By: Jennifer Gilligan, IntegraMSP President
As insurers demand more evidence of cybersecurity oversight, small businesses face growing compliance costs, complicated technology decisions, and a widening gap between perceived risk and actual exposure.
Cyber insurance is changing how businesses are expected to manage and demonstrate their cybersecurity practices. What began as relatively straightforward questions about antivirus protection, backups and network security has expanded into requests for documented policies, formal risk assessments, testing and evidence that security controls are operating effectively.
For large organizations with dedicated compliance departments, legal advisers and cybersecurity teams, these requirements may be manageable extensions of existing programs. For small and midsize businesses, however, they can represent substantial new operational and financial obligations. The underlying concern is legitimate. Cyberattacks can cause significant financial losses, and insurers need reliable information to evaluate the risks they underwrite.
But the growing complexity raises another question: What happens when the expectations placed on small businesses begin to exceed their resources, expertise, or understanding of the risks involved?
For companies that outsource their IT management, the issue is further complicated by uncertainty about who is responsible for meeting those expectations.
Why Insurers Are Demanding More Evidence
Cyber insurance companies face an unusual underwriting challenge. Unlike many traditional insurance risks, cybersecurity threats evolve rapidly and can affect multiple policyholders simultaneously. A vulnerability in widely used software, an attack against a cloud provider, or a compromise involving a technology vendor can expose numerous businesses to losses from a single event.
According to the National Association of Insurance Commissioners' October 2026 report, U.S. insurers reported 56,323 cyber insurance claims in 2025, an increase of 20% over the previous year. The domestic cyber insurance market has nearly tripled since 2020, reflecting the growing importance of coverage as cybersecurity threats evolve. Understanding whether a business has purchased cybersecurity products is no longer necessarily sufficient to evaluate its exposure. An organization may have backup software without regularly testing whether its data can be restored. Multifactor authentication may be available but inconsistently enforced. Security monitoring may cover only some of the systems the business relies upon. For insurers, the difference between having a security control and demonstrating that it works can materially affect the assessment of risk. This helps explain the increasing emphasis on documentation, testing and verification. Insurers want greater confidence that the protections described in applications reflect actual operating practices. The challenge is that producing that evidence can require processes and expertise that many smaller businesses have never needed to establish.
When Compliance Becomes a Business Expense
Small businesses have historically relied on outside providers for functions they cannot economically maintain in-house. Accounting, legal services, human resources, and technology management are common examples. Cybersecurity governance and compliance are increasingly adding to that list.
A company might employ a managed service provider, or MSP, to maintain its network, support employees, manage backups and implement cybersecurity protections. It may reasonably expect that provider to document the technical services being delivered. However, developing organizational security policies, conducting formal risk assessments, coordinating audits and establishing governance programs can extend beyond routine technology management. These activities often require decisions involving company leadership, legal counsel, insurance professionals, and specialized compliance advisers. They also require time and money. The financial implications extend beyond purchasing additional security software. Businesses may need to invest in policy development, employee training, recurring assessments, reporting systems, and ongoing administrative oversight. For organizations with limited staffing and tight operating margins, these are not insignificant commitments. The question becomes whether compliance requirements intended to reduce risk are creating a level of complexity that some smaller organizations struggle to absorb.
Outsourcing Technology Doesn't Mean Outsourcing Accountability
One of the more complicated aspects of these changing requirements is understanding where the responsibilities of a business end and those of its technology provider begin. The Cybersecurity and Infrastructure Security Agency addresses this distinction in its guidance for managed service provider customers, emphasizing that outsourcing IT management does not eliminate an organization's responsibility for managing its own risk. That does not mean technology providers bear no responsibility. An MSP remains accountable for the services it has contracted to deliver.
If an MSP manages endpoint protection, patching, backups, or multifactor authentication, a client should reasonably expect accurate information about those services and appropriate evidence of their implementation. But a request for a companywide information security policy, formal incident response plan, or organizational risk assessment involves more than the technical operation of systems. Those documents can address employee behavior, management authority, legal obligations, business continuity and decisions about acceptable risk.
A technology provider can contribute expertise, but it cannot automatically make those organizational decisions on behalf of its client. The distinction becomes particularly important when insurance requirements extend to applications, employees, departments, or third-party services outside the MSP's management. A provider may be able to verify that a security control exists within the systems it manages without being able to certify that the same control is consistently applied across the entire organization. Understanding these boundaries is essential to establishing accurate expectations and avoiding gaps in accountability.
