If you run a 20–100 employee accounting firm in Los Angeles, cyber insurance is no longer “fill out a form and get a policy.” Most carriers now treat renewal like a security verification. You need to show controls are in place (not just promised). A practical baseline is to meet 5 core control areas:
- MFA
- employee cybersecurity training
- strong backups + recovery testing
- identity/access management
- and data classification
These are commonly referenced as essential underwriting expectations.
If you want a simple target to aim for quickly:
- MFA coverage goal: 100% of email, remote access, and privileged/admin access
- Patching benchmark: critical/high patches within 30 days or less (often faster for severe issues)
- Backup resilience: offsite + offline/immutable copy + documented recovery testing (monthly is best for critical systems; quarterly is a common baseline)
This article provides a checklist you can use to:
- qualify for coverage
- avoid renewal surprises
- reduce the exact risks insurers and CPA partners care about:
- email compromise (BEC)
- ransomware
- deadline downtime
Why Accounting Firms Get Scrutinized (Even If You’re “Not a Big Target”)
Accounting firms are high-value targets because:
- You store tax data, payroll info, bank details, and identity data
- You exchange sensitive documents with clients (often over email or portals)
- You operate under deadlines. Attackers know downtime pressure increases ransom leverage
Underwriters don’t want “we’re careful” as an answer. They want proof your firm can prevent and recover from the most common loss scenarios, especially ransomware and account takeover.
The 5-Control Cyber Insurance Readiness Stack (Simple Framework)
This is the framework to compare your current posture against what insurers commonly expect.
- Multi-Factor Authentication (MFA)
What insurers want: MFA broadly deployed especially email, remote access, and privileged users. Coalition, a cyber insurance carrier, lists MFA as a core requirement area for coverage qualification.
A common underwriting benchmark states MFA 100% for remote access and privileged accounts, with a minimum expectation of MFA for email access.
Buyer checklist
- MFA enabled for all Microsoft 365 / email users
- MFA for all admin accounts (no exceptions)
- MFA for remote access (VPN/remote tools)
Common failure mode: “We have MFA for some users” is treated as “MFA is not implemented.”
- Employee Cybersecurity Training (Anti-Phishing + BEC Prevention)
Coalition lists cybersecurity training as a core coverage requirement area.
Why insurers care: many real-world breaches start with user action (credential theft, phishing, impersonation).
Buyer checklist
- Ongoing phishing training (not once per year)
- A clear process for reporting suspicious emails
- External email warnings (tagging) is commonly recommended in underwriting guidance
Common failure mode: training exists but is undocumented (no records to show the carrier).
- Backups That Survive Ransomware + Tested Recovery
Coalition emphasizes offsite and separate-from-network backups, and specifically calls out the importance of testing backups via full recovery because many firms discover restore failures only when it’s too late.
Acronis and SentinelOne summarizes underwriting expectations that often include 3-2-1 (or stricter 3-2-1-1), immutable/offline copies, and documented recovery testing.
A separate underwriting bulletin also lists backups that are tested and stored separately/segregated from the primary network.
Buyer checklist
- At least one backup copy that’s offline or immutable
- Backups stored separately from your primary network
- Documented restore tests (monthly for critical systems is best; quarterly is a common baseline)
Common failure mode: “We back up to a drive on the same network” (ransomware can reach it).
- Identity & Access Management (Least Privilege)
Coalition lists identity/access management as a core cyber insurance requirement area and describes enforcing least privilege (“users only have enough rights to do their job”).
Buyer checklist
- Remove local admin rights for most users
- Separate admin accounts from daily-use accounts
- Tighten access to finance/banking workflows (wire/ACH changes)
Common failure mode: too many users have admin rights because “it’s easier.”
- Patch Management (Because underwriters check this)
Underwriting guidance commonly references patch timelines, including critical/high severity patching within 30 days or fewer (often sooner for critical issues).
Buyer checklist
- Monthly patch cycle with reporting
- Faster patching for critical issues
- Visibility into “end-of-life” software risks (underwriters ask)
Common failure mode: patching is ad hoc, undocumented, or ignored during busy season.
What Proof Do You Need for Renewal? (Evidence Pack Checklist)
Underwriters don’t just want controls, they want evidence. Use this checklist to build a renewal-ready package:
MFA proof
- Screenshot/report showing MFA enforced across users and admins
- Exception list (ideally empty)
Endpoint security proof (EDR / centrally managed endpoint protection)
- Coverage report showing security agent installed across endpoints
- Central management view (what’s protected vs not)
Backup + recovery proof
- Backup architecture summary: offsite + offline/immutable copy
- Restore-test logs/results (date, what was restored, time to restore)
Patching proof
- Patch compliance report (especially critical/high severity)
- Policy describing patch windows/timelines
Training proof
- Security training logs + phishing test results (even simple records help)
- Your phishing reporting process
Incident response readiness
- A documented plan (who does what, who calls whom, what happens first)
- Vendor contacts and escalation steps (MSP, backup provider, insurer hotline)
Cost Expectations (What This Usually Means in Real Life)
Cyber insurance readiness isn’t “buy one tool.” It’s a bundle of controls + process + proof.
