TL;DR: North Carolina small businesses must demonstrate enforced multi-factor authentication, endpoint detection and response across every device, immutable backups, and a documented incident response plan, or face renewal denials and premium hikes. The path to renewal is achievable in 4 to 8 weeks with a focused remediation plan.
Cyber insurance renewal coming up? Preferred Data Corporation has helped North Carolina manufacturers, contractors, and professional service firms qualify for cyber coverage. Call (336) 886-3282 or contact us for a renewal-ready security assessment.
How large are reported cybercrime losses?
The FBI Internet Crime Complaint Center 2024 Annual Report documented over $16 billion in reported losses, a 33% increase year over year, with business email compromise alone driving $2.77 billion across 21,442 complaints.
What Controls Do Cyber Insurers Now Require?
Underwriting questionnaires in 2026 have converged on a baseline set of controls. According to a Prescient Solutions 2026 SMB cyber insurance checklist and Alphacis 2026 cyber insurance requirements analysis, the controls insurers prioritize are MFA, EDR, immutable backups, email security, vulnerability management, security awareness training, and a documented incident response plan.
Three controls to start with:
Enforced Multi-Factor Authentication (MFA)
Many cyber insurers now mandate enforced MFA across email, VPN, RDP, cloud applications, and all admin accounts. The keyword is "enforced," meaning users cannot opt out. Phishing-resistant MFA (FIDO2 hardware keys, certificate-based authentication) earns the most favorable underwriting terms.
- ☐ Microsoft 365 / Google Workspace MFA enforced for all users
- ☐ VPN and remote access MFA enforced
- ☐ Privileged accounts on phishing-resistant factors (FIDO2 keys)
- ☐ Service accounts protected with conditional access or rotating credentials
Endpoint Detection and Response (EDR or MDR)
Many carriers now require EDR or MDR tools deployed across every endpoint: laptops, desktops, servers, and increasingly mobile devices. Traditional antivirus is no longer sufficient. Insurers want behavioral detection, automated response, and 24x7 monitoring.
- ☐ EDR agent installed on every workstation, laptop, and server
- ☐ Telemetry sent to a SIEM or MDR provider for analysis
- ☐ Automated isolation capability for compromised endpoints
- ☐ Documented mean time to detect (MTTD) and mean time to respond (MTTR)
Immutable, Tested Backups
Ransomware operators routinely target backups before encrypting production data. Carriers now require backups that cannot be deleted or modified, paired with documented test restorations.
- ☐ 3-2-1 backup rule (three copies, two media types, one offsite or air-gapped)
- ☐ Immutable storage configured (object lock, retention lock, or vault)
- ☐ Quarterly test restores documented
- ☐ RTO and RPO targets defined and validated
Key takeaway: MFA, EDR, and immutable backups are three controls insurance applications commonly ask about.
PDC's cybersecurity services and backup and disaster recovery offerings deliver each of these controls as managed services for North Carolina small businesses, with documentation suitable for insurance underwriting.
How Much Does Each Control Cost a Small NC Business?
Indicative monthly costs for a 50-employee North Carolina small business, based on PDC engagement data and public market benchmarks. Actual costs vary by environment, vendor, and existing licensing.
| Control | Typical Monthly Cost (50 endpoints) |
|---|---|
| Enforced MFA (already in M365/Google) | Included in license |
| Phishing-resistant MFA (FIDO2 keys) | $5 to $10 per user |
| EDR (managed) | $8 to $20 per endpoint |
| MDR (24x7 SOC) | $25 to $60 per endpoint |
| Immutable cloud backup | $300 to $1,200 per month |
| Security awareness training | $3 to $8 per user |
| Documented IR plan and tabletop | $2,500 to $7,500 (one-time) |
For a 50-person Piedmont Triad business, the total combined investment typically lands between $1,200 and $3,500 per month.
What Does the 2026 Cyber Insurance Application Look Like?
Common knock-out questions in 2026 applications:
- Is MFA enforced on all email, VPN, and remote access systems?
- Is EDR or MDR deployed on every endpoint, including servers?
- Are backups immutable and stored offsite or air-gapped?
- Have backup restorations been tested in the last 90 days?
- Is there a documented incident response plan with named owners?
- Has every employee completed security awareness training in the last 12 months?
- Is there a documented patch management process with SLA?
- Are privileged accounts segregated from daily-use accounts?
- Is email filtered for phishing, BEC, and malicious attachments?
- Is there a tested process to detect and revoke former employee access?
Compliance with these baseline questions is the floor, not the ceiling. Higher-tier questions cover network segmentation, OT/IT separation for manufacturers, identity governance, vendor risk management, and AI usage policies.
Sample 2026 Underwriting Questionnaire Structure
| Section | Sample Questions | Documentation Required |
|---|---|---|
| Identity | MFA scope, password policy, privileged access | M365/AD reports, MFA enforcement policy |
| Endpoint | EDR coverage, patch SLA, encryption | EDR vendor report, patch compliance log |
| Network | Firewall rules, segmentation, RDP exposure | Firewall config, network diagram |
| Backup | 3-2-1, immutability, test restore cadence | Backup vendor report, restore test logs |
| DMARC, phishing simulation, BEC controls | DMARC report, training completion records | |
| Governance | IR plan, vendor risk, training | IR plan PDF, training reports |
PDC delivers underwriting-ready documentation as part of every managed IT engagement.
