Cyber Insurance Requirements in Canada: What Insurers Check in 2026

Canadian cyber insurers expect five controls before they quote: multi-factor authentication (MFA) on remote access and email, tested backups, phishing training, endpoint detection and response (EDR) and regular vulnerability testing. Larger companies are also asked about penetration testing, an incident response plan and, increasingly, SOC 2 or ISO 27001. Every one of those controls already appears in SOC 2 and ISO 27001, so a company that builds the controls once can use the same evidence for the insurer and the auditor.

Why did Canadian cyber insurers start requiring security controls?

Canadian cyber insurers started requiring security controls after losses far exceeded premiums in 2020 and 2021. The cyber loss ratio for Canada's P&C industry, including Lloyd's, was 371.4% in 2020 and 115.4% in 2021, according to MSA Research data reported by Canadian Underwriter. A 371% loss ratio means insurers paid out about $3.70 in claims for every dollar of premium collected.

Before 2020, many cyber policies were written on revenue and industry alone, with few questions about security controls. Ransomware claims during the shift to remote work changed underwriting. Insurers raised premiums, some left the market, and the controls that used to be nice to have became conditions of a quote.

The market has since recovered. The Insurance Bureau of Canada reports the market is continuing to stabilize, thanks in part to stronger underwriting practices. Prices have come down and capacity has returned. The control requirements stayed.

What security controls do cyber insurers require before quoting?

Cyber insurers in Canada require a short list of baseline controls before quoting, and the list grows with company size and industry risk. The list below combines what Canadian brokers describe on applications with requirements published by carriers such as Coalition.

Multi-factor authentication on remote access and email

MFA is the control insurers ask about first and check most carefully. Application questions usually ask about MFA on email, remote access (VPN, remote desktop), privileged and administrator accounts, and cloud consoles. An honest answer needs coverage numbers: which systems enforce MFA, which accounts are exempt, and why. Phishing-resistant methods such as passkeys and FIDO2 keys are becoming the expected standard for administrators. The Entra ID phishing-resistant MFA guide covers the setup in Microsoft 365.

Tested, segregated backups

Insurers ask whether backups exist, whether a copy is offline or immutable, and when a restore was last tested. A backup that shares credentials with production fails the question, because ransomware operators delete reachable backups first. The test record is the evidence: the date, what was restored, and how long the restore took. The ISO 27001 A.8.13 backup guide sets out what a defensible backup control includes.

Phishing awareness training

Training is a standard application question and one of the cheapest requirements to meet. Insurers look for regular training plus phishing simulations, with completion records. The Government of Canada Get Cyber Safe guidance, written with IBC, calls regular staff training a critical component in reducing risk.

Endpoint detection and response

EDR moved from a large-company control to a common requirement for mid-size firms. Underwriters ask what percentage of endpoints and servers run EDR and whether alerts are monitored around the clock. The difference between owning EDR and having alerts reviewed is covered in the EDR vs MDR breakdown.

Vulnerability management and penetration testing

Insurers ask how fast critical patches are applied and, for larger companies, when the last penetration test took place. A patching SLA written down and met is stronger evidence than a statement that we patch regularly. The SOC 2 CC7.1 vulnerability management guide covers scanning cadence and remediation timelines.

Incident response plan

Insurers want to see an incident response plan because a company with one calls the breach hotline early and preserves evidence. Many Canadian cyber insurers and managing general agents (MGAs) run in-house incident response teams that triage a reported incident before bringing in panel forensics firms, breach counsel and PR support. A plan that names the insurer's hotline as the first call gets the most value from that service. The incident response plan template includes the contact list and escalation steps.

What do cyber insurers scan before binding a policy?

Most cyber insurers run an outside-in scan of a company's public domains during quoting and renewal. Scanning platforms such as BitSight and Coalition's own tools look for open RDP ports, unpatched internet-facing software and known CVEs. Findings from the scan can hold up the quote until the issues are fixed.

A company can run the same checks first:

• Open remote access: confirm RDP and SSH are closed to the internet or behind a VPN with MFA
• Exposed software versions: check VPN appliances, firewalls and web servers against current patch levels
• Email authentication: SPF, DKIM and DMARC records, checked with the free SPF checker
• Web configuration: HTTP security headers, checked with the free security headers checker

Fixing scan findings before the broker submits the application keeps the first quote clean.

Can a cyber insurer deny a claim over MFA?

A cyber insurer can deny a claim when the controls described on the application were missing at the time of the attack. In February 2024, a ransomware attack disabled about 80% of the City of Hamilton's network. Global News reported that the claim was denied because multi-factor authentication had not been fully implemented at the time of the attack, and that the policy provided no coverage for losses where the absence of MFA was the root cause. The city has spent $18.3 million on recovery. CP24 reported that a third-party review found the denial aligned with the policy.

Claim denials over a missed procedure are rare. The larger risk is an application answer that overstates coverage. MFA is enabled and MFA is enforced on every account with remote access are different statements, and the underwriter relies on the exact wording. An accurate answer with a documented exception is safer than a yes that turns out to be partial.