For many 20–100 user accounting firms, a useful planning range is:
- Baseline managed IT: $125–$175 per user/month (from your existing pricing positioning)
- Adding insurance-grade security depth: often means layering stronger email security, EDR/MDR monitoring, backup hardening (immutable/offline), and documented testing.
Buyer rule: the cheapest MSP quote is often missing the exact items insurers care about. These are usually MFA enforcement, restore testing, and evidence reporting.
If you want to pressure-test MSP proposals, read these other 2 articles:
- How Much Do Managed IT Services Cost for Accounting Firms in Los Angeles?
- How Do You Choose the Right Managed IT Provider for a CPA, Tax, or Accounting Firm in Los Angeles?
Common Mistakes That Cause Denied Quotes, Higher Premiums, or Renewal Panic
- “We have MFA” (but not for everyone)
Underwriters want broad enforcement, especially email and privileged users.
- Backups exist, but restores aren’t tested
Coalition and other underwriting guidance emphasize testing because failed restores are discovered too late.
- No offline/immutable backup copy
Modern ransomware targets backups; insurers increasingly look for resilience features like immutability and isolation.
- Patching is inconsistent during busy season
Underwriters care about patch windows and end-of-life software.
- You can’t produce proof
A working control with no evidence often gets treated as “not implemented.”
How to Choose an MSP That Helps You Qualify (Not Just “Fix Tickets”)
When you evaluate MSPs, ask these exact questions:
- Can you show an MFA compliance report (email, admin, remote access)?
- Do you provide EDR/MDR and can you show coverage reporting?
- How do you design backups to survive ransomware (offline/immutable), and how often do you test restores?
- Can you provide patch compliance reporting and your patch timeline policy?
- Do you provide an “evidence pack” for renewals (monthly/quarterly reporting)?
If the provider can’t show evidence, they’re not building an insurance-ready environment. They’re doing break/fix with nicer branding.
Example Scenario
A 45-user CPA firm in Los Angeles struggled at renewal because they couldn’t prove MFA coverage and hadn’t performed a documented restore test. They implemented:
- MFA enforcement across email and privileged accounts
- centrally managed endpoint protection/EDR reporting
- backup hardening with an offline/immutable copy
- a monthly restore test with documented results
At the next renewal, they submitted a clean evidence pack and avoided last-minute underwriting delays.
Trust Signals That Set Providers Apart
A provider worth your time should be able to back their claims with measurable proof, not just words. Look for:
- Monthly reporting samples showing MFA adoption, backup verification, patching status, and endpoint coverage
- A documented incident-response process with clear escalation steps
Fothion brings 20+ years in IT with sub-1-hour response times and 95% positive customer feedback.
Get an Accounting Firm Cyber Insurance Readiness Assessment (30 Minutes)
If you’re unsure whether your CPA/accounting firm would pass today’s cyber insurance underwriting checklist, the fastest next step is identifying the specific control gaps and missing proof before renewal.
Book a 30-minute call with Fothion and we’ll:
- review MFA coverage for email, remote access, and privileged accounts
- identify ransomware exposure risks and whether backups would survive an attack
- assess segmentation and backup protections (offline/immutable options)
- evaluate endpoint security coverage (EDR/MDR readiness)
- outline a practical “evidence pack” you can use at renewal
Book here: https://fothion.com/schedule-a-phone-call/
FAQs (with answers):
1.What cyber insurance controls are most commonly required?
Most insurers commonly expect controls like MFA, cybersecurity training, strong backups (including offsite/off-network), and identity/access management.
2.Is MFA required for email accounts?
Common underwriting guidance often expects MFA broadly—especially for email, remote access, and privileged users.
3.Do insurers require tested backups?
Yes—restore testing and backups stored separately/off-network are commonly emphasized because “backup that can’t restore” doesn’t reduce claims risk.
4.How fast do we need to patch vulnerabilities?
A common benchmark referenced by underwriting guidance is applying critical/high severity patches within 30 or fewer days (often faster for critical issues).
5.What documentation do we need at renewal?
Evidence typically includes MFA coverage, endpoint protection/EDR coverage, backup architecture + test results, patching reports, and incident response documentation.