Cyber Insurance Requirements That Affect DR Planning
Insurers now verify your backups and recovery plans before issuing coverage.
Cyber insurance used to run on the honor system: fill out a questionnaire, answer yes or no to a dozen security questions, and a policy showed up in the mail. That model is dead. Insurers now treat renewal like an audit, pulling outside-in scans of an organization's environment, asking for screenshots of security configurations, and cross-checking claims against what third-party tools can actually observe from outside the network. Leading carriers have signaled that the old questionnaires ask the wrong questions and produce answers that go stale almost immediately. What insurers demand now, tested backups, documented recovery targets, incident response plans that have actually been run through a tabletop exercise, has become the real blueprint for disaster recovery planning in 2026. Anyone still treating DR as an internal IT decision, separate from the insurance conversation, is already behind.
What is driving premiums up
Premiums are forecast to climb 15 to 20 percent in 2026, and the reason isn't abstract. Catastrophic losses are back, and ransomware is the engine behind them. Global ransomware losses are projected to hit $265 billion annually by 2031, and the average cost of a single ransomware incident in 2024 already topped $5.13 million, figures that move actuarial tables. Those are the kinds of numbers that move actuarial tables.
The more revealing figure, though, is the denial rate. More than 40 percent of all cyber insurance claims get denied, and 82 percent of those denials trace back to one cause: no multi-factor authentication on critical systems. That statistic alone should reframe how anyone reads a premium increase. Carriers aren't just raising prices across the board and hoping that covers the risk. They're refusing to pay when the basics weren't in place, so the rising cost of coverage is really about insurers finally pricing in how many claimants were never actually insurable to begin with. It's about insurers finally pricing in how many claimants were never actually insurable to begin with. An organization can carry a policy for years, pay every premium on time, and still discover at the moment of loss that it was never really covered. Being functionally uninsured, despite holding a policy number and a certificate on file, is now an operational risk, not a theoretical one.
Why backup and recovery infrastructure is the most scrutinized DR control in underwriting
An organization that can restore from a clean, recent backup doesn't need to pay a ransom. That single fact reshapes the entire risk calculation for an insurer, and it's why backup and recovery draws more underwriting scrutiny than almost anything else on the application.
The trouble is that the answers organizations give about their own backups are unreliable, and not by a small margin. A study across more than 10,000 policies found that answers about backups were incorrect or incomplete 90 percent of the time. The answers given about backups were incorrect or incomplete 90 percent of the time, nearly every applicant. That's nearly every applicant. Some carriers have stopped asking about backups on the application at all, because the responses were too unreliable to underwrite against, which tells you something about how bad the gap between claimed and actual capability had gotten.
One insurer described what happens when that gap appears in a real incident: the worst manufacturing claim of his career involved a company that reported having working backups, didn't have them, and took 48 days to recover from an incident that should have taken 48 hours. Forty-eight days versus forty-eight hours is a different category of business event. It's a different category of business event, and that gap is what turns a manageable incident into one that threatens the company's survival.
Attackers know this too, and they act on it methodically. In 72 percent of ransomware incidents, the attacker specifically targets backup infrastructure before deploying the encryption payload, because a working backup is the one thing that neutralizes their leverage. That makes immutable storage, meaning backups that cannot be altered or deleted even by someone holding administrative credentials, non-negotiable rather than a nice-to-have. Without it, true recovery from a ransomware event is effectively impossible.
How RTO and RPO targets became underwriting criteria
RTO, recovery time objective, is the acceptable window of downtime. RPO, recovery point objective, is the acceptable window of data loss. Shorter numbers on both signal to an insurer that a company can get back on its feet fast and without losing much in the process, and insurers now ask for these figures directly rather than assuming they exist on some internal runbook.
RPO on paper and RPO in practice often diverge, and the divergence follows a consistent pattern. If an attacker has been sitting in the network for weeks before detonating ransomware, the most recent backup, the one that would normally give the best (lowest) RPO, may already contain encrypted files or dormant malware. Restoring from it just re-infects a clean environment, forcing a revert to an older backup instead. It just re-infects a clean environment, which forces a revert to an older backup instead. The real, effective data loss ends up far higher than the RPO on paper ever suggested. Closing that gap takes immutable storage paired with malware detection capable of scanning backups before they're trusted, not after the restore is already underway.
Downtime costs average $5,600 per minute, which makes the financial stakes concrete rather than abstract. An RTO that's never been documented, or worse, documented but never tested against a real restore, sits on the balance sheet as an unpriced financial exposure that nobody has actually measured.
Regulation is starting to formalize what insurers already expect informally. DORA requires financial entities in its jurisdiction to define RTO and RPO for each critical function, though it stops short of mandating specific numeric targets. In practice, sector-specific requirements for core banking systems frequently set RTOs under 4 hours and RPOs under 1 hour, while healthcare organizations typically face RTOs under 2 hours and RPOs under 15 minutes. Insurers underwriting in these sectors are, in effect, underwriting against the regulatory baseline as much as against the policy itself. An organization out of step with its sector's regulatory expectations is unlikely to find a sympathetic underwriter either.
What a tested incident response plan looks like to an insurer
Carriers now expect a formal incident response plan, one that's documented, stored securely, and tested at least once a year. That baseline sounds modest until you look at what "documented" actually has to include to satisfy an underwriter.
