Cyber insurance requirements for small business in Ontario have gotten stricter, and most applications now read less like a form and more like a security audit. If your business has renewed a policy recently and the questionnaire suddenly got longer, you are not imagining it. Insurers tightened their applications after a wave of ransomware claims, and a growing number of small Toronto businesses are getting quoted higher premiums, or turned down outright, because of a handful of missing controls that would take a few weeks to fix. A cybersecurity readiness assessment is usually the fastest way to find out where those gaps are before an underwriter does.
This is not a legal or insurance opinion, and requirements vary between insurers and policies. It is a plain-language look at the controls that keep coming up on Canadian small business applications, based on what brokers and IT providers see repeatedly, so you know what to check before you sit down with your broker.
Why insurers started asking so many questions
Five years ago, a cyber insurance application for a small business was often a single page. Now it can run several pages, sometimes with a call from an underwriter afterward. The shift tracks a simple pattern: insurers pay out on ransomware and business email compromise claims more than almost anything else in this category, and a small number of missing controls, no multi-factor authentication, backups sitting on the same network as everything else, show up in claim after claim.
The Canadian Centre for Cyber Security’s baseline controls for small and medium organizations line up closely with what insurers ask about, which is not a coincidence. Underwriters are increasingly pricing policies around whether a business already follows something close to that baseline, rather than treating every applicant the same.
None of this means coverage is impossible to get. It means the businesses getting better terms tend to be the ones who can answer the application’s questions with specifics instead of guesses. That is worth fixing before renewal, not after a claim gets questioned.
People often ask: does having antivirus software count as endpoint protection?
Not on most current applications. Traditional antivirus matches known threats against a signature list, which misses newer attack methods. Insurers increasingly ask specifically about endpoint detection and response (EDR), a different category of tool that watches for suspicious behaviour rather than only known malware.
The 9 things insurers ask about most often
These nine controls show up, in some form, on most small business cyber insurance applications in Canada. Not every insurer asks about all nine, and some ask about more, but this is the core list worth checking before you renew.
1. Multi-factor authentication on email and remote access
This is the single most common question on modern applications. Insurers want MFA turned on for email, VPN access, and remote administrative logins, not just for a handful of accounts. Partial rollouts are one of the most common reasons an application gets flagged for follow-up questions.
2. Backups that are tested and kept offline or immutable
A backup sitting on the same network as everything else can be encrypted in the same attack that takes down the rest of your systems. Applications increasingly ask whether backups are separated from the main network and whether a restore has actually been tested, not just whether backups run.
3. Endpoint protection beyond basic antivirus
Traditional antivirus catches known threats. Endpoint detection and response (EDR) watches for unusual behaviour on a device, which is what catches attacks that have not been seen before. Several insurers now ask which category of tool is actually installed.
4. A written incident response plan
It does not need to be long. A page naming who gets called first, who can make the call to shut systems down, and how staff report something suspicious answers most of what an application asks for here.
5. A regular patching and update schedule
Unpatched software remains one of the most common ways attackers get a foothold. Applications often ask how frequently systems are updated and whether that is handled on a schedule or only when something breaks.
6. Employee phishing awareness training
A large share of claims start with a clicked link or a convincing fake invoice. Insurers commonly ask whether staff receive any regular training on recognizing phishing attempts, even something as simple as periodic reminders and a known process for reporting a suspicious email.
Pro tip
Ask your IT provider for a written, dated summary of your current controls before you start an insurance application. Most applications ask for specifics, like exact MFA coverage or the age of your last successful backup test, that are hard to answer accurately from memory alone.
7. Controls on admin and privileged accounts
Applications often ask how many people hold administrator-level access and whether that list is reviewed periodically. A former employee’s account still holding admin rights is a common and avoidable finding.
8. Email authentication records (SPF, DKIM, DMARC)
These records make it harder for an attacker to send email that appears to come from your own domain, a common setup for business email compromise and invoice fraud. Some applications ask about this directly; others infer it during underwriting.
9. A current inventory of devices and software
Knowing what is actually connected to the network and what software is running on it is a basic starting point for most of the questions above. It is hard to answer questions about patching or endpoint protection accurately without one.
Save your money
Businesses that already have MFA and a tested backup routine in place are often quoted more favourably, since those two controls alone block a large share of the claims insurers pay out on. Fixing them before you apply can be worth more than shopping around for a lower quote on the same gaps.
Good to know: This article is general information, not insurance or legal advice. Exact requirements, pricing, and eligibility vary by insurer, broker, and policy, and they change over time. Confirm the specific requirements that apply to your business with your insurance broker or insurer before you buy or renew a policy. ITBizTek is not responsible for decisions made solely on the basis of this article.
How to score your own readiness
This is a rough self-check, not an insurance quote and not a guarantee of coverage or pricing. Check the boxes that already describe your business, then see where that puts you.
Cyber insurance readiness self-check
Download the free readiness checklist
Save the nine-point checklist as a PDF and use it before your next application or renewal call.
What happens if you do not meet the requirements
Falling short on a few of these controls does not automatically mean an application gets rejected. In practice it more often means one of three things: a higher premium, a narrower policy with some exclusions, or a request to fix specific gaps within a set window before coverage starts. The costliest outcome is usually the one nobody plans for, a claim getting reviewed after an incident and the insurer finding the application answers did not match reality. That is a conversation worth avoiding, and it starts with an honest inventory of where things actually stand rather than where you assume they stand.
If a breach does happen, Canadian businesses also have separate reporting obligations to be aware of under privacy law, outlined by the Office of the Privacy Commissioner of Canada, alongside whatever your insurance policy requires. The two are not the same process, and it helps to know both before you need either.
The Government of Canada’s Get Cyber Safe program and the Insurance Bureau of Canada both publish general background on how cyber coverage works in the Canadian market, worth a read before your renewal conversation.
Frequently asked questions
Does cyber insurance cover ransomware payments?
Some policies include coverage for ransom payments and negotiation costs, while others exclude or cap it, and a few jurisdictions have started restricting this kind of coverage. It depends entirely on the specific policy wording, which is exactly the kind of detail worth asking your broker to walk through line by line rather than assuming it works the same way across every insurer. The controls in this article tend to matter either way, since insurers price and structure ransomware coverage around the same baseline security questions.
How much does cyber insurance cost for a small business in Ontario?
Pricing varies widely based on industry, revenue, the amount of sensitive data handled, claims history, and how many of the controls above are already in place, so there is no single figure that applies broadly. Businesses that can demonstrate MFA, tested backups, and a written incident response plan tend to see more competitive quotes than businesses applying with none of those in place. A broker who works with Ontario small businesses can give a realistic range once they know your specific setup.
Can I get cyber insurance without an IT provider?
It is possible, but harder to prove the technical answers on the application without someone who manages your systems day to day. Many of the questions, MFA coverage, backup configuration, patch cadence, are specific enough that guessing risks an inaccurate application, which can matter more at claim time than at application time. Working with an IT provider, even briefly, to document current controls before applying tends to produce a more accurate and often more favourable application.
ITBizTek works with businesses across Vaughan, Markham, Mississauga, and Richmond Hill to document and close the exact gaps insurers ask about, before renewal season makes it urgent.
Quick recap: MFA, tested offline backups, real endpoint protection, a written response plan, and a patching schedule cover most of what a Canadian cyber insurance application asks for. Get those five in order first. A cybersecurity assessment can confirm where you actually stand before your broker asks.
