TL;DR: An evidence packet (exported sign-in logs, Conditional Access screenshots, or a signed IT-vendor letter) answers the renewal questionnaire with proof rather than a written attestation. For NC SMBs whose policies renew between July and December 2026, the window to build the evidence packet before the renewal quote lands is closing in weeks.
Key takeaway: Cyber insurance is no longer a checkbox at policy binding. It is a continuous evidence problem. If your Q4 renewal quote is going to be materially worse than last year's, the reason is almost never "your industry got risker." It is "your carrier now requires proof, and you have not built the proof yet."
Is your cyber insurance policy up for renewal between July and December 2026? Contact Preferred Data Corporation for a cyber-insurance readiness assessment and evidence-packet build. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.
What Is Changing in Cyber-Insurance Renewals?
Renewal questionnaires increasingly ask for evidence of controls.
Key takeaway: NC SMBs that treat their cyber-insurance renewal as an isolated event once a year will discover that "we passed last year" is no longer predictive.
What Evidence Should an NC SMB Have Ready for Renewal?
Plan for a renewal that asks for proof, not just a yes: for example, a sign-in log export or Conditional Access screenshot showing MFA enforcement across the last 90 days.
Three common gaps to check before renewal:
- The MFA gap on privileged accounts. MFA is enabled for the general user population but not for the domain administrator account, the SQL admin, the Cisco firewall admin, or the SaaS billing admin. Each one is a gap an evidence request would expose.
- The EDR gap on servers. EDR is deployed on user workstations but not on file servers, print servers, domain controllers, or Hyper-V hosts. Because ransomware detonates most catastrophically on servers, carriers now specifically ask for the EDR coverage percentage on the server population.
- The backup-immutability gap. 3-2-1 backup is present, but the third copy is on the same NAS with a mapped drive letter reachable from the file server. Ransomware encrypts it in the same pass. Carriers now specifically ask for evidence of immutable, offline, or air-gapped backup with a documented restore test.
What Should NC SMBs Do Before Their Q4 2026 Renewal?
The response is a coordinated four-track program to close the questionnaire gap and build the evidence packet. All four tracks run in parallel over 60-90 days.
Track 1: Identity plane hardening (Weeks 1-4).
- Enforce MFA on every user, every admin, every service where a service account cannot be constrained by IP or certificate. Microsoft Entra ID Conditional Access, Duo, Okta, Google Workspace 2SV enforcement.
- Export MFA enforcement evidence. Entra sign-in log CSV export or Conditional Access policy screenshot showing "Require multi-factor authentication" applied to all users. Duo authentication log export by user population.
- Eliminate legacy authentication protocols. Basic Auth, POP3, IMAP, SMTP AUTH without OAuth. Every one is a bypass for the MFA control.
Track 2: Endpoint plane hardening (Weeks 2-6).
- Deploy EDR on 100% of workstations and 100% of servers. SentinelOne, CrowdStrike, Microsoft Defender for Endpoint Plan 2, Sophos Intercept X, or an equivalent modern platform. Traditional AV does not satisfy the requirement.
- Confirm coverage via the EDR console. Export the deployed-agent count. Compare to the Active Directory computer object count. Any delta is a finding that will surface at questionnaire time.
- Establish a documented EDR alert triage and response procedure. MDR partnership (24/7 SOC) or written internal escalation. Carriers now ask whether alerts route to a monitored inbox or a 24/7 responder.
Track 3: Backup and recovery hardening (Weeks 3-8).
- Deploy immutable backup on the third copy. Wasabi, Backblaze B2, Azure immutable blob, AWS S3 Object Lock, Veeam Hardened Repository, Datto Immutable Cloud Series, or an equivalent. A NAS with a mapped drive letter does not satisfy the requirement.
- Perform a documented restore test. Full-system restore of at least one production server to a test environment. Written record of the restore date, the source backup, and the successful application boot.
- Document the recovery time objective (RTO) and recovery point objective (RPO) per system class. File servers, email, ERP, CRM, line-of-business applications.
Track 4: Evidence packet assembly (Weeks 8-12).
- Compile the identity, endpoint, and backup evidence into a single dated packet. Cover page with the assessment date, followed by MFA enforcement screenshots, EDR coverage exports, backup immutability confirmation, restore-test record, and any other supporting artifacts.