How Does AI Affect 2026 Cyber Insurance Pricing?
AI is shifting the loss landscape in two directions, and underwriters are pricing both. On the offense side, AI-generated phishing now appears in 82.6% of phishing emails per Hoxhunt 2026 BEC research, and deepfake-driven CEO fraud has risen sharply, accounting for 40% of business email compromise according to Digital Applied research. On the defense side, EDR and MDR vendors that use AI for detection are achieving demonstrably better mean-time-to-detect, which carriers reward with lower premiums.
What insurers will ask in 2026:
- Has the company published an AI usage policy?
- Are employees trained to verify financial requests with out-of-band confirmation?
- Are sensitive data flows reviewed when deploying generative AI tools?
- Is there a process to revoke AI tool access tied to former employees?
For North Carolina manufacturers exploring AI transformation initiatives, getting these governance pieces in place protects both the upside (productivity gains) and the downside (insurance posture).
What Is the 60-Day Renewal Readiness Plan?
A focused 60-day plan can move most North Carolina small businesses from a likely denial or premium hike to a competitive renewal. Use this sequence.
Days 1 to 14: Assess and Prioritize
- Pull your current cyber insurance application and broker's renewal supplement
- Run a control gap analysis against the 2026 questionnaire
- Identify your top three knock-out risks
- Get a remediation quote with timeline and cost
Days 15 to 35: Remediate Knock-Out Items
- Enforce MFA across email, VPN, and admin accounts
- Deploy or expand EDR coverage to 100% of endpoints
- Configure immutable backups and run a test restore
- Document the changes for the broker
Days 36 to 50: Strengthen Secondary Controls
- Roll out phishing-resistant MFA for privileged users
- Run a phishing simulation and security awareness training
- Refresh the incident response plan and run a tabletop exercise
- Tighten patch SLAs and document the cadence
Days 51 to 60: Document and Submit
- Compile the underwriting evidence package: policy excerpts, vendor reports, screenshots
- Walk the broker through the documentation
- Submit the renewal supplement
- Address any underwriter follow-up questions
Key takeaway: Underwriters reward documented controls more than they reward promises.
PDC's vCIO and managed IT services include underwriting evidence packaging for North Carolina small businesses, including manufacturers in the Piedmont Triad, professional firms in Charlotte and Raleigh, and contractors across Greensboro and Winston-Salem.
Renewal in less than 60 days? Call Preferred Data Corporation at (336) 886-3282 or request an emergency renewal assessment and we will scope a fast-track remediation plan.
Frequently Asked Questions
Will missing controls raise my cyber insurance premium in 2026?
Businesses missing one or more knock-out controls (MFA, EDR, immutable backups) often see premium increases or outright denials.
What happens if my cyber insurance is denied?
If your renewal is denied, you typically have three options: shop the application to other carriers (limited; controls drive most of the pricing), accept a higher-priced surplus lines policy with limited coverage, or remediate controls and reapply.
Is MFA on email enough, or do I need it everywhere?
MFA on email alone will not satisfy 2026 underwriters. The minimum scope is enforced MFA on email, VPN, RDP, all cloud applications that handle sensitive data, and all administrative accounts. Phishing-resistant MFA (FIDO2 keys, certificate-based) on privileged accounts is increasingly expected.
Do I really need EDR if I already have antivirus?
Yes. EDR provides behavioral detection, automated isolation, and forensic data that traditional AV cannot deliver.
What backup approach satisfies 2026 cyber insurance underwriters?
The baseline is the 3-2-1 rule (three copies, two media types, one offsite) plus immutability (object lock, retention lock, or air gap) plus tested restorations within the last 90 days. Carriers want to see vendor reports proving the backups exist and restoration logs proving they work.
Can I get cyber insurance if I'm a manufacturer with old OT systems?
Yes, but underwriters expect compensating controls: network segmentation between IT and OT, monitored boundary devices, documented patching cadence even where direct patching is impossible, and risk acceptance language for legacy systems. PDC's cybersecurity services include OT/IT segmentation reviews and CMMC-aligned controls for North Carolina manufacturers.
How do I document my controls for the underwriter?
Build an evidence pack with: a one-page security posture summary, MFA enforcement reports from your identity provider, EDR coverage report from your endpoint vendor, backup and restore test logs, the most recent vulnerability scan summary, the incident response plan, and security awareness training completion records. PDC delivers a polished evidence pack as a standard deliverable in our managed engagements.
Does cyber insurance cover ransomware payments?
Coverage varies by policy and jurisdiction. Most 2026 policies cover ransomware response costs (forensics, restoration, legal), but coverage of the ransom payment itself depends on the policy form, OFAC sanctions screening, and increasingly carrier-specific exclusions. Talk to your broker about the specifics before relying on payment coverage.
Related Resources
- Cybersecurity Services for NC Businesses
- Backup and Disaster Recovery
- Managed IT Services
- AI Transformation and Governance
- Contact Preferred Data Corporation
Ready to renew with confidence? Preferred Data Corporation has served North Carolina manufacturers, contractors, and professional service firms from our High Point headquarters since 1987. We provide on-site support within 200 miles of High Point, covering the Piedmont Triad, Charlotte, Raleigh, Greensboro, and Winston-Salem. Call (336) 886-3282 or request your cyber insurance readiness assessment today.