A qualifying plan spells out defined roles and responsibilities, so everyone knows who's accountable for which decision during the first chaotic hours of an incident. It lays out communication protocols, both the internal escalation chain and the external notification procedures for customers, regulators, and partners. It maps the legal and regulatory notification processes, including the specific breach notification timelines a company is bound to. It names the forensic and legal resources the organization would actually engage, with specifics rather than a vague reference to "outside counsel." And it shows evidence the plan has actually been tested.
That testing bar keeps climbing. Some carriers now require tabletop exercises as a condition of renewal, walking through a simulated incident with the actual people who'd be responsible during a genuine one. Others offer premium discounts to organizations that can show a tested plan on file. Testing has stopped being optional. It's a line item in the pricing model now, the same as a credit score is a line item in a mortgage rate.
The core distinction insurers now draw is between documentation and demonstrated capability. A binder on a shelf and a rehearsed response are not the same thing, and insurers have started pricing them accordingly.
Zero trust, network segmentation, and MDR: how the 2026 baseline moved past MFA
MFA is still required, but the question insurers ask about it has changed shape. "We have MFA" doesn't satisfy anyone anymore. Carriers want evidence it's enforced across every account, with particular scrutiny on VPN access, remote desktop, and administrative credentials. VPN access without MFA attached to it is now a specific, named underwriting flag that can sink an application on its own, no matter how strong the rest of the environment looks.
The frontier past MFA is zero trust. Carriers have started folding zero trust principles directly into underwriting conversations, and the questions aren't rhetorical: does the organization actually operate on least-privilege access as a default, continuous verification rather than a one-time login check, and conditional access policies that adjust based on context rather than granting a session and walking away from it.
Network segmentation is where this gets examined concretely, and being specific about what "examined" means in practice, insurers look at whether IT and OT networks are kept separate, whether backup infrastructure sits isolated from the production environment it protects (which loops directly back to why backups survive... Insurers look at whether IT and OT networks are kept separate, whether backup infrastructure sits isolated from the production environment it protects (which loops directly back to why backups survive an attack or don't), whether privileged access workstations are segmented from general-use machines, and whether there are real network-level access controls enforced between segments rather than a flat network with a firewall sitting at the edge and nothing else behind it.
Monitoring has undergone a parallel shift, from EDR to MDR, and the shift tracks how fast attacks now move. A few years back, an organization might have had weeks to notice and respond to an intrusion before it escalated. Now the window is measured in hours, sometimes minutes. Insurers have moved past requiring endpoint detection and response tools that simply generate alerts, toward requiring managed detection and response with actual 24/7 coverage behind it. A tool that pings someone at their desk during business hours isn't sufficient, because attackers deliberately don't wait for business hours.
Vendor risk, policy exclusions, and the DR exposures most organizations haven't planned for
Third-party incidents are a structural concern. They're a structural one, and treating them as an afterthought is the mistake most organizations are still making. Supply chain and third-party failures now drive over 30 percent of all data breaches. An organization can lock down every control on its own network and still get taken down through a contractor's compromised credentials or a software dependency nobody was tracking.
Insurers now expect a documented assessment of every vendor and contractor that touches internal systems or handles sensitive data, along with evidence those vendors meet specific benchmarks: defined encryption standards and agreed incident disclosure timelines, details that used to live in a vague contract clause and now need to be demonstrable on demand. Leading organizations in 2026 are turning to Software Bills of Materials and real-time telemetry from partners to track software dependencies as they change, and insurers are watching that shift closely as it becomes more common across sectors.
Large enterprises are increasingly requiring their own vendors to carry minimum levels of cyber insurance as a condition of doing business. That pushes the requirement down into smaller companies faster than any regulator could mandate it, creating a contractual current running through the market that moves quicker than policy ever could. A regulation takes years to pass. A contract clause takes effect on the next renewal.
The exclusions written into 2026 policies deserve just as much attention as the coverage itself, because they aren't fine print. They're material gaps, and most buyers still read past them. Voluntary ransom payments made without carrier approval are excluded. Repeat attacks within a short window following a prior incident may be excluded. Nation-state attacks fall under war exclusions that are being interpreted more broadly than they used to be. And most policies now carry a separate, lower sub-limit specifically for ransomware, sitting below the headline policy limit that gets quoted in the sales conversation and rarely gets read against the fine print underneath it.
The complete 2026 DR control baseline, assembled from what insurers consistently require
None of what follows is new at this point. Each item has already been argued for in the sections above. What changes here is the framing: this is the baseline, drawn from what insurers and industry sources consistently identify as required, assembled into one working list.
MFA enforced across every account, VPN, remote access, email, administrative, with documented evidence of deployment rather than a self-attestation. Managed detection and response running 24/7, backed by documented response procedures rather than an alert feed alone. Immutable, encrypted backups, tested regularly, isolated from the primary environment, with restore test records on file to prove the tests actually happened rather than just scheduled. Documented RTO and RPO targets, validated against real restore tests rather than estimated on a whiteboard. A documented, tested incident response plan, exercised within the last 12 months, with tabletop records where a carrier requires them.
Patch and vulnerability management running on a formal schedule, with defined remediation timelines and documented compliance against them. Vendor and supply chain risk assessments, covering every third party with system access, not just the largest ones. Security awareness training that includes phishing simulation and tracks employee participation on paper. Network segmentation built around zero trust principles: least-privilege access, separate administrative accounts, isolated backup infrastructure. Centralized logging with a defined retention period long enough to reconstruct an incident after the fact, not just to satisfy a checkbox.
The thread running through every one of these is proof. A control an organization can't document is, from a carrier's point of view, a control that doesn't exist, no matter how well it actually performs day to day. That's the real shift in 2026: insurers stopped taking the word for it.
