Does cyber insurance require MFA? What a yes on the form proves

Does cyber insurance require MFA? Not by law: no statute makes multi-factor authentication a condition of a cyber policy. Carriers require it themselves, in four places. It is an eligibility rule in the underwriting guide, a question on the application, a pre-bind subjectivity when the answer fails, and sometimes a condition, sublimit or exclusion in the policy. The scope applications ask about is MFA on remote access, on email and on administrator accounts, and sometimes on the backup console. What the requirement needs from an underwriter is proof, and a signed "Yes" is not proof: it is a statement that the evidence can confirm or contradict. Botminds' Cyber Underwriting Risk Assessment reads the application, ransomware supplement, outside-in scan and penetration test, and grades each MFA answer against what those documents show, before the quote.

That gap between the answer and the evidence is the subject of this guide: where MFA has to be, which kinds count, what can be checked from outside, and what follows when a yes turns out to be untrue. The examples come from a fictional sample submission, Lattimer Freight Systems, a $186.4 million freight company asking for a $5 million limit.

Does cyber insurance require MFA? Where the requirement actually sits

The requirement sits in the carrier's minimum-controls guide first, and everything else follows from it. A guide sorts controls by what they do to the decision: an eligibility control must be met or the carrier will not quote, a required control must be met or become a condition, and a priced control moves the premium without blocking the risk. In the sample carrier's guide, MFA on remote access and on email are eligibility controls in every revenue band, while MFA on privileged accounts is priced below $50 million of revenue, required from $50 million to $500 million and an eligibility rule above that.

The application turns the guide into questions, and the subjectivity turns a failed answer into a condition of binding. A policy can then carry the requirement into the contract: a warranty or condition that MFA is maintained, a sublimit that applies if it is not, or an exclusion for losses where its absence was the cause. Which of these a policy uses, and how a court reads it, is a coverage question for the wording, outside this guide. What the underwriter controls is whether the answer was true when the risk was accepted.

Where does MFA have to be for cyber insurance? Four places applications ask about

Applications ask about four places, and each is a separate door. Remote access is the door the sample carrier writes into eligibility for every revenue band: the VPN, remote desktop, remote management tools and any cloud console reachable from the internet. Email is the second, because a mailbox taken over with a stolen password can send payment instructions that look genuine: the FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with $3.05 billion of reported losses (FBI IC3 report, 2025). Privileged accounts are the third, including service accounts. The backup console is the fourth, because an attacker who can sign in there can delete the copies a company needs to recover.

Public guidance reads the same way. CISA's ransomware guidance tells organisations to "Implement phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems", and to "Implement MFA on all VPN connections to increase security" (CISA #StopRansomware Guide). It explains why remote access comes first: "Threat actors often gain initial access to a network through exposed and poorly secured remote services, and later traverse the network using the native Windows RDP client."

What counts as MFA for cyber insurance? Not every second factor is equal

Any second factor counts as MFA, but not every kind resists the attacks carriers are paying for. CISA ranks the forms from strongest to weakest by what they withstand: phishing, "push bombing", attacks on the phone network and SIM swaps (CISA fact sheet, Implementing Phishing-Resistant MFA, October 2022). It calls phishing-resistant MFA "the gold standard" and adds that "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication", with public key infrastructure as the other phishing-resistant form.

For underwriting, the ranking turns one question into two: is MFA in place, and is it a kind the guide accepts for that door. A guide can accept app codes on email for small accounts and require phishing-resistant MFA for administrators of large ones. The application has to ask the second question for the guide to use it.

A valid MFA answer is not an accurate one

A yes can be complete, consistent with every other answer on the form, signed by an officer, and still false. The form checks itself: did the applicant answer every question, do the answers agree. Accuracy is a different test, the answer against the systems it describes, and only evidence from outside the form can apply it. That is why the sample's two contradictions sat on a form that looked clean until the scan and the penetration test arrived.

The cause need not be bad faith. The person who signs the application may not be the person who runs the VPN, and "all remote access" may mean, to the signer, the VPN they use themselves. The remote desktop server opened for a vendor two months ago is not in their picture. The scan, which sees the company the way an attacker does, is.

The form can tell you an answer was given. Only the evidence can tell you it was true, and only before the quote is that difference still cheap.

Do cyber insurers check MFA? What can be seen from outside, and what cannot

Insurers can check MFA on anything that faces the internet, and need the insured's own evidence for everything else. An outside-in scan reaches login pages: it can record whether a VPN portal or a remote management page asks for a second factor, and whether a remote desktop login is reachable with nothing in front of it. In the sample scan, the VPN portal and the remote-management page both showed an MFA prompt; the remote desktop on port 3389 did not, and had been visible for at least 68 days.

