Practical guide
How MFA, EDR and backups change your cyber insurance premium
A practical guide to proving MFA, endpoint detection and tested backups to cyber insurers without assuming an unsupported premium discount.
Updated October 2026. About a 8 minute read.
Key point
MFA, EDR and recoverable backups can influence eligibility, coverage restrictions and pricing. They are not a guaranteed percentage discount. Underwriters need evidence of scope, monitoring and recovery, not just product names.
MFA
Make stolen passwords less useful
EDR
Detect and investigate endpoint activity
Backups
Restore essential systems and records
| Control | Useful evidence | Gap to disclose |
|---|---|---|
| MFA | Coverage of email, remote access and admin accounts | Exceptions and legacy access paths |
| EDR | Device coverage and alert response ownership | Unmanaged servers and unattended alerts |
| Backups | Isolation settings and a recent restore record | Untested applications or shared credentials |
| Recovery | Named decision makers and system priorities | Dependencies without a workable alternative |
Security products are not the same as working controls
Buying a security subscription does not tell an underwriter how safely the business operates. A tool might be installed on laptops but not servers. Staff might use MFA for email while administrators reach backups with only a password. Copies of data might exist without anyone testing that the application can use them. CISA's StopRansomware Guide focuses on implementing and maintaining controls, not simply purchasing them.
Treat the insurance application as a description of the environment you actually run. Ask your IT provider to explain which users, systems and locations each answer includes. Separate current controls from projects that are still planned. If a question uses an unclear term, request clarification and keep the response. An honest explanation of a limited deployment is more useful than a broad yes that your records cannot support after an incident.
MFA: check every useful path into the business
Multifactor authentication asks users for more than a password. CISA recommends stronger, phishing resistant methods where available. For a small business, start by mapping email, remote access, administrator access and critical cloud services. A protected main login does not help if an old remote access service or recovery account lets someone bypass it. Include contractors and service accounts in the discussion rather than checking only employee logins.
Prepare an account report showing where enforcement is enabled. Record any exceptions, who approved them and how they are constrained. Review the process for enrolling a new device and recovering a lost authentication method. Attackers can exploit weak recovery steps even when normal access is protected. Do not describe all MFA methods as equivalent. Ask which methods the underwriter accepts for privileged access and which systems the question explicitly covers.
EDR: detection needs someone who responds
Endpoint detection and response helps identify and investigate suspicious activity on computers and servers. It does not magically remove every threat. CISA discusses endpoint protection and monitoring as part of layered ransomware defenses. Ask whether your deployment covers the systems that matter to recovery, including remote laptops and servers outside the office. An inventory is the starting point for knowing what is absent.
The operational question is who receives alerts and what they can do. A service monitored only during office hours may leave activity unattended overnight. Clarify responsibilities with your IT provider and keep a written escalation path. Distinguish EDR software from a managed response service in the application. If an operating system cannot support the product, explain how that device is isolated and what monitoring or replacement plan addresses the gap.
Backups: demonstrate recovery, not storage
CISA recommends offline backups and testing their availability and integrity. Protected copies reduce the risk that an attacker can encrypt both production data and its backup. An immutable backup can restrict changes, but its usefulness still depends on configuration, access controls and retention settings. Ask who can delete copies, change the protection settings or reach the backup management account. Separate credentials matter when production accounts are compromised.
A restore test should show that a critical process works again, not only that a file downloads. Restore an application and enough related data to check dependencies and permissions. Record the test date, the result and the problems found. Explain which systems were not tested. Backups do not reverse stolen data or eliminate breach response costs. Keep response, notification and recovery planning alongside the backup plan rather than using recovery as a substitute for prevention.
Hypothetical worked example: a small software company
Consider an invented software company renewing its cyber policy. It enforces MFA on staff email, but production administrators have an exception. EDR covers company laptops but not the server used for builds. Backups complete successfully, yet nobody has restored the customer database into a working test environment. This is a hypothetical control review, not a real claim or an account of any insurer’s underwriting decision.
