# Cyber insurance email security requirements: what insurers ask and how to prepare

URL: https://iblockspam.com/blog/cyber-insurance-email-security-requirements
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Choosing a filter
Author: iBlockSpam Team

> What cyber insurance applications ask about email: MFA, filtering, DMARC, backups, training and payment checks, how to answer honestly and what proof to keep.

## Short answer

Cyber insurance applications usually ask whether every mailbox uses multifactor authentication, whether inbound email is filtered for phishing and malware, whether your domain publishes SPF, DKIM and DMARC, whether backups are separate and tested, whether staff get phishing training, and whether payment changes are verified by phone. Requirements vary by insurer and policy, so answer from evidence, not memory.

Cyber insurance applications now read like a security audit, and email is where many of the questions land. Insurers ask about email because so many claims start there: a stolen mailbox password, a phishing link or a fake invoice. This guide explains the email controls applications usually ask about, how to answer honestly, and what evidence to keep.

We don't name insurers or quote their forms. Requirements vary by insurer, by policy and by the size of your business, and they change at renewal. Use this as a preparation checklist, read your own questionnaire line by line, and take coverage and legal questions to your broker or counsel.

## What email security do cyber insurers require?

Many cyber insurance applications ask about the same six email controls: multifactor authentication (MFA) on every mailbox, filtering of inbound email for phishing and malware, email authentication on your domain (SPF, DKIM and DMARC), backups kept separate from the systems they protect, staff training on phishing, and a callback step before any payment or bank detail change. Some also ask about legacy sign-in, admin accounts and an incident plan.

The UK's National Cyber Security Centre (NCSC) puts the underlying logic plainly in its [cyber insurance guidance](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance): buying a policy "might require providing information about your security controls," and insurance "will not instantly solve all of your cyber security issues." Insurers expect the basics to be in place first, just as a home insurer expects locks on the doors.

These controls aren't insurance inventions. They track public government guidance. [CISA's Cyber Essentials](https://www.cisa.gov/resources-tools/resources/cyber-essentials) says to "leverage multi-factor authentication for all users, starting with privileged, administrative and remote access users," and to "establish regular automated backups and redundancies of key systems." If you've already worked through our [small business email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business), most answers will be yes.

## Why do insurers ask so much about email?

Insurers ask about email because it is the most common way attackers reach money and data at small businesses. Business email compromise (BEC) is fraud where a criminal uses a hacked or impersonated mailbox to redirect payments, and it produces some of the largest reported losses of any cybercrime.

The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses ([IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). Across October 2013 to December 2023, the FBI counted more than $55 billion in exposed BEC losses worldwide ([IC3 PSA, September 2024](https://www.ic3.gov/PSA/2024/PSA240911)). A single redirected supplier payment can exceed a small policy's limit, which is why the questions about payment verification sit next to the technical ones.

A compromised mailbox also tends to be the first step of larger incidents. An attacker who controls one inbox can reset other passwords, read invoices, and send convincing phishing to your customers from your real address.

## What does a typical questionnaire ask about email?

A cyber insurance questionnaire is the application form an insurer uses to assess your risk before quoting. The email section is usually a set of yes/no questions, sometimes with a box for exceptions. The table below shows common generic items, what each one means in practice, and the evidence that supports a yes.

