Business Cyber Insurance Requirements and CIS IG2/IG3 Guide

We do not treat a cyber insurance questionnaire as paperwork to get through. Every security answer should be something the business can prove. That is one reason CIS IG2 and IG3 are useful: they turn isolated underwriting questions into a broader operating security program.

Cyber insurance has become an important part of business risk management, but obtaining a policy does not replace the need for a mature cybersecurity program.

Insurers may ask detailed questions about identity security, multi-factor authentication, endpoint protection, backups, vulnerability management, email security, remote access, incident response and other safeguards.

The exact requirements vary by insurer, policy, industry, organization and risk profile. There is no universal checklist that guarantees eligibility, coverage or a particular premium.

A useful way to prepare is to build cybersecurity around a recognized framework and maintain evidence showing that the controls described on an insurance application are actually operating.

The CIS Critical Security Controls provide a practical framework for doing this.

This guide explains how businesses can use CIS Controls Implementation Group 2, or IG2, and Implementation Group 3, or IG3, to strengthen cybersecurity and improve cyber-insurance readiness.

Note: This guide is informational and does not provide insurance or legal advice. Policy language and underwriting requirements control. Businesses should confirm insurance requirements with their broker and carrier and legal requirements with qualified counsel.

Why Cyber Insurance Applications Have Become More Technical

Cyber insurance underwriting is fundamentally about risk.

An insurer needs enough information to understand the likelihood and potential severity of a cyber incident.

Modern applications can therefore ask about specific cybersecurity controls rather than simply asking whether the business "has cybersecurity."

Questions may address:

• Multi-factor authentication
• Privileged administrator accounts
• Endpoint detection and response
• Managed detection and response
• Email security
• Microsoft 365 security
• Vulnerability scanning
• Patch management
• Remote access
• Backups
• Backup isolation
• Recovery testing
• Network segmentation
• Security awareness training
• Incident response planning
• Security logging
• Vendor access
• Penetration testing

The questions differ by carrier.

A business should never assume that implementing one product automatically allows it to answer "yes" to a broad insurance question.

The Most Important Rule: Answer Applications Accurately

Cyber insurance applications should reflect the actual environment.

For example, an organization should be careful about answering:

"Yes, we use MFA."

The real question may be whether MFA protects all remote access, Microsoft 365, administrators, cloud applications, VPN access or other systems.

Similarly:

"Yes, we have backups."

does not explain whether backups are isolated, monitored, encrypted, protected from compromised administrators or periodically restored.

Huff Data Systems recommends maintaining technical evidence that supports important answers provided to an insurer.

Why CIS Controls Are Useful for Cyber Insurance Readiness

The CIS Critical Security Controls v8.1 contain 18 Controls and 153 Safeguards.

CIS organizes the safeguards into three Implementation Groups.

IG1 establishes essential cyber hygiene.

IG2 builds on IG1 for organizations with greater operational complexity, sensitive information and cybersecurity requirements.

IG3 includes all 153 safeguards and is designed for organizations with greater risk, sophisticated threats, highly sensitive information or significant requirements for confidentiality, integrity and availability.

CIS states that Implementation Groups are selected according to factors such as risk profile, resources, organizational complexity and the type of data being protected.

This makes CIS useful for cyber-insurance preparation because it provides a structured way to demonstrate that cybersecurity is a managed program rather than a collection of unrelated products.

CIS IG2 as a Strong Business Cybersecurity Baseline

Many established small and mid-sized businesses may find IG2 relevant because it goes substantially beyond foundational security.

CIS describes IG2 organizations as enterprises that generally have people responsible for managing and protecting IT infrastructure, may have multiple departments with different risk profiles, and may store or process sensitive client or enterprise information.

IG2 builds upon all IG1 safeguards.

Businesses should select their CIS Implementation Group through a risk-based process rather than assuming that company size alone determines the correct level.

When IG3 May Be Appropriate

IG3 is the highest CIS Implementation Group and includes all 153 CIS v8/v8.1 safeguards.

CIS describes IG3 organizations as commonly having security specialists, sensitive information or functions subject to regulatory or compliance oversight, significant availability requirements, and exposure to sophisticated attacks.

