidence and client guidance.