Before seeking comparable offers, the company removes the administrator exception, adds supported monitoring to the build server and tests recovery with its IT provider. It keeps the configuration reports and test findings. The insurer may accept the evidence, request more information or leave the price unchanged. No premium saving is assumed. The practical gain is a more accurate application and fewer unexplained gaps in the business’s ability to contain and recover from an attack.
What drives the cost up or down
Pricing can respond to more than the presence of these controls. Data sensitivity, revenue, customer contracts, previous incidents, business interruption exposure and the requested limit also matter. A healthcare practice and a design studio with similar devices do not necessarily have equivalent liability. Broader coverage or a lower retention can cost more even after security improves. Compare the full terms before deciding that a changed premium proves a particular control worked.
Strong evidence can support insurability and help challenge restrictive terms. Weak evidence, unresolved exceptions and inaccurate answers can lead to questions, delays or less attractive offers. We have not verified a universal public discount for MFA, EDR or backups, so this guide gives no percentage saving. Obtain ranges from actual comparable quotations for your business. Keep the coverage limit, retention and important endorsements consistent when testing the price effect of improvements.
Prepare a useful renewal evidence pack
Build a short pack with an asset inventory, authentication coverage, endpoint coverage, backup configuration and restore results. Add the name of the person or provider accountable for each control. Share only what the insurer needs through its approved secure channel. Do not send passwords, recovery codes or unnecessary personal data. Ask how documents are retained and who can see them if a quotation process involves several insurers.
Start while there is still time to fix gaps rather than on the day cover expires. Request written confirmation that any proposed remediation satisfies the underwriting question. Keep records of what changed after the application was submitted and disclose material differences through the agreed process. At the next renewal, repeat the review instead of reusing an old yes answer. Controls drift when staff, software and providers change, even when the original implementation was sound.
Plan your insurance budget
Use the cyber liability cost calculator for a planning range with visible assumptions. It is a model, not an insurer quotation or a guarantee of coverage.
Frequently asked questions
Does MFA guarantee a lower premium?
No. It can influence eligibility or terms, but pricing depends on the whole risk and insurer appetite. No universal percentage discount is established here. Compare actual offers with the same coverage and ask how the insurer assessed your control evidence.
Is antivirus the same as EDR?
Not necessarily. Products and services differ in detection, investigation and response capabilities. Describe what is deployed and who handles alerts. Ask the underwriter to define its requirement rather than treating a product label as proof that the requirement is met.
Will a cloud provider handle our backups?
Do not assume so. Your subscription, configuration and division of responsibility determine what can be restored. Confirm the available copies, access controls and recovery process. Test the business application rather than relying solely on a provider’s service description.
Can we answer yes while a control is planned?
Describe the current state and the planned change separately. Ask whether the insurer can offer conditional terms and what evidence is needed when the work is complete. Keep written clarification instead of silently treating a future project as a working control.
How often should we test restoration?
Choose a schedule based on operational risk, meaningful system changes and the policy requirements. CISA recommends testing backups, but this guide does not invent a universal insurance testing interval. Record each test and address its failures before relying on it.
Related reading
Sources
These primary sources support the coverage distinctions and operating guidance discussed above. Security guidance is not an insurance contract. Published product descriptions illustrate possible cover, while your issued wording and applicable law control a claim.
- CISA and FBI: StopRansomware Guide. Security controls, incident response and recovery guidance. This is security guidance, not insurance wording.
- NAIC: Cybersecurity insurance. Consumer and regulatory context for cyber insurance and the distinction between business losses and liability.
- Travelers: How does cyber insurance work?. Published insurer explanation of cyber coverage. Your issued policy and endorsements control any claim.
All worked examples are clearly hypothetical. Their dollar amounts and percentages are assumed calculation inputs, not premium benchmarks, reported claims or statistics. No unverified market premium or control discount is presented.