IG3 can therefore be appropriate for organizations where a successful cyberattack could create unusually significant operational, financial, regulatory or public consequences.

Examples can include organizations with:

• Highly sensitive information
• Significant regulatory obligations
• Critical operations
• High availability requirements
• Significant intellectual property
• Sophisticated threat exposure
• Software development risk
• Large or complex networks
• Significant third-party dependencies

Not every business needs IG3.

The decision should be based on risk.

Cyber Insurance Control Areas and CIS Alignment

The following sections connect common cyber-insurance underwriting topics with areas addressed by CIS Controls.

They are not a representation of the requirements of every insurance company.

1. Asset Inventory

Insurance Concern

Can the organization identify the systems it is responsible for protecting?

Cis Alignment

Control 1 - Inventory and Control of Enterprise Assets

Business Objective

Maintain an accurate inventory of computers, servers, network devices and other enterprise assets.

Why It Matters

Unknown devices can remain unpatched, unmanaged and unmonitored.

Evidence To Retain

• Current asset inventory
• RMM inventory
• Endpoint management reports
• Device ownership
• Hardware lifecycle information

2. Software Inventory

Insurance Concern

Does the business know what software is installed and whether unsupported applications remain in use?

Cis Alignment

Control 2 - Inventory and Control of Software Assets

Evidence

• Software inventory
• Supported operating-system report
• Application inventory
• Unsupported software remediation records

3. Data Protection

Insurance Concern

What sensitive information does the business possess and how is it protected?

Cis Alignment

Control 3 - Data Protection

Businesses Should Understand

• What sensitive information exists
• Where it is stored
• Who can access it
• How it is transmitted
• How long it is retained
• How it is securely disposed of

Evidence

• Data classification policy
• Encryption settings
• Access-control documentation
• Data-retention policy

4. Secure Configuration

Insurance Concern

Are computers and servers configured using controlled security standards?

Cis Alignment

Control 4 - Secure Configuration of Enterprise Assets and Software

Practical Controls

• Centrally managed security settings
• Removal of unnecessary services
• Secure endpoint baselines
• Firewall configuration
• Disk encryption
• Controlled local administrator access

Evidence

• Configuration policies
• Endpoint management reports
• Security baseline reports
• Configuration compliance reports

5. Account Management

Insurance Concern

Are user accounts actively managed?

Cis Alignment

Control 5 - Account Management

Important Practices

• Promptly disable former employees
• Inventory accounts
• Control administrator accounts
• Review inactive accounts
• Avoid unnecessary shared accounts

Evidence

• Account inventory
• Termination procedure
• Account review records
• Privileged account inventory

6. MFA and Access Control

Insurance Concern

Is multi-factor authentication used and where?

Cis Alignment

Control 6 - Access Control Management

High-Priority Areas Can Include

• Microsoft 365
• VPN
• Remote access
• Administrative accounts
• Cloud applications
• Backup administration
• Remote-management platforms

A business should document MFA coverage instead of simply recording "MFA enabled."

Evidence

• MFA enrollment report
• Conditional Access policies
• VPN authentication configuration
• Administrative access policy
• Privileged role reports

7. Vulnerability and Patch Management

Insurance Concern

How does the organization identify and remediate known vulnerabilities?

Cis Alignment

Control 7 - Continuous Vulnerability Management

A mature process should address:

• Vulnerability scanning
• Patch deployment
• Internet-facing systems
• Emergency vulnerabilities
• Unsupported systems
• Remediation tracking

Evidence

• Vulnerability reports
• Patch reports
• Remediation tickets
• Exception documentation
• External vulnerability scan results

8. Logging and Security Monitoring

Insurance Concern

Can the organization detect and investigate suspicious activity?

Cis Alignment

Control 8 - Audit Log Management Control 13 - Network Monitoring and Defense

Practical Capabilities

• Centralized logging
• Endpoint security telemetry
• Microsoft 365 logs
• Firewall logs
• Identity alerts
• Security investigation
• Retention appropriate to risk

Evidence

• SIEM reports
• MDR reports
• Security incident tickets
• Log-retention configuration
• Alert-response procedures

9. Email and Web Security

Insurance Concern

How does the business reduce phishing and malicious email risk?