| Questionnaire item (generic wording) | What it means in practice | Evidence to keep |
|---|---|---|
| Is MFA required for all email accounts? | Every mailbox, including shared and admin accounts people sign in to, needs a second factor | Admin console report of MFA status per user |
| Is MFA required for remote access and admin accounts? | VPN, remote desktop and every admin role, not just mail | Screenshot of the enforcement policy |
| Are legacy authentication protocols blocked? | Older sign-in methods that skip MFA are switched off | Policy setting or sign-in log showing blocks |
| Is inbound email filtered for spam, phishing and malware? | A filter checks mail before users see it, with nothing bypassing it | Filter policy settings; MX record lookup |
| Are links and attachments scanned or sandboxed? | Risky files and URLs are checked, blocked or rewritten | Feature settings; plan or licence name |
| Do you use SPF, DKIM and DMARC? | Your domain tells receivers which servers may send as you and what to do with fakes | Public DNS records; DMARC policy value |
| Are external emails tagged? | Users see a warning on mail from outside the organization | Mail flow rule or tenant setting |
| Are backups offline or separate, and tested? | Copies can't be deleted with the same stolen account; restores are proven | Backup report; last restore test date |
| Do employees receive phishing training? | Regular training, sometimes simulations | Training records and dates |
| Are payment and bank detail changes verified out of band? | A phone call to a known number before money moves | Written procedure; call log for changes |
| Do you have an incident response plan? | Who to call and what to do in the first hour | The plan document and its review date |

Not every form asks every question, and the wording varies. Remember that your MX, SPF and DMARC records are public DNS, so anyone, including an underwriter, can check them in seconds. Make sure what you write matches what a lookup shows.

## How should you answer the MFA questions?

Answer yes only if MFA is enforced by a technical setting for every account the question covers, with exceptions listed. MFA means signing in needs something beyond a password, such as an authenticator app prompt, a passkey or a hardware security key.

It also helps to know which kind of MFA you use, in case the form asks. [CISA's MFA page](https://www.cisa.gov/MFA) says "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," and recommends number matching where phishing-resistant MFA isn't possible yet. Text-message codes count as MFA on many forms, but they are the weakest option. Our guide to [passkeys and phishing-resistant MFA](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email) covers the upgrade path for admins and finance staff.

Common gaps that turn an honest yes into a no:

- **Shared mailboxes with a password.** If people sign in to `accounts@` directly, it needs MFA too, or it should be converted so nobody signs in to it.
- **Service accounts.** Scanners and apps that send mail with a username and password often skip MFA. Microsoft has been retiring basic authentication for SMTP submission; see [SMTP AUTH and basic auth retirement](https://iblockspam.com/blog/microsoft-365-smtp-auth-basic-auth-retirement).
- **Admin accounts.** The global admin is the account insurers care about most. Make sure it has the strongest method you have.
- **"Users can opt in."** Optional MFA isn't required MFA. On Microsoft 365, [security defaults](https://iblockspam.com/blog/microsoft-365-security-defaults-mfa) or Conditional Access enforce it; on Google Workspace, use [2-Step Verification enforcement](https://iblockspam.com/blog/google-workspace-2-step-verification-enforcement).

## How do you prove your email is filtered?

Inbound email filtering means software checks each incoming message for spam, phishing and malware before it reaches a mailbox, and holds or blocks what's risky. To answer the filtering question, you need to know what filters your mail and confirm nothing goes around it.

1. **Look up your MX records.** These DNS records show where the internet delivers your mail. The [MX Lookup](https://iblockspam.com/tools/mx-lookup) shows them in one step.
2. **Confirm the filter is switched on.** In Microsoft 365 or Google Workspace, check that anti-spam, anti-phishing and anti-malware policies are enabled and set to quarantine high-risk mail rather than only tag it.
3. **Check for a bypass.** If you use a separate filtering service, make sure attackers can't deliver straight to your mailbox provider and skip it. Our guide to [blocking direct-to-tenant bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass) explains the fix.
4. **Record which features you have.** If the form asks about link or attachment scanning, note the plan or service that provides it. Don't tick a feature your licence doesn't include.
5. **Save screenshots** of each policy with the date.

Whether built-in filtering is enough depends on the question, not on a general rule. Our guides on [whether Microsoft 365 needs a spam filter](https://iblockspam.com/blog/do-i-need-a-spam-filter-with-microsoft-365) and [whether Google Workspace filtering is enough](https://iblockspam.com/blog/is-google-workspace-spam-filter-enough) set out what's included.