Email and privileged accounts are invisible from outside. For those the evidence is a penetration test, a screenshot of the identity provider's policy, or a written confirmation from the insured's IT lead, and the subjectivity says which. The sample's privileged-account subjectivity asks the insured to enforce MFA on, or remove interactive sign-in from, the two named service accounts, "confirmed in writing by the Insured's IT lead with a screenshot of the policy". What the scan can and cannot reach is set out in the guide to cyber insurance security scan tools, and the question wording that makes MFA answers testable is in cyber insurance application questions.

The check, in view: the signed MFA answer first, the evidence next

What happens if MFA was not in place at the time of a claim?

It depends on the policy's terms and on the law that governs it, and the outcomes range from nothing to the policy being avoided. If the policy carries an MFA condition, sublimit or exclusion, those terms decide the claim. If the issue is that the application was untrue, the question becomes misrepresentation. In New York that turns on materiality under Insurance Law § 3105, set out in the application questions guide.

The United Kingdom's rules for business insurance show the range most clearly. Under Schedule 1 of the Insurance Act 2015, a deliberate or reckless breach of the duty of fair presentation lets the insurer avoid the contract and refuse every claim. Any other breach is remedied by what the insurer would have done had it known: if it would have refused the risk, it may avoid the contract but returns the premium; if it would have written different terms, those terms apply; if it would have charged more, it pays claims in proportion to the premium it actually charged (Insurance Act 2015, Schedule 1; the Distribution guide to the duty of fair presentation sets the remedies out in full).

Read as an underwriter, the middle remedy is the telling one. If the carrier would have written the risk with an MFA condition, the policy is treated as if it had one. A contradiction found before the quote lets the underwriter write that condition on purpose, in words the broker has seen, instead of having a court infer it after a loss. In the sample, the remote-access subjectivity carries its own consequence: if it is not met at binding, ransomware cover is sublimited to $2,500,000 at 50% coinsurance.

What is the NYDFS MFA requirement, and does it apply to insureds?

New York's cybersecurity regulation requires MFA of the companies the Department of Financial Services licenses, not of insureds generally, but it is a useful benchmark for what complete MFA looks like. As amended in 2023, 23 NYCRR 500.12 says "Multi-factor authentication shall be utilized for any individual accessing any information systems of a covered entity" (23 NYCRR § 500.12).

Companies with a limited exemption must still use MFA for "remote access to the covered entity's information systems", for remote access to third-party applications from which nonpublic information is accessible, and for "all privileged accounts other than service accounts that prohibit interactive login". The last phrase answers the service-account question precisely: a service account is outside the rule only if it cannot be used to sign in interactively, which is exactly the fix the sample's privileged-account subjectivity asks for. How the Department enforces the regulation against insurers themselves is in New York's cybersecurity notification requirements, read from the fines.

How Cyber Underwriting Risk Assessment grades an MFA answer

The solution grades MFA as four separate controls, remote access, email, privileged accounts and the backup console, so that a strong answer on one cannot cover a weak one on another. For each, the control grader shows the signed answer with its question number and page, then the evidence with its source and date, then the grade and the reason. It never grades a row without citing both sides, and it never decides appetite: whether a contradicted MFA answer blocks the quote is the carrier's guide and the underwriter's call.

A contradicted answer becomes a pre-bind subjectivity worded from the carrier's approved library, with the asset or account filled in from the evidence. Where the scan was the evidence, the subjectivity includes a rescan before binding, because the fix should be confirmed the same way the gap was found.

The evidence drawer: why MFA on remote access is graded Contradicted

Questions people ask

Is SMS MFA enough for cyber insurance?

That is the carrier's decision, but CISA ranks SMS and voice codes as the weakest form, vulnerable to phishing, SS7 and SIM swap attacks, and says they should be used only as a last resort. A guide that accepts SMS for some users should say so, so the answer can be graded consistently.

Can a claim be denied for no MFA?

It can, where the policy makes MFA a condition or excludes losses caused by its absence, or where an untrue MFA answer is a material misrepresentation under the governing law. In the UK, if the insurer would only have written the risk on different terms, the policy is treated as written on those terms.

Does MFA on the VPN cover remote desktop?

Only if remote desktop is reachable solely through the VPN. A remote desktop port open directly to the internet bypasses the VPN entirely, which is what the sample scan found on port 3389, and why CISA tells organisations not to expose remote desktop on the web at all.

Do service accounts need MFA for cyber insurance?

A well-drafted application asks, and New York's own rule shows the standard: MFA for all privileged accounts "other than service accounts that prohibit interactive login". A service account that a person can sign in to with a password is a privileged account without MFA.

What is phishing-resistant MFA?

It is authentication that a fake login page cannot capture and replay, because the credential is bound to the real site. CISA names FIDO/WebAuthn, used by security keys and passkeys, as the only widely available form, with PKI-based smart cards as the other.

Do small businesses need MFA to get cyber insurance?

Each carrier decides by revenue band and industry. The sample carrier treats MFA on remote access and email as eligibility controls in every band, including below $50 million of revenue, and only scales its rule for administrator accounts with size.