Cyber Insurance MFA Requirements, Explained for Small Business

If you’ve seen a cyber insurance application recently, you’ve seen the multifactor authentication questions. MFA sits at or near the top of nearly every questionnaire — often before the EDR and backup questions — because compromised credentials remain one of the most common ways attackers get into small businesses.

Here’s what carriers are actually asking, and how to get to an honest “yes.”

What carriers typically expect

Underwriters generally aren’t asking whether MFA exists somewhere in your business. The questions usually target specific access points:

• Email accounts — every user, not just administrators. Business email compromise drives a large share of claims.
• Remote access — VPNs, remote desktop tools, and any path into your network from outside.
• Administrative accounts — the credentials that can change settings, create users, or access everything.
• Cloud services — Microsoft 365, Google Workspace, and line-of-business applications holding sensitive data.

Some questionnaires go further and ask which type of MFA you use. App-based authenticators and hardware keys are generally viewed more favorably than SMS text codes, which can be intercepted or SIM-swapped.

The good news: you probably already own it

For most small businesses, the MFA a carrier expects is already included in software you pay for. Microsoft 365 and Google Workspace both include MFA capabilities in their standard business plans. The work isn’t buying a product — it’s turning enforcement on for every user, every remote path, and every admin account, and then confirming nobody has been quietly excluded.

That last part matters. “MFA is enabled” and “MFA is enforced for all users with no exceptions” are different answers, and questionnaires increasingly probe the difference.

How to answer accurately

Cyber insurance applications are typically signed attestations. The practical approach:

1. Inventory the access points — email, remote access, admin accounts, key cloud services.
2. Check enforcement, not just availability — pull the actual policy status from your admin console rather than answering from memory.
3. Close the exceptions — legacy accounts, shared mailboxes, and service accounts are the usual stragglers.
4. Keep evidence — a screenshot of the enforcement policy is worth keeping with your application records.

If you’re not sure how to check any of this, that’s a reasonable thing to ask your IT provider to verify before renewal — with time to fix gaps, not the week the application is due.

Where MFA fits in the bigger picture

MFA protects the front door — your accounts and access. It pairs with the other controls carriers ask about: endpoint detection and response watches for malicious behavior on the computers themselves, patch management reduces the known vulnerabilities attackers exploit, and backups determine how bad a successful attack becomes.

PC Vax focuses on the endpoint portion of that picture — managed EDR, 24/7 monitoring, and managed response — and our readiness reviews help identify which of the other controls, like MFA, may need attention before your application does it for you.

Preparing for an application or renewal? Start with our Cyber Insurance Readiness overview, or read how to prepare for the questionnaire.

PC Vax provides cybersecurity services, not insurance advice. Requirements vary by carrier, policy, and applicant, and PC Vax does not guarantee insurance eligibility, approval, coverage, or premiums.