The Conversation Should Begin Before the Insurance Questionnaire Arrives
A common challenge arises when a business receives a cybersecurity insurance questionnaire and forwards it directly to its IT provider for completion. The approach is understandable. Many of the questions concern technical systems that business owners do not manage themselves. However, insurance questionnaires increasingly include questions that cannot be answered through technical knowledge alone. Some require confirmation of existing security controls. Others ask whether formal policies have been adopted, whether employees receive training, whether management conducts periodic risk reviews, or whether specific procedures are consistently followed.
These questions involve different areas of responsibility.
An MSP may know whether multifactor authentication is enabled on the systems it manages. It may not know whether every employee follows the organization's data handling policies or whether management has formally approved a business continuity plan. The distinction matters because insurance applications involve representations about the organization's actual practices. Inaccurate or unsupported statements can create complications during underwriting and, depending on the circumstances and applicable law, during a subsequent claim.
A more effective approach begins before the application or renewal deadline. Businesses and their technology providers can review the requirements, identify which controls are already in place, determine what evidence is available, and establish which obligations require additional attention. That process may reveal genuine security gaps. It may also identify situations in which appropriate protections exist, but the documentation needed to demonstrate them has never been developed. Those are different problems, with potentially different solutions and costs. Discussing the requirements in advance also helps clarify when technical reporting falls within an existing managed services agreement and when additional assessments, documentation, or consulting may be necessary.
The objective is not to complicate the insurance process. It is to prevent a routine renewal from becoming an urgent effort to establish responsibilities and make commitments that were never previously defined.
When Insurance Requirements Begin Influencing Technology Providers
Another development complicating the relationship between businesses, insurers and managed service providers is the use of insurer-affiliated cybersecurity vendors. Insurance carriers have developed relationships with technology and security providers to help assess risk, deliver preventive services and support incident response. These arrangements can offer practical benefits. Insurers gain access to technical expertise, while policyholders may receive access to specialized services, preferred pricing, or resources that would otherwise be difficult to obtain.
However, there is an important distinction between recommending an affiliated provider and making the use of that provider a condition of coverage. Some businesses are encountering situations in which their existing technology provider is considered unable to meet an insurer's requirements and an insurer-affiliated provider is presented as an alternative.
For small businesses with established IT relationships, such arrangements introduce questions about cost, provider choice, and operational continuity. Replacing an MSP is not necessarily a simple vendor substitution. The existing provider may have years of knowledge about the organization's systems, business processes, employees and operational requirements. A transition can involve changes to security tools, infrastructure management, technical documentation and support procedures. There is also a distinction between using an insurer's approved incident response specialists after a claim and requiring a business to change its ongoing managed IT provider as a condition of obtaining or retaining insurance coverage.
For example, insurer Chubb maintains a network of incident response providers, while also allowing policyholders to request approval for providers outside that network. Such arrangements demonstrate that insurers are influencing how businesses access specialized cybersecurity services. They do not, however, establish a general requirement that businesses replace their existing MSPs. When an insurer recommends a particular provider, businesses should understand whether that recommendation is optional, represents one way to satisfy a security requirement, or is an actual condition of coverage. Insurers have legitimate reasons to require evidence of security capabilities. Businesses also have an interest in understanding whether the required standard can be met through their existing provider or an independent assessment. The larger question is whether insurance requirements will increasingly influence not only the cybersecurity outcomes businesses must demonstrate, but also which technology partners they use to achieve them.
The Value of an Existing Technology Relationship
As insurance requirements become more sophisticated, an established relationship with a technology provider can become an important resource. An MSP familiar with a company's infrastructure, security controls and operating environment can help identify which requirements are already satisfied, where additional safeguards may be necessary and whether an apparent compliance deficiency is actually a documentation issue. In some cases, a business may not need additional technology. It may need better procedures, verification of existing controls, or more comprehensive documentation.
The National Institute of Standards and Technology recognizes that smaller businesses frequently rely on outsourced cybersecurity expertise, including MSPs and fractional security leadership, because maintaining those resources internally may not be practical. That relationship can support broader risk management discussions, provided the responsibilities are clearly defined. Routine technical reporting is different from developing organizational policies, conducting formal assessments, coordinating audits or participating in detailed insurance underwriting discussions. Some technology providers offer these capabilities through additional consulting or advisory services. Others coordinate with specialized compliance professionals, insurance brokers, or legal counsel. The value of a trusted technology adviser is not in assuming every responsibility presented to the business. It is in helping leadership understand what is required, which controls already exist, and where additional expertise or resources may be necessary. For smaller organizations without internal cybersecurity leadership, that distinction can be particularly valuable.
The Risk Businesses Haven't Experienced Yet
A related issue surfaced during a recent managed service provider peer group discussion: Some small business owners remain willing to accept significant cybersecurity exposure because they have not personally experienced the consequences. The observation reflects a challenge that extends well beyond cybersecurity. Risk can be difficult to prioritize when its consequences are uncertain, the expense of prevention is immediate, and the business has competing operational demands. A company that has never experienced a serious security incident may conclude that its existing practices are adequate. The absence of a major problem can reinforce that assumption, even when meaningful weaknesses remain.
Research suggests that confidence and preparedness do not always align.
The National Cybersecurity Alliance's 2026 Small Business Cybersecurity Awareness & Practices Survey, developed in partnership with CISA, examined 1,000 small and midsize business leaders across 10 industries. The survey found a significant gap between confidence in cybersecurity preparedness and the ability to verify effective protection. More than half of the businesses surveyed could not confirm that they had maintained a clean security record. The findings also highlighted problems with the consistent use of existing security tools and the growing gap between AI adoption and AI governance. This does not mean small business owners are indifferent to cybersecurity. Many are concerned about the risks but face difficult decisions about where to allocate limited resources. It does suggest that awareness of a threat does not necessarily produce meaningful changes in business behavior. When the consequences have not yet been experienced, the perceived cost of prevention may appear greater than the perceived cost of doing nothing.
What Happens When Accountability Catches Up?
The financial consequences of a cyber incident do not necessarily end with recovering systems or restoring operations. Businesses may face customer claims, contractual disputes, regulatory investigations, notification obligations, and other costs depending on the nature of the incident and applicable laws. Insurance can help address some of those losses, but coverage is governed by policy terms, exclusions, limits and other conditions. As insurance underwriting becomes more demanding, businesses that have delayed cybersecurity investments may encounter additional challenges when applying for coverage or renewing existing policies.
At the same time, customer contracts and regulatory expectations are continuing to evolve. This creates the potential for a significant mismatch. A business may believe it is operating within an acceptable level of risk because it has not experienced a serious incident, while its insurer, customers or regulators increasingly expect documented evidence that specific controls and governance practices are in place. Those expectations do not automatically establish legal liability. Responsibility for any particular incident will depend on the facts, relevant laws and contractual obligations.
But the direction of the discussion is important. Cybersecurity is becoming less about whether a company believes it is adequately protected and more about whether it can demonstrate that its practices meet the obligations it has undertaken. For small businesses that have not invested in those processes, the consequences may become apparent at insurance renewal, during contract negotiations or after an incident, when there is considerably less flexibility to address the underlying issues.
The Challenge of Bringing Small Businesses Along
More demanding underwriting practices are not inherently unreasonable. Insurers have a legitimate financial interest in reducing preventable losses, and businesses benefit when effective safeguards reduce the likelihood and severity of incidents. The concern is whether the growing expectations are being communicated and implemented in ways that recognize the operating realities of smaller organizations. A company with 20 employees cannot necessarily be expected to maintain the same internal governance structure as an enterprise with hundreds of employees and dedicated risk management staff. That does not mean it should be exempt from appropriate cybersecurity practices. It means the methods used to establish, document, and verify those practices may need to reflect the size and complexity of the business. Managed service providers, insurance brokers, compliance advisers and business leadership all have roles in helping organizations understand those differences.
But their responsibilities are not interchangeable. A technology provider can implement and document agreed-upon security controls. An insurance professional can explain coverage requirements. Compliance and legal advisers can help interpret obligations and develop appropriate governance practices. The business itself remains responsible for making informed decisions about its risk tolerance and the resources it commits to managing that risk. An established technology partnership can help make that process more manageable, particularly when responsibilities are defined before a renewal, audit or claim creates urgency. As expectations evolve, greater clarity will be needed about what is required, why it matters, who is responsible and what it will cost.
A Growing Divide Between Expectations and Readiness
Cyber insurance is becoming an increasingly influential force in how businesses approach cybersecurity governance. That influence can produce meaningful improvements in security, but it also has the potential to expose a widening divide between organizations that have the resources to demonstrate compliance and those still struggling to establish basic oversight. The challenge for smaller businesses is not simply the cost of cybersecurity tools. It is the increasing expectation that they manage technology risk through formal processes, documented controls, and clearly assigned accountability.
For some organizations, those expectations represent a necessary progression in business maturity. For others, they may arrive before leadership has fully recognized the risks involved or developed the capacity to address them. Meanwhile, insurers are developing more sophisticated ways to evaluate exposure, and technology providers are navigating changing expectations about the services they should deliver and the responsibilities they should assume. These developments are moving at different speeds.
The question is whether small businesses will have the guidance, flexibility and resources needed to adapt before insurance restrictions, contractual demands or legal consequences force the issue. The absence of a cybersecurity incident is not evidence that the risk has disappeared. And the absence of consequences today does not guarantee that businesses will be protected from them tomorrow.
