A ransomware incident often starts with one compromised password: a convincing phishing email, a reused credential, or a remote access account left exposed. For a business seeking or renewing cover, the question is no longer simply whether security controls exist. Does cyber insurance require MFA? In many cases, yes – particularly for the systems an attacker could use to access email, cloud data, remote networks or administrator privileges.
Multi-factor authentication (MFA) requires a person to provide two or more verification factors before signing in. Typically, that means something they know, such as a password, plus something they have, such as an authenticator app, security key or approved mobile prompt. It materially reduces the chance that a stolen password alone can lead to account takeover.
Does cyber insurance require MFA?
There is no single rule that applies to every insurer or policy. Requirements vary by insurer, policy type, cover limit, industry, claims history and the business’s overall cyber risk. However, MFA has become one of the most common baseline controls in cyber insurance applications and underwriting questionnaires.
Some insurers make it a condition of cover for key systems. Others may offer cover without universal MFA but apply exclusions, higher premiums, lower limits or more detailed security requirements. A policy may also distinguish between MFA being present and MFA being enforced for all relevant users, including contractors, executives and IT administrators.
The practical answer is that a business should treat MFA as essential if it wants to obtain competitive cyber insurance terms and strengthen its security posture. It is also a sensible operational control regardless of insurance. Insurance may help with eligible recovery costs, but it does not prevent interrupted operations, lost customer confidence or the work required to restore systems.
Where insurers commonly expect MFA
Underwriters usually focus on services that create a direct path to sensitive data, critical systems or privileged access. Email is a major priority because a compromised mailbox can be used to reset passwords, impersonate finance staff and distribute fraudulent messages internally.
MFA is commonly expected for Microsoft 365, Google Workspace and other business email platforms; virtual private networks (VPNs) and remote desktop access; cloud administration portals; privileged or administrator accounts; remote management tools; and finance, payroll or customer systems where available. Requirements may extend to software-as-a-service applications that hold personal information, payment details or commercially sensitive documents.
For Microsoft 365 environments, simply enabling MFA capability is not the same as ensuring it protects the organisation. Businesses should verify that users are actually enrolled, legacy authentication is blocked, and conditional access policies are appropriately configured. Service accounts, shared mailboxes and emergency access accounts also need careful design. They are often overlooked during implementation, yet can become exceptions that attackers exploit.
MFA methods are not all equal
Most insurers accept common MFA methods, but the quality of authentication still matters. Authenticator app codes and number-matching prompts are generally stronger than SMS codes, which can be vulnerable to SIM-swapping and interception. Hardware security keys and passkeys can provide phishing-resistant authentication, especially for high-risk administrators and finance personnel.
That does not mean every employee needs a hardware key on day one. A proportionate approach may use authenticator apps for the workforce while requiring phishing-resistant methods for privileged accounts, executives and users with access to financial approvals. The right design balances risk, usability and support capacity.
Why MFA matters during a cyber insurance claim
Insurance applications are declarations about the business’s security controls. If an application states that MFA protects email and remote access, but it was disabled, inconsistently deployed or bypassed for a material group of users, the insurer may scrutinise that gap after an incident.
The outcome depends on the policy wording, local law and the facts of the claim. Not every implementation issue automatically voids cover, and insurers should not be assumed to deny claims merely because an incident occurred. However, inaccurate answers, unmet conditions or a failure to disclose a significant change in risk can create serious complications.
This is why security and insurance teams should work from evidence rather than assumptions. Keep records of MFA policies, user enrolment, conditional access settings, exception approvals and periodic access reviews. If your managed IT provider administers identity systems, clarify who is responsible for monitoring compliance and reporting exceptions.
How to prepare before completing an insurance application
A rushed cyber insurance questionnaire can expose gaps that have existed for months. A more reliable approach is to review the environment before renewal, then remediate issues that affect both insurability and business resilience.
Start by mapping every identity platform used across the business. This includes cloud productivity suites, VPNs, remote support tools, line-of-business applications, accounting platforms and third-party portals. Identify which accounts are privileged, which are shared, and which systems still permit password-only or legacy sign-in methods.
Next, confirm that MFA is enforced rather than merely offered. Review sign-in logs and identity reports for unenrolled users, failed challenges, risky sign-ins and authentication methods that do not meet your internal standard. New starters, departing staff, contractors and dormant accounts deserve particular attention because identity lifecycle failures are a common source of unnecessary exposure.
Then test the business process around MFA. Employees need a clear way to enrol a replacement mobile, report a lost device and recognise suspicious prompts. Helpdesk staff need identity verification steps that cannot be easily defeated by a social engineering call. An attacker who persuades support to reset a password or add a new MFA method may achieve the same result as stealing a password.
Finally, compare the documented controls with the policy application and proposed wording. Ask the broker or insurer direct questions where language is unclear. For example, does the policy require MFA for all users or only remote access? Are SMS codes accepted? Are service accounts in scope? Does the requirement apply continuously throughout the policy period? Written clarification is more dependable than informal assumptions.
MFA is necessary, but it is not the entire control set
MFA significantly reduces credential-based attacks, but it cannot protect every pathway into an organisation. Attackers may exploit unpatched devices, poorly secured remote tools, compromised suppliers, malicious attachments or users who approve a fraudulent MFA prompt. A mature approach combines identity protection with proactive IT management.
Businesses should also maintain tested backups that are protected from routine user access, apply security updates promptly, limit administrator privileges, use endpoint protection and monitor for suspicious activity. Email filtering, staff awareness training and a documented incident response process further reduce operational disruption when a threat gets through.
Cyber insurers increasingly assess these controls together. An organisation with enforced MFA but no reliable backups or unsupported software may still face difficult underwriting questions. Conversely, a business that can demonstrate disciplined identity management, recoverable data and tested response procedures is in a stronger position to protect critical business data and explain its risk profile clearly.
Common MFA mistakes to avoid
The most damaging mistake is treating MFA as a one-off project. People change roles, applications are added, and authentication settings can drift after a migration or administrative change. MFA needs regular review.
Avoid blanket exclusions that remain in place indefinitely. Temporary exceptions for a legacy application may be necessary, but they should have an owner, compensating controls and a planned retirement date. Also avoid relying only on user self-reporting. Use identity platform reports to confirm coverage.
Do not overlook privileged access. Administrator accounts should be separate from standard user accounts, protected by stronger authentication and used only when administrative work is required. This reduces the impact if an everyday email account is compromised.
A practical next step for business leaders
Before your next cyber insurance renewal, ask your IT team to produce a concise MFA coverage report. It should show which critical systems are protected, how many accounts are enrolled, which exceptions remain, and what remediation is planned. That report supports better insurance discussions while giving leadership a clearer view of identity risk.
For growing organisations, this work can be difficult to sustain alongside daily support demands. A managed technology partner can help configure identity controls, monitor compliance and build a resilient technology environment without turning security into an unmanaged side project. The aim is not to satisfy a checkbox alone, but to reduce the likelihood that one compromised password becomes a business-wide incident.