How do cyber insurance requirements map to SOC 2 and ISO 27001?

Every control on a typical cyber insurance application maps to an existing SOC 2 criterion and ISO 27001:2022 Annex A control. The evidence an auditor collects is the evidence a broker needs for the application.

Cyber insurance requirements mapped to SOC 2 and ISO 27001:

Payment verification for cyber crime coverage (dual authorization and call-back on banking changes) is usually a finance procedure outside the SOC 2 or ISO 27001 scope. Insurers still ask about payment verification, so the procedure needs to be written down.

A company with a current SOC 2 report or ISO 27001 certificate can answer most of the application from audit evidence. A company with neither can use the insurer's list as the first stage of a compliance program, because the same controls carry forward into the audit.

Does SOC 2 or ISO 27001 lower cyber insurance premiums?

SOC 2 or ISO 27001 evidence lowers cyber insurance premiums, improves terms, or makes coverage available to a company that would otherwise be declined. A Canadian broker described the effect to us in three outcomes: lower premiums, lower rates, or coverage that becomes attainable in the first place. Weak controls lead to higher retentions, sublimits on ransomware, or a declined application.

Underwriters price risk from the application answers and the external scan. With an independent audit report, the underwriter can trust that the answers are accurate. The SOC 2 and ISO 27001 premium guide breaks down how underwriters use audit evidence.

Which privacy laws affect cyber insurance in Canada?

Canadian privacy law sets many of the costs a cyber policy pays for after a breach. First-party breach response coverage pays for forensics, breach counsel and notification costs. Notification is required under PIPEDA when a breach creates a real risk of significant harm, and under Quebec's Law 25 for confidentiality incidents involving Quebec residents. A company that already knows which personal information is held, and where, can give the insurer accurate answers about data volumes and can respond faster when the policy is used.

What does a cyber insurance policy cover?

A standalone cyber insurance policy in Canada usually covers three areas:

• First-party coverage: breach response costs (forensics, legal counsel, notification), business interruption and extra expense, and data restoration. Some policies extend business interruption to outages at IT and non-IT vendors.
• Third-party liability: defence costs and damages when clients or the public sue over a privacy breach or transmitted malware.
• Cyber crime: reimbursement for direct financial loss from funds transfer fraud and social engineering.

Brokers report that most claims fall under first-party coverage and cyber crime.

How should a company prepare for a cyber insurance application or renewal?

Preparation for a cyber insurance application starts 60 to 90 days before the renewal date. The steps below give the broker an accurate application and the underwriter a clean scan:

1. Request the application form early. Each carrier asks slightly different questions, and the broker can share the form before submission.
2. Measure MFA coverage. Export enforcement status from the identity provider and list every exception with a reason.
3. Run a restore test. Record the date, the system restored and the time taken.
4. Check the outside view. Scan public domains for open RDP, exposed software versions, and email and header issues.
5. Confirm EDR and training coverage. Pull coverage percentages from the EDR console and completion rates from the training platform.
6. Answer with evidence. Match every yes on the application to a document, export or screenshot.
7. Choose one broker before applying. Carriers work with the first broker who submits a company's application, so shopping the same application through several brokers can block access to a market.

Where does Truvo fit in a cyber insurance application?

Truvo is a cybersecurity and compliance firm, not an insurance broker. Truvo assesses the controls insurers ask about, closes the gaps, and prepares the evidence so the application is accurate. Clients buy coverage through a trusted broker of their choice, and the same controls and evidence carry into SOC 2 or ISO 27001 when the company is ready. The Truvo readiness assessment covers the controls insurers ask about alongside SOC 2 and ISO 27001.

Frequently Asked Questions

Is cyber insurance mandatory in Canada?

Canadian law does not require businesses to carry cyber insurance. Customer contracts, lenders and government buyers often require a minimum amount of cyber liability coverage, so many companies buy a policy to meet contract terms.

What is the most important cyber insurance requirement?

Multi-factor authentication is the requirement Canadian cyber insurers check first and most carefully. Applications ask about MFA on email, remote access, administrator accounts and cloud consoles, and missing MFA is a common reason for exclusions and denied claims.

Does cyber insurance cover ransomware attacks?

Standalone cyber policies in Canada usually cover ransomware response costs, business interruption and data restoration. Some insurers apply sublimits or coinsurance to ransomware claims, and a policy can exclude losses where a required control such as MFA was missing.

How early should a company prepare for a cyber insurance renewal?

Preparation for a cyber insurance renewal should start 60 to 90 days before the renewal date. The time allows the company to measure MFA coverage, run a restore test, fix external scan findings and collect evidence for each application answer.

Do contract workers count as employees under a cyber insurance policy?

Many cyber policies define employees to include temporary contract workers whose work the company directs and controls. Independent contractors and subcontractors are usually treated separately, so the broker should confirm how a specific policy defines both groups.