Cyber Insurance Requirements for Texas Small Businesses

Dane Gray

Nov 4

5 min read

A few years ago, a cyber insurance application was a page of yes-or-no questions. Today it reads more like a security review. Carriers want to know how you sign in, how you back up, who watches for attacks and what you'd do on a bad day. Answer "no" to the wrong question and you may face a higher premium, a lower limit, an exclusion, or no offer at all. Answer "yes" when the real answer is "sort of," and a claim can be challenged later.

This guide covers the controls insurers commonly ask Texas small businesses about, how to answer the application honestly, and how the same work lines up with a written cybersecurity program under Texas law. It's general information, not legal or insurance advice; your broker and policy have the final word.

Why the application matters as much as the policy

Your answers on the application become part of the deal. If a claim comes in and the investigation shows that a control you said was in place wasn't, the carrier may dispute coverage. That's why it pays to treat the application as a checklist to verify, not a form to rush through.

Before you sign, ask your IT provider to confirm each technical answer, and keep the proof on file.

The controls insurers commonly ask about

Every carrier words it differently, but most applications come back to the same list.

1. Multifactor authentication (MFA) everywhere it counts

Expect questions about MFA on email, remote access, admin accounts and cloud apps. "Everywhere it counts" usually means every user, not just the owner. Phishing-resistant options like passkeys or security keys are stronger still; see device code phishing: when MFA isn't enough.

2. Backups you can actually restore

Carriers ask whether backups are kept separate from your network, whether at least one copy can't be changed or deleted, and whether you test restores. A written disaster recovery plan and recent test results answer these questions well. Don't forget Microsoft 365 data: Microsoft doesn't back it up for you.

3. Endpoint detection and response, with someone watching

Many applications ask for endpoint detection and response on every computer and server, and some ask who reviews the alerts and when. 24/7 monitoring, where security analysts review alerts around the clock, answers the "who's watching after hours" question.

4. Email security

Expect questions about filtering for phishing and malicious attachments, and about domain protections (SPF, DKIM and DMARC) that make your company's email harder to fake. Some carriers ask whether automatic forwarding to outside addresses is blocked, which also shuts down the inbox-rule attacks behind many payment-fraud claims.

5. Patching and supported systems

Carriers ask how quickly you apply security updates and whether anything runs on software that no longer gets them. Have a short list of anything older and what you're doing about it.

6. Admin accounts and access

Separate admin accounts from everyday accounts, limit who has admin rights, and remove access promptly when people leave. Our Microsoft 365 employee offboarding checklist covers the last part.

7. Security awareness training and phishing practice

Most applications ask whether staff are trained and tested. Keep records of who completed training and when.

8. Payment verification procedures

Social engineering and funds-transfer fraud coverage often depends on a documented callback rule: any change to payment details is confirmed by phone at a number already on file.

9. An incident response plan

Insurers want to know you have a written plan, who's on it and whether you've practiced it. Most carriers also give you a breach hotline and a panel of response firms. Put that number in your plan before you need it.

What's different for a Texas business

A written cybersecurity program can help you in court. Texas SB 2610 gives businesses with fewer than 250 employees a defense against certain exemplary damages after a data breach, if they had a cybersecurity program in place that meets the law's standards. The work an insurer asks for, such as MFA, backups, monitoring and training, is much of that program. Our Texas SB 2610 explainer covers what the program needs.

Texas breach notice rules apply. Texas law sets requirements for notifying affected people, and in larger breaches the Texas Attorney General, when certain personal information is exposed. Your policy may help pay for notification and legal counsel, so know what's covered before you need it.

Local weather overlaps with cyber risk. Storm and power outages aren't cyber events, but they test the same backups and plans. Check with your broker how your property, business interruption and cyber policies fit together.

How to get ready before renewal

Get a copy of last year's application and the new one as early as your broker can share it.
Go through each question with your IT provider and mark anything that's "partly" true.
Close the gaps that matter most first: MFA for everyone, protected backups, endpoint detection and response with monitoring, and blocked external forwarding.
Collect proof: screenshots, reports, training records and test-restore results.
Keep it all in one folder so next year's renewal, and any claim, is easier.

How 24uNet helps Texas businesses

We help businesses in Bryan, College Station and across Texas answer cyber insurance applications accurately, close the gaps carriers care about and keep the proof on file. Our Security Baseline covers the core controls insurers ask about, our Texas cybersecurity program documents it, and our identity threat detection and response service watches Microsoft 365 sign-ins around the clock. Learn more about our cybersecurity services in Bryan–College Station, or contact us to go through your application together before renewal.

FAQ

What do cyber insurance companies require from small businesses?

Most commonly: multifactor authentication, protected and tested backups, endpoint detection and response with monitoring, email security, regular patching, limited admin access, staff training, payment verification procedures and a written incident response plan.

Is MFA required for cyber insurance?

Most carriers ask about MFA on email, remote access and admin accounts, and many won't offer coverage without it. Check your application for the exact wording.

Can a claim be denied if our application was wrong?

It can be disputed. If the investigation finds a control you said was in place wasn't, the carrier may challenge coverage. Verify every answer with your IT provider before signing.

Is cyber insurance required by Texas law?

No Texas law requires most small businesses to carry cyber insurance, but customers, lenders and contracts sometimes do. A written cybersecurity program can also matter under Texas SB 2610.

Does cyber insurance cover wire fraud?

Sometimes, under social engineering or funds-transfer fraud coverage, which may be limited or optional. Ask your broker and keep a documented callback procedure.

Can 24uNet help with our cyber insurance application?

Yes. We review the technical questions with Texas businesses, fix gaps and gather proof for the application.