Cis Alignment

Control 9 - Email and Web Browser Protections

CIS IG2 includes safeguards such as DNS filtering, browser/extension controls, DMARC and additional email/web protections.

Practical Areas

• Anti-phishing controls
• Domain impersonation protection
• SPF
• DKIM
• DMARC
• DNS filtering
• Malicious attachment protection
• Browser controls

Evidence

• Email security configuration
• DMARC record
• SPF/DKIM validation
• DNS filtering reports
• Phishing reports

10. Endpoint Protection, EDR and MDR

Insurance Concern

Are business endpoints protected from malware and suspicious behavior?

Cis Alignment

Control 10 - Malware Defenses Control 13 - Network Monitoring and Defense

Practical Capabilities

• Centrally managed endpoint security
• Behavior-based protection
• Endpoint detection and response
• Security monitoring
• Alert investigation
• Isolation capability

Evidence

• Endpoint coverage report
• EDR deployment report
• MDR service documentation
• Security incident reports
• Endpoint policy configuration

11. Backup and Ransomware Recovery

Insurance Concern

Can the business recover after ransomware or destructive attack?

Cis Alignment

Control 11 - Data Recovery

CIS includes safeguards addressing:

• A documented recovery process
• Automated backups
• Protection of recovery data
• An isolated instance of recovery data

IG2 and IG3 additionally include testing data recovery.

CIS Safeguard 11.5 calls for testing backup recovery quarterly, or more frequently, for a sampling of in-scope assets.

Evidence

• Backup reports
• Recovery architecture
• Backup access-control records
• Restore-test reports
• Recovery documentation
• RTO/RPO documentation where used

12. Network Architecture and Segmentation

Insurance Concern

Can attackers move freely through the environment after compromising one system?

Cis Alignment

Control 12 - Network Infrastructure Management

IG2 includes establishing and maintaining a secure network architecture that addresses segmentation, least privilege and availability.

Evidence

• Network diagram
• Firewall configuration
• VLAN/segmentation documentation
• Remote-access configuration
• Network device inventory

13. Security Awareness Training

Insurance Concern

Are employees trained to recognize cyber threats?

Cis Alignment

Control 14 - Security Awareness and Skills Training

Training Should Address Topics Relevant To The Organization, Including

• Phishing
• Credential theft
• MFA attacks
• Payment fraud
• Sensitive information
• Incident reporting
• Social engineering

Evidence

• Training completion reports
• Training policy
• Phishing simulation results where used
• Remedial training records

14. Third-Party and Vendor Risk

Insurance Concern

Can a vendor or service provider create access to the organization?

Cis Alignment

Control 15 - Service Provider Management

IG2 contains meaningful additional requirements around service-provider classification, contracts and assessments.

Evidence

• Vendor inventory
• Vendor risk classifications
• Security requirements in contracts
• Vendor assessments
• Vendor access review
• Offboarding records

15. Application Security

Insurance Concern

Organizations that develop software have additional supply-chain and application risk.

Cis Alignment

Control 16 - Application Software Security

IG2 and IG3 introduce significant application-security requirements.

IG3 includes advanced safeguards such as code-level security checks, application penetration testing and threat modeling.

Evidence

• Secure development policy
• Vulnerability tracking
• Software component inventory
• Code scanning reports
• Application penetration tests
• Threat models
• Remediation records

16. Incident Response

Insurance Concern

Does the business know what to do when an attack occurs?

Cis Alignment

Control 17 - Incident Response Management

A Plan Should Address

• Incident leadership
• IT/security response
• Legal counsel
• Cyber insurance
• Evidence preservation
• Communications
• Regulatory review
• Recovery
• Post-incident analysis

Evidence

• Incident-response plan
• Contact list
• Tabletop exercise records
• Incident tickets
• Lessons-learned reports

17. Penetration Testing

Insurance Concern

Has the organization independently tested whether defenses can be bypassed?

