Most practices treat the cyber policy as a thing they buy and then do not think about. Premium goes out, certificate goes in a folder, done.

The application is the part nobody rereads. And the application is the part that decides whether the policy does anything for you on the worst day.

The application is a set of promises

When you applied, someone answered a list of questions about how your practice runs. Do you require multi-factor authentication. Do you have backups. Are they tested. Do you have a written incident response plan.

Whoever filled that out answered honestly, based on what they believed at the time. Often that person was your IT provider, or an office manager reading the question for the first time, or you at the end of a long day.

Those answers are part of the contract. That is the uncomfortable part.

What carriers are asking in 2026

Requirements vary by carrier and every application is different, so treat this as the shape of the thing rather than your specific list. Across the market, the questions cluster in the same places.

Multi-factor authentication

Not just on email. On remote access and cloud admin consoles. On banking. Increasingly on the practice management system too. Several carriers now decline SMS codes as sufficient for privileged accounts.

Endpoint detection and response

On every workstation and every server, and specifically not legacy antivirus. Whether that is actually true across your tenant is the sort of thing an independent audit answers. Many applications also ask whether it is monitored around the clock, and by whom.

Backups, and the word tested

This is the question that catches people. Applications increasingly ask for the date of your most recent restore test, which systems were tested, and how long recovery actually took. Not whether backups exist. Whether someone has proven they come back. The same question applies to the vendors you depend on, which we covered in what happens when your clearinghouse goes down.

A written incident response plan

Documented, with a named owner. An escalation path that says who gets called. And evidence that somebody has actually walked through it. Tabletop exercise documentation is commonly accepted as that evidence. Many carriers ask whether it was refreshed in the last twelve months.

The rest of the list

  • Email authentication (SPF, DKIM and DMARC) set to enforce, not monitor
  • An out-of-band verification step before any wire transfer or bank detail change
  • Patching within a defined window, faster for anything facing the internet
  • Security awareness training, with documented completion, not just a subscription

The shift that matters

The change in underwriting is not the length of the list. It is that yes has stopped being an answer.

Underwriters increasingly want to know where a control is in place. Since when. With what exceptions. At claim time the question is narrower and harder: was the control actually operating when the loss happened.

A practice that answered yes in good faith, and cannot show what was true on the day, is in a worse position than it thinks.

What this means for a small practice

You are probably doing more than you get credit for. The gap is usually not the control. It is the evidence.

You have backups. Can you say when they were last restored, and what came back? You have training. Can you produce who completed it and when? You have a plan for a bad day. Is any of it written down, and has anyone walked through it out loud?

None of that is expensive. It is just nobody's job, so it does not happen, and then the one time it matters you are reconstructing history from memory.

A reasonable thing to do this quarter

Get a copy of your most recent application or renewal questionnaire from your broker. Read it with the practice manager. For every question, write down two things: what we answered, and where the proof lives.

Where those two columns disagree, you have found something useful. That list is worth more than any security product you could buy this year, because it tells you exactly where you stand before anyone else asks.

Questions people ask

Can a carrier really deny a claim over an application answer?

Coverage disputes are decided case by case. What the policy says matters, and so does what the application said at the time. The general principle is that the application forms part of the contract. That is why it is worth knowing what yours says. If you want a view on your specific policy, that is a conversation for your broker or your attorney.

Our IT provider filled out the application. Does that cover us?

They answered about the systems they manage. The policy is still the practice's contract. Training records are a business question. So is what procedure is written down, and who can approve a bank change. None of those are network questions. It is worth reading it together.

What counts as testing an incident response plan?

Commonly a tabletop exercise: the people involved sit down, walk through a scenario, and write down what they decided and what they could not answer. The written record of that exercise is usually what a carrier means by evidence. It does not require taking anything offline.

We are a small practice. Is this proportionate?

The controls scale down. The evidence does not disappear. A five-person practice can hold all of this in a short document reviewed once a year. The mistake is assuming small means the questions will not be asked.

Does this overlap with HIPAA?

Partly. The current HIPAA Security Rule already requires contingency planning, data backup, disaster recovery, emergency mode operations and periodic testing. Work you do for one is often usable for the other, though the wording each one uses is different. Neither is a substitute for reading your own policy.

Sources and notes

  • Control patterns compiled from published 2026 cyber insurance readiness and underwriting guidance, reviewed September 2026. These are vendor and broker publications rather than carrier policy documents. Carrier requirements differ, and the only list that governs you is the one on your own application.
  • Todyl, "How cyber insurance requirements are changing," reviewed September 2026. todyl.com
  • Consilien, "Cyber insurance requirements: 2026 readiness checklist," reviewed September 2026. consilien.com
  • UnderDefense, "Cyber insurance readiness checklist," reviewed September 2026. underdefense.com
  • SeedPod Cyber, "Minimum controls checklist for SMBs and MSPs," reviewed September 2026. seedpodcyber.com
  • HIPAA Security Rule contingency planning requirements, 45 CFR 164.308(a)(7). hhs.gov

This article is general information about operating procedures and documentation. It is not insurance advice, it is not legal advice, and it is not a statement about what any policy covers. Your policy and application wording control. Talk to your broker about your own coverage.