By: Jennifer Gilligan, IntegraMSP President
As cyber insurance requirements become more demanding, businesses and their technology providers are navigating an increasingly complicated division of responsibility.
Cyber insurance requirements are becoming more sophisticated, placing new expectations on businesses to demonstrate that their cybersecurity controls are documented, monitored, and functioning as intended. For companies that outsource IT services to a managed service provider, or MSP, those expectations introduce an important question: How much responsibility should the technology provider assume when an insurance company requests policies, procedures, and evidence of compliance?
The answer is not always as straightforward as businesses might expect.
Historically, many cyber insurance questionnaires focused on relatively basic technical safeguards. Businesses were asked whether they maintained backups, used antivirus software, required multifactor authentication, or had protections against unauthorized network access. Today, insurance applications and underwriting reviews can require considerably more detail, including documented security policies, vulnerability assessments, evidence of testing, incident response procedures, and information about how cybersecurity risks are managed.
The change is significant because it moves the conversation beyond whether a particular security control exists and into how an organization governs, documents, and verifies its cybersecurity practices. For businesses relying on an MSP, some of that information naturally comes from their technology provider. Other requirements, however, belong to the business itself. Understanding the distinction is becoming increasingly important.
What Businesses Should Reasonably Expect From Their MSP
An MSP responsible for managing a company's technology should be able to explain the services it provides and, where appropriate, supply documentation supporting those services. For example, if an MSP manages endpoint protection, patching, backups, or multifactor authentication, a client should reasonably expect confirmation of which controls are implemented and what systems are covered.
Depending on the services purchased, an MSP may also be able to provide reports showing patch compliance, backup testing, security monitoring, or other technical activities. These requests are directly related to the work the provider is performing.
The important qualification is that the information must be limited to systems and services actually managed by the provider. An MSP cannot reasonably certify controls it does not operate, independently verify, or have authority to manage. That distinction becomes particularly important when a business uses multiple technology vendors or maintains applications and systems outside the MSP's management.
A cybersecurity questionnaire may ask whether an organization has a particular control in place across its entire environment. The MSP may be able to confirm that the control exists within the systems it manages, but that does not necessarily establish that the requirement has been satisfied throughout the business. This is where documentation and clearly defined service responsibilities become essential.
Where Technical Support Ends and Business Governance Begins
A more complicated issue arises when insurance providers request formal policies, risk assessments, compliance documentation, or certification of organizational practices. A business may be asked to provide an information security policy, an incident response plan, employee access procedures, or evidence that management regularly reviews cybersecurity risks.
While these documents frequently involve technology, they are not exclusively IT responsibilities.
An incident response plan, for example, must address much more than how a technical issue will be contained. It may need to identify who has authority to make business decisions, when legal counsel should be contacted, how customers will be notified, and which executives are responsible for coordinating a response.
Similarly, an information security policy may address employee conduct, acceptable use, disciplinary procedures, data handling, and organizational risk tolerance. An MSP can provide technical input into these documents. It may also offer formal cybersecurity governance or compliance advisory services. But developing an organization's policies, establishing its risk management program, and maintaining compliance are not automatically included in a traditional managed IT services agreement.
Those activities require defined responsibilities, appropriate expertise and, in many cases, a separate engagement. The distinction matters because responsibility must be accompanied by authority. A technology provider cannot enforce every organizational policy, oversee every business process, or make executive decisions about acceptable risk on behalf of its customers.
Evidence Is Becoming as Important as Implementation
The shift toward documented verification is creating another challenge. An organization may have functioning cybersecurity protections but still struggle to produce the specific evidence requested by an insurer. For example, maintaining a backup system is not necessarily the same as producing a documented history of successful restoration tests. Having endpoint protection installed does not automatically satisfy a request for comprehensive security monitoring reports.
In some cases, the required evidence may already exist within the MSP's management tools. In others, additional testing, documentation, assessments, or reporting processes may be necessary. Those activities have a cost, even when the underlying technology is already being managed.
This creates an important consideration for both businesses and their providers. Routine reporting associated with contracted services is different from preparing specialized evidence packages, coordinating audits or performing new assessments to satisfy an external insurance requirement. The distinction should be addressed through the service agreement rather than assumed by either party.
Who Should Speak With the Insurance Company?
As underwriting questions become more technical, insurance agents and brokers may request direct conversations with a company's IT provider. There are legitimate reasons for those discussions. An insurer may need clarification about how a particular security measure works or whether a specific technical requirement has been satisfied.
But a meeting with an insurer can involve considerably more than technical clarification. Questions may extend into contractual obligations, risk acceptance, coverage representations and commitments about future compliance. Responses can also influence underwriting decisions and the insurer's understanding of the business's security posture.
The business purchasing the insurance should remain responsible for its application, the accuracy of its representations and decisions concerning coverage, with guidance from its insurance professional and legal counsel when appropriate. The MSP's role should be clearly defined.
A provider may supply verified technical information or participate in a meeting under an agreed scope. That does not mean the provider should independently complete insurance applications, make coverage representations, guarantee compliance, or accept responsibility for business risks outside its contractual control. These boundaries protect both parties by reducing ambiguity about who is authorized to speak for the organization and what information is being certified.
Shared Responsibility Requires Clear Expectations
The Cybersecurity and Infrastructure Security Agency has emphasized the importance of clearly defining responsibilities between MSPs and their customers, including security services, incident response, and contractual obligations. The principle is straightforward: Outsourcing technology management does not eliminate the organization's responsibility to understand and manage its risks.
At the same time, an MSP remains responsible for performing the services it has contracted to deliver and meeting its own applicable obligations. Neither party benefits when those responsibilities are assumed rather than documented.
For small and midsize businesses, this may require reconsidering what they expect from their technology relationships. Some organizations need traditional managed IT services, technical support, and cybersecurity protection. Others have reached a point where insurance requirements, customer contracts, or regulatory obligations justify additional governance, risk management, or compliance expertise.
Those needs may be met through an expanded MSP agreement, a virtual chief information security officer, a compliance consultant, legal counsel or some combination of those resources. The appropriate arrangement depends on the business's risk profile and the responsibilities it needs external providers to assume.
A Changing Relationship Between Businesses and Their Technology Providers
As cybersecurity insurance requirements continue to evolve, the distinction between implementing security controls and governing organizational risk is becoming harder to overlook. Businesses should expect transparency, accurate reporting, and accountability from their technology providers. They should also understand what their existing service agreements cover and recognize when additional work is necessary.
MSPs, in turn, have a responsibility to explain those distinctions clearly, document the services they provide, and avoid making commitments beyond their authority or contractual scope. The broader issue is not whether a technology provider should help a client meet its insurance requirements. In many cases, that assistance is an important part of a successful relationship.
The question is what kind of assistance is required, who is responsible for delivering it, and whether the arrangement reflects the actual work and risk involved.
As insurance carriers place greater emphasis on evidence, documentation, and organizational oversight, businesses will increasingly need both technical expertise and effective risk governance. Those functions can work together, but they are not interchangeable. And recognizing the difference may be one of the most important steps businesses can take as cybersecurity accountability continues to evolve.