Cis Alignment

Control 18 - Penetration Testing

IG2 includes establishing a penetration-testing program, periodic external penetration testing and remediation of findings.

CIS calls for periodic external penetration tests based on program requirements, no less than annually.

IG3 adds validation of security measures following testing and periodic internal penetration testing no less than annually.

Evidence

• Penetration-test report
• Scope
• Remediation plan
• Remediation evidence
• Retest results

IG2 Versus IG3 for Cyber Insurance Readiness

IG2

IG2 can provide a strong target for businesses that have:

• Multiple departments
• Sensitive customer or company information
• Regulatory or contractual cybersecurity requirements
• Significant dependence on technology
• Dedicated IT management
• Meaningful business interruption exposure
• A need for formal cybersecurity processes

IG2 goes beyond foundational cyber hygiene by adding controls for more mature vulnerability management, logging, network security, recovery testing, service providers, application security and penetration testing.

IG3

IG3 includes every CIS v8/v8.1 safeguard.

It may be appropriate when:

• Cybersecurity failure could create severe business consequences
• Highly sensitive information is stored
• The company develops important software
• Sophisticated attackers are a realistic concern
• Internal network compromise could create major consequences
• Regulatory requirements are significant
• Availability is critical
• Customers require advanced security
• The organization has the resources and expertise required to operate advanced controls

A workable cyber insurance readiness model

A practical business approach is:

Level 1 - Establish the Foundation

Implement CIS IG1.

This creates essential cyber hygiene.

Level 2 - Build an Insurable Security Program

Evaluate and implement the applicable IG2 safeguards.

For many established businesses, this is where cybersecurity becomes a more formal operational program rather than a collection of security products.

Level 3 - Add Risk-Driven IG3 Safeguards

Determine whether specific IG3 safeguards are appropriate because of:

• Business risk
• Customer requirements
• Regulation
• Data sensitivity
• Software development
• Threat exposure
• Insurance requirements
• Operational criticality

A company does not become more secure merely by claiming "IG3."

Controls must actually be implemented, operated, tested and documented.

Cyber Insurance Evidence Package

Huff Data Systems recommends maintaining a cybersecurity evidence package that can be updated throughout the year.

It can include:

Organization and Governance

• Cybersecurity policy
• Risk assessment
• CIS assessment
• Incident-response plan
• Business continuity plan

Assets

• Hardware inventory
• Software inventory
• Cloud application inventory

Identity

• MFA report
• Administrator inventory
• Conditional Access policies
• Account review
• Offboarding procedure

Endpoint Security

• EDR coverage
• Security policy
• Encryption status
• Patch compliance

Network

• Network diagram
• Firewall inventory
• Segmentation documentation
• Remote-access configuration

Vulnerability Management

• Vulnerability scan
• Remediation report
• External exposure review

Email

• Email security configuration
• SPF
• DKIM
• DMARC
• DNS filtering

Backup

• Backup coverage
• Backup architecture
• Isolation controls
• Restore test results

Detection and Response

• MDR/SIEM documentation
• Incident records
• Alert-response process

Training

• Security-awareness completion
• Phishing testing where applicable

Vendor Management

• Vendor inventory
• Vendor assessments
• Security contract requirements

Testing

• Penetration-test report
• Remediation evidence
• Tabletop exercise results

Questions Executives Should Ask Before Signing a Cyber Insurance Application

1. Who technically verified the answers?

1. Does "MFA" apply everywhere the application expects it?

1. Are all endpoints actually covered by EDR?

1. Are servers included?

1. Are remote users included?

1. Are privileged accounts protected differently?

1. Are backups isolated from production credentials?

1. When was the last successful restore test?

1. When was the last vulnerability scan?

1. When was the last external penetration test?

1. Do we have unsupported operating systems?

1. Is Microsoft 365 configured according to our security standard?

1. Do we have a current incident-response plan?

1. Have we tested the incident-response plan?

1. Are third-party vendors with administrative access documented?

1. Can we produce evidence supporting our answers?

What Not to Do

Do Not Treat the Application as a Sales Questionnaire

Insurance answers can have contractual significance.