## Do insurers check SPF, DKIM and DMARC?

Many questionnaires ask about email authentication, and because the records are public, the answer is easy for anyone to verify. SPF lists the servers allowed to send for your domain, DKIM adds a cryptographic signature to your mail, and DMARC tells receivers what to do when a message claiming your domain fails both checks.

DMARC is defined in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html). Its policy has three values: `p=none` (monitor only), `p=quarantine` and `p=reject`. Only the last two ask receivers to act on fake mail. A record like this example passes most "do you use DMARC?" questions and protects you in practice:

```
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
```

If you're still at `p=none`, say so. Then follow our plan for [moving DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business). For context, our [scan of the top 1,000 websites](https://iblockspam.com/research/email-security-top-1000) in October 2026 found that 38.3% of domains don't enforce DMARC, so a no here is common, but it is also one of the cheapest gaps to close.

## What about backups, training and payment checks?

### Backups

Insurers ask whether backups are separate from production and tested, because ransomware and account takeovers delete or encrypt mail. CISA's [Cyber Essentials](https://www.cisa.gov/resources-tools/resources/cyber-essentials) recommends a backup that "automatically and continuously backs up critical data and system configurations." Your mailbox provider's deleted-items retention isn't necessarily a backup; [email archiving vs backup](https://iblockspam.com/blog/email-archiving-vs-backup) explains the difference. Record the date of your last test restore.

### Training

Training questions usually ask how often staff are trained and whether you run phishing simulations. Keep a dated list of who completed what. Our guide to [email security awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business) covers a program small teams can sustain.

### Payment verification

A callback control means anyone who receives a request to pay a new account, or change bank details, confirms it by calling a phone number already on file, never one in the email. The FBI's first BEC prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3, 2024](https://www.ic3.gov/PSA/2024/PSA240911)). Write the rule down, train finance staff on it, and keep a short log of changes you verified. [Vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) shows how these scams work.

## What happens if your answers are wrong?

Your application answers are part of the basis on which the insurer agrees to cover you. If an answer turns out to be untrue when you make a claim, the policy wording and local law decide what happens next. The [NCSC](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance) warns that if you say security measures are in place when they aren't, "the insurer may not be obliged to pay any claims," and that you should let your insurers know when your circumstances change. We can't give legal advice on that, so ask your broker or counsel how your policy treats misstatements before you sign.

Practical habits that help:

- **Answer for today, not for next quarter.** If MFA rollout finishes next month, say "in progress" and give the date.
- **List exceptions.** One shared mailbox without MFA, written down, is better than a yes that isn't true.
- **Ask what a question means** if it's ambiguous. "All users" and "all remote access" can be read several ways.
- **Keep the evidence** in one folder with the date: screenshots, reports, policies and training records.
- **Re-check before renewal.** Settings drift. A new admin or a new app can quietly undo a control.

## Does insurance replace email security?

No. Insurance pays for some of the cost of an incident; it doesn't stop the incident. The [FTC's cyber insurance page](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance) suggests deciding whether you need first-party cover (your own losses, such as data recovery and business interruption), third-party cover (claims against you), or both, and asking whether the insurer will "defend you in a lawsuit or regulatory investigation" and offers a breach hotline available at all times.

Read how the policy handles tricked payments. The [NCSC's cyber insurance guidance](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance) warns that "some insurance policies will not cover monies lost through business email compromise fraud," while others go further and cover computer-enabled fraud. Ask your broker, in writing, whether a fraudulent transfer would be covered, under which section, up to what limit and with what conditions, before you need it.

Reporting rules matter too. Check how and how quickly your policy expects you to tell the insurer about an incident. The NCSC notes that some insurers supply services during an incident and may put you in touch with an incident response organization. Put your insurer's claims line in your [email incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan), and if money has already left your account, follow [business email compromise wire transfer recovery](https://iblockspam.com/blog/business-email-compromise-wire-transfer-recovery) straight away: the bank call comes first.