- Route the packet to your broker two weeks before the questionnaire is due. Brokers who see the packet in advance can pre-negotiate with the underwriter on questionnaire ambiguities.
- Update the packet quarterly. The packet is a living artifact. Any month you renew it is a month you have current-state evidence for the renewal.
How Should NC SMBs Think About Ransomware Sublimits and Exclusions?
Three concrete policy-language patterns NC SMBs should ask their broker to flag:
- Ransomware sublimit language. A sublimit on ransomware-specific first-party costs (ransom payment, negotiator, recovery).
- Widespread event exclusion. Language that excludes coverage when a covered event is part of an industry-wide campaign (Kaseya-style, MOVEit-style, ChangeHealthcare-style). NC SMBs affected as downstream victims of a vendor breach can find themselves outside coverage if this language is not specifically negotiated.
- KEV-list-related exclusion. Language that excludes coverage when the breach vector is a vulnerability that was on the CISA KEV catalog for more than a defined window before the incident.
How Does 2026 Cyber Insurance Compare to 2020 Cyber Insurance?
The 2020 SMB cyber-insurance market and the 2026 SMB cyber-insurance market are two different products.
Comparison: 2020 vs 2026 SMB cyber-insurance underwriting posture.
| Element | 2020 Standard | 2026 Standard |
|---|---|---|
| MFA requirement | Recommended | Mandatory, enforced across all users and admins |
| EDR requirement | Traditional AV acceptable | EDR/MDR required on all workstations AND servers |
| Backup requirement | 3-2-1 acceptable | 3-2-1-1-0 with immutable + documented restore test |
| Evidence standard | Written attestation | Exported logs, screenshots, or signed vendor letter |
| Broker-negotiable posture | Broad | Narrow, evidence-gated |
The market is not going to un-tighten. NC SMBs should plan for a durable evidence-required, mandatory-controls posture through at least the 2028 renewal cycle.
Explore Preferred Data's cybersecurity services
Frequently Asked Questions
Is Windows Defender enough EDR for cyber insurance?
Windows Defender in its default free configuration is not sufficient. Microsoft Defender for Endpoint (Plan 2) is the paid enterprise SKU with EDR capabilities. The distinction between "free Windows Defender AV" and "Defender for Endpoint Plan 2 EDR" is not obvious from the product naming, and it is a common questionnaire failure point.
What if we cannot deploy MFA on our ERP system because the vendor does not support it?
This is a common NC SMB pattern with legacy Actian Zen, Pervasive SQL, or vendor-specific ERP systems. The 2026 carrier expectation is a compensating control: restrict access to the ERP system to a defined jump-host or Privileged Access Workstation that itself requires MFA at logon, and document the compensating architecture in the evidence packet. Some carriers will accept this; some will require the ERP to be behind Entra Private Access or a similar ZTNA layer.
How much time do we need to build the evidence packet before renewal?
For an SMB starting from a "we have MFA on some things, EDR on workstations only, and a NAS backup" baseline, plan for 60-90 days to close the gaps and build a defensible evidence packet. For SMBs at a stronger baseline, 30-45 days is achievable. Do not start the build the week the questionnaire arrives; the timeline does not work.
What is "immutable backup" and why do carriers care?
Immutable backup is a backup copy that cannot be modified or deleted for a defined retention period, even by an administrator with full credentials. Object Lock in S3-compatible storage, Veeam Hardened Repository, Datto Immutable Cloud Series, and Wasabi Bucket Lock are examples. Carriers care because the ransomware playbook now specifically targets and encrypts writable backups as a first step; an immutable copy is the one thing an attacker cannot delete.
Does using an MSP help our cyber-insurance renewal?
It can. An MSP can (a) produce evidence packets that a broker can attach to a questionnaire, (b) join an underwriter call to speak to controls, and (c) be contractually accountable for maintaining the controls between renewals.
Can we skip cyber insurance and self-insure?
Self-insurance is a legitimate strategy for organizations with the balance sheet to absorb a major incident cost. Self-insurance without that balance-sheet backing is not a strategy; it is a bet.
Related Resources
- Cybersecurity Services for NC Small Businesses
- Managed IT Services
- Backup Services
- Contact PDC - request a cyber-insurance readiness assessment and evidence-packet build