Cyber Insurance Renewal: What Changed and How to Prepare in 2026

Read the complete guide: How do you make your IT cyber-insurance defensible? A 2026 guide for commercial businesses.

Cyber insurance renewal used to be a formality. A broker sent a short form, the firm signed, and the premium barely moved. That ended in 2021 and 2022, when a wave of ransomware losses pushed premiums up and turned the application into a detailed security audit. The market has calmed since, but the renewal is not the rubber stamp it once was. For a 10-to-100 person law firm, accounting practice, or professional services group, understanding what changed is the difference between a smooth renewal at a competitive rate and a last-minute surcharge, a coverage cut, or a declined policy.

The market softened, but the requirements did not

The most important thing to understand about the 2026 renewal is that pricing and requirements moved in opposite directions. On price, the news is good. After the double-digit increases of the hard market, additional underwriting capacity entered the space and carrier loss ratios improved, and cyber insurers such as Coalition have reported flat-to-declining pricing for accounts that present well. Industry coverage from outlets like Insurance Journal has tracked the same shift from a hard market to a more competitive one.

On requirements, nothing loosened. The controls carriers demanded when premiums spiked are now the permanent baseline. The National Association of Insurance Commissioners has documented the market's growth and the increasingly control-driven nature of underwriting in its cyber insurance reporting. In practice, that means the soft pricing is available only to firms that can still prove their controls. A firm that cannot is not shopping the same market as one that can.

What underwriters now expect as table stakes

The renewal application has converged across carriers on a recognizable core set of controls. Expect to attest to each of these, and expect to prove some of them:

• Multifactor authentication (MFA) on email, remote access, and administrative accounts. This is the single most scrutinized control, and its absence is now grounds for non-renewal at many carriers. We covered why in Why does cyber insurance now require MFA everywhere?
• Endpoint detection and response (EDR) with monitoring, not just legacy antivirus.
• Tested backups that are offline or immutable, so ransomware cannot encrypt them along with production data.
• Email filtering and security awareness training, because phishing remains the dominant entry point.
• A written incident response plan and, increasingly, evidence it has been exercised.
• Timely patching of internet-facing systems and a process to address critical vulnerabilities quickly.

Newer questionnaires push further, asking about privileged access management and application controls such as allowlisting. If your renewal form asks whether you restrict which programs can run, that is not idle curiosity; it maps to how ransomware actually executes. We explained the underwriting logic in Ring-fencing and application allowlisting: why underwriters ask. These control expectations track closely with public frameworks such as the NIST Cybersecurity Framework and CISA's cyber hygiene guidance, so aligning to those standards is a reliable way to stay ahead of what the next questionnaire will ask.

The application is a legal document, not a survey

The most expensive renewal mistake has nothing to do with price. It is answering the application inaccurately. Every attestation on a cyber insurance application is a representation the carrier relies on to issue the policy, and if a claim later reveals that a control was not actually in place as stated, the carrier can dispute or deny coverage. This is not hypothetical; misrepresentation on the application is a recurring reason claims fail. We walked through the mechanics in Why do cyber insurance claims get denied?

The trap is subtle. A firm answers "yes, we require MFA" because it is enabled for most staff, when a legacy protocol or a service account still allows a password-only login. At renewal, the honest answer is the one that survives a claim. If a control is only partially deployed, say so, and use the 90-day window to close the gap before you sign.

A 90-day renewal playbook

Treat the renewal as a short project with a fixed deadline, working backward from the policy expiration date.

1. Day 90: request the application early and read the whole thing. The questionnaire tells you exactly what the carrier will grade. Any question you cannot answer with a confident "yes" is a work item.
2. Day 75: close the gaps. Deploy the missing control, or document a compensating control and a remediation timeline. This is the highest-leverage step, because it changes both your risk and the price you qualify for.
3. Day 60: gather evidence. Collect configuration screenshots, an MFA coverage report, backup test results, and your incident response plan. Carriers increasingly ask for proof, and having it ready signals a mature program.
4. Day 45: give your broker time to market the account. In a competitive market, a broker who can approach multiple carriers with a clean, well-documented submission will find better terms than a single incumbent quote.
5. Day 15: review the quote for coverage, not just premium. Compare sublimits for ransomware, social engineering and funds transfer fraud, business interruption waiting periods, and any new exclusions. A cheaper policy with a low social-engineering sublimit is a poor trade for a firm that wires client funds.

For professional services firms, one more item belongs on the list. Accounting practices handling customer financial information fall under the FTC Safeguards Rule, and law firms handling regulated client data carry parallel obligations. The same controls that satisfy those rules are the ones your cyber carrier wants to see, so treat compliance and insurability as one program rather than two.

The firms that renew well are the ones that never let controls drift

The pattern across every smooth renewal is the same: the controls were already in place and already documented, so the application was a reporting exercise rather than a remediation scramble. The firms that struggle are the ones that treated last year's attestations as a one-time event and let MFA coverage, patching, or backup testing quietly slip over twelve months. The renewal simply surfaces the drift.

That is the case for treating your security controls as an operating baseline maintained year round, not a checklist assembled two weeks before the deadline. For the full set of controls underwriters expect and how they fit together, start with the pillar guide on cyber-insurance defensible IT.