In the UK, the [NCSC's Cyber Essentials page](https://www.ncsc.gov.uk/information/cyber-essentials) says any UK organisation with a turnover under £20m that certifies its whole organisation is "automatically entitled to Cyber Liability Insurance" arranged through its delivery partner. The NCSC also notes some insurers offer discounts when recognized defenses are already in place.

## How do you prepare for a cyber insurance application?

Use this checklist two to four weeks before the application or renewal is due:

1. **Get the questionnaire early** from your broker and highlight every email-related question.
2. **Export an MFA report** from your admin console and fix any account without enforced MFA.
3. **Block legacy sign-in** methods that skip MFA, and record the setting.
4. **Run a public DNS check** of your domain with the [Email Health Check](https://iblockspam.com/tools/email-health-check) to see MX, SPF, DKIM and DMARC in one scan.
5. **Screenshot your filtering policies** and confirm nothing bypasses them.
6. **Run a test restore** of one mailbox and note how long it took.
7. **Collect training records** with dates and completion.
8. **Write or update the payment verification procedure** and the incident plan, including the insurer's notice line.
9. **Answer the form from your evidence folder**, listing exceptions in writing.
10. **Diary a re-check** a month before the next renewal.

## Next steps

- Read your current policy or quote with your broker and ask which section covers a fraudulent payment, and what verification it expects.
- Check your public records now with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), and fix anything at `p=none` before the underwriter sees it.
- Turn on enforced MFA for every mailbox and admin account this week, starting with admins.
- If you want inbound filtering with per-user quarantine digests and domain monitoring priced per domain rather than per user, see iBlockSpam for [small businesses](https://iblockspam.com/solutions/small-business). It's one control on the list, not a substitute for MFA, backups or a callback rule.

Browse more guides on [choosing email security](https://iblockspam.com/blog/topic/buying).

## Frequently asked questions

### Do cyber insurers require MFA on email accounts?

Many applications ask about it directly, and your answer forms part of what the insurer relies on. Requirements vary by insurer and policy, so read your own questionnaire and ask your broker. CISA recommends MFA for all users, starting with privileged, administrative and remote access accounts, so turn it on for every mailbox before you apply.

### Will a cyber insurance claim be denied if I answered the questionnaire wrong?

It can create problems. Your answers form part of the basis on which the insurer agreed to cover you, so an inaccurate answer may affect a claim, depending on the policy wording and local law. Answer only what you can show is true today, note exceptions in writing, and ask your broker or counsel how your policy treats misstatements.

### Does cyber insurance cover money lost to a fake invoice or business email compromise?

Not always. The UK NCSC warns that some insurance policies will not cover money lost through business email compromise fraud, while others extend to computer-enabled fraud. Don't assume either way. Ask your broker in writing whether a fraudulent transfer is covered, under which section, up to what limit, and whether any conditions apply.

### Do insurers ask whether my domain has DMARC?

Some questionnaires ask about SPF, DKIM and DMARC, and because the records are public DNS, anyone, including an underwriter, can look them up. A DMARC record at p=quarantine or p=reject shows that receivers are asked to stop mail that fakes your exact domain. Check yours with a free DMARC checker before you apply.

### Is the spam filter in Microsoft 365 or Google Workspace enough for an insurance application?

It may be, depending on the question. If the form asks whether inbound email is filtered for spam, phishing and malware, built-in filtering that's switched on and reviewed usually counts. Some forms ask about specific features such as link or attachment scanning. Answer for what is actually enabled, and keep a screenshot of the policy settings.

## Sources

- [FTC: Cyber Insurance (Cybersecurity for Small Business)](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity/cyber-insurance)
- [NCSC: Cyber insurance guidance](https://www.ncsc.gov.uk/guidance/cyber-insurance-guidance)
- [NCSC: Cyber Essentials](https://www.ncsc.gov.uk/information/cyber-essentials)
- [CISA: Cyber Essentials](https://www.cisa.gov/resources-tools/resources/cyber-essentials)
- [CISA: More than a Password (multifactor authentication)](https://www.cisa.gov/MFA)
- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/cyber-insurance-email-security-requirements (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt