Cyber Insurance Requirements for Ontario SMBs

Cyber-insurance applications and renewals can ask detailed questions about technical controls, operational responsibilities, and supporting evidence. Requirements vary by insurer, policy, organization, and broker.

This guide gives Ontario SMBs a practical way to prepare. It is not insurance advice, and completing every item does not guarantee eligibility, approval, coverage, or a particular premium.

Controls worth reviewing before an application or renewal

1. A properly managed firewall

Questionnaires may ask who administers the firewall, whether firmware and security updates are current, and how rule reviews and log monitoring are handled. Document the device, its owner, and the operating routine rather than simply answering “yes.”

2. Multi-factor authentication (MFA) for critical access

Review email, remote access, cloud applications, administrator accounts, and other critical systems. Document where MFA is enforced, any exceptions, and how those exceptions are managed.

3. Endpoint protection on supported devices

Review the protection deployed across workstations and laptops, including devices used by remote staff. Depending on your requirements and the questionnaire, endpoint detection and response (EDR) may provide capabilities beyond traditional signature-based antivirus.

4. Backups that are isolated and tested

You may be asked whether backups are segregated from production systems and whether restores are tested rather than assumed. An off-site or off-cloud backup can form part of that approach; recovery objectives, test procedures, and records still need to match your organization’s requirements.

5. Patch management

A written process for keeping operating systems and business software current. “Windows updates run automatically” is a start; a managed process with reporting is better.

6. Email filtering

Basic anti-phishing filtering on your email domain, plus ideally a process for verifying unusual payment requests by phone (the classic “CEO fraud” control).

7. Incident response basics

You may be asked what happens after an incident is detected: who is notified, how systems are isolated, who investigates, and when specialist forensic, legal, or insurance contacts become involved. A short, tested plan is more useful than an untested document written only for the application.

How to document the controls

An application or renewal may require evidence, not just a list of products. For each relevant item, keep an appropriate record:

• Firewall: the management contract or service agreement showing who reviews it and how often.
• MFA: a screenshot of your identity provider’s MFA enforcement policy.
• Backups: a log of restore tests with dates.
• Patching: a monthly report or ticket trail.

Managed service arrangements can provide useful records, but the available evidence depends on the service scope. If your IT is outsourced, ask your provider which controls they operate and what documentation they can supply. Do not assume that every managed Cybersecurity arrangement covers every questionnaire item.

If you identify gaps or receive an unfavourable decision

Ask your insurer or broker to clarify the requirements and the reason for the decision. A prioritized remediation plan can assign owners and target dates for items such as firewall management, MFA enforcement, endpoint coverage, or restore testing. Remediation does not guarantee approval or better pricing; the insurer makes that determination.

The bigger picture

Use the questionnaire as one input into a broader security review, not as a complete security framework. Confirm your obligations with your insurer or broker, then address the controls and operational gaps that matter to your organization.

NVG provides managed firewall, VPN, endpoint, identity, email-security, backup, and monitoring options for businesses across the GTA. We can review your current controls, document the agreed scope, and help organize available evidence. Get a free Cybersecurity assessment to discuss your environment and questionnaire.