Technical questions should be verified.

Do Not Assume a Product Equals a Control

Purchasing EDR does not prove that every endpoint is protected.

Purchasing a backup product does not prove that recovery works.

Enabling MFA for some users does not prove that every required system is protected.

Do Not Wait Until Renewal

Cybersecurity evidence should be maintained continuously.

Trying to reconstruct a year's worth of evidence immediately before renewal is inefficient and increases the chance of inaccurate answers.

Do Not Assume CIS Compliance Guarantees Insurance

CIS alignment does not guarantee:

• Policy issuance
• A lower premium
• Claim payment
• Regulatory compliance
• Prevention of a cyberattack

Insurance decisions are controlled by the insurer and policy.

CIS provides a structured cybersecurity framework that can help businesses improve risk management and demonstrate cybersecurity maturity.

Cyber Insurance and Business Continuity

Insurance is one part of resilience.

A mature organization should combine:

Cybersecurity

Reduce the probability and impact of an attack.

Business Continuity

Maintain critical operations during disruption.

Disaster Recovery

Restore systems and data.

Incident Response

Contain and investigate attacks.

Cyber Insurance

Transfer defined financial risks according to policy terms.

These functions should support each other.

Common questions

Does cyber insurance require CIS IG2?

There is no universal requirement that every cyber insurer requires CIS IG2. Requirements vary by insurer and policy.

IG2 can provide a strong framework for organizing the controls insurers commonly evaluate.

Does CIS IG3 guarantee cyber insurance approval?

No.

IG3 represents the complete set of CIS Controls v8/v8.1 safeguards, but insurance underwriting remains specific to the insurer, organization and policy.

Is MFA required for cyber insurance?

Many insurers evaluate MFA, particularly for remote access, cloud services and privileged access, but exact requirements vary.

The organization should obtain requirements directly from its insurer or broker.

Are backups enough for ransomware coverage?

Backups are only one component of ransomware resilience.

Insurers may evaluate additional controls such as MFA, endpoint protection, vulnerability management, remote access, email security and incident response.

Should backup recovery be tested?

Yes.

CIS Safeguard 11.5, applicable to IG2 and IG3, calls for quarterly backup recovery testing, or more frequently, for a sampling of in-scope assets.

Does IG2 require penetration testing?

CIS v8.1 Safeguards 18.1, 18.2 and 18.3 are applicable to IG2 and IG3.

This includes establishing a penetration-testing program, performing periodic external penetration tests no less than annually according to program requirements, and remediating findings.

What additional penetration testing does IG3 add?

IG3 adds Safeguard 18.4, validation of security measures after penetration testing, and Safeguard 18.5, periodic internal penetration testing no less than annually.

Where Huff Data fits

Huff Data Systems can help businesses prepare the technical side of cyber-insurance readiness by:

• Assessing cybersecurity controls
• Mapping controls against CIS IG2 and IG3
• Identifying gaps
• Implementing technical safeguards
• Reviewing Microsoft 365 security
• Managing endpoint security
• Improving identity security
• Reviewing backup and recovery
• Testing restoration
• Improving vulnerability management
• Coordinating penetration testing
• Developing incident-response processes
• Maintaining technical evidence
• Providing factual technical information for insurance questionnaires

Insurance interpretation and coverage decisions should remain with the business's insurance broker, carrier and qualified legal counsel.

Build Cyber Insurance Readiness Before Renewal

The best time to discover a cybersecurity requirement is not the day an insurance application is due.

Businesses can use CIS IG2 and IG3 to create a measurable cybersecurity roadmap and maintain evidence throughout the year.

Huff Data Systems can help evaluate the current environment and create a prioritized plan based on business risk.

Victoria: 361-570-7240 Houston: 713-493-2051

Related Huff Data Content

• Cybersecurity Services
• CIS Controls Business Guide
• Business Cybersecurity Assessment Guide
• Ransomware Readiness Guide
• Business Continuity and Disaster Recovery
• Microsoft 365 Security Guide
• Texas Cybersecurity Compliance Guide