Cyber insurance requirements for Maryland small businesses: the checklist, and who can get you through it

By Duane Epperly · Published July 6, 2026 · Updated October 20, 2026 · 4 min read

Cyber insurers now verify five controls before writing or renewing a small-business policy: multi-factor authentication on email, remote access, and admin accounts; endpoint detection and response on every device; backups kept off the network and tested; security awareness training; and role-based access with least privilege. EDG.tech implements all five for Maryland and Washington, DC small businesses inside EDG.tech Complete at $100 per user per month and completes the carrier questionnaire with you.

What do cyber insurers require from a small business in 2026?

The renewal questionnaire has hardened into a standard. Carriers' own guidance names the same five controls: multi-factor authentication on every login, with email and remote access first; routine security awareness training; at least one backup kept completely separate from the primary network, with a second copy off-site and recovery tested; identity and access management so each person can reach only the data their role needs; and least privilege, under which users cannot install or change software on company devices (Coalition, "5 essential cyber insurance requirements"). Most applications add endpoint detection and response on every workstation and server, a patching cadence, email filtering, and a written incident response plan.

Answer "no" to any of these and the premium rises, the ransomware sub-limit shrinks, or the application is declined. Answer "yes" inaccurately and a claim can be denied for misrepresentation, which is the outcome nobody budgets for.

Why does it matter more in Maryland?

Two reasons specific to here. Maryland's Personal Information Protection Act requires businesses that hold residents' personal data to keep "reasonable security procedures" and to notify affected people within 45 days of discovering a breach (Md. Code, Com. Law § 14-3504; Maryland Attorney General guidance). A carrier that sees you cannot meet the statute will not want the claim. And the money is real: the FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints and $3.05 billion in reported losses in 2025, with 3,611 ransomware complaints (FBI IC3 2025 Internet Crime Report). Business email compromise is exactly the loss that enforced multi-factor authentication and email security prevent, and it is the first thing the underwriter asks about.

The checklist, control by control

Multi-factor authentication. On email, VPN and remote desktop, cloud admin consoles, and any account that can move money. Carriers treat email MFA as the minimum, and most now ask whether it is enforced for every user rather than available.

Endpoint detection and response. Not a virus scanner. Software on every workstation and server that detects behavior, isolates the machine, and can roll back changes, with a person or a service watching the alerts. The questionnaire usually asks who monitors it and whether coverage is 24/7.

Backups kept apart and tested. One copy that ransomware on the network cannot reach, one copy off-site, and a recorded test restore. "We have backups" is not an answer; "we restored a server last quarter and it took four hours" is.

Security awareness training with phishing simulation. Carriers want to see that training happens on a schedule and that simulated phishing results are tracked, because the human click is still the most common way in.

Access control and least privilege. Named accounts, no shared admin logins, admin rights removed from daily-use accounts, and offboarding that closes access the day someone leaves.

Usually also asked: patching within a defined window, email filtering with impersonation detection, a written incident response plan, and encryption on laptops.

What do you send the underwriter?

Carriers increasingly ask for evidence, not checkboxes: a screenshot of the MFA enforcement policy, the endpoint protection console showing every device covered, the last backup test report, the training platform's completion and phishing-click rates, and the user list with admin rights marked. If your IT provider cannot produce those in a day, the controls are probably not where the application says they are.

Who can help a Maryland small business meet cyber insurance requirements?

A managed IT and security provider that already runs these controls for every client, which is the point of EDG.tech Complete. For $100 per user per month it includes enforced multi-factor authentication, endpoint detection and response on every device, a 24/7 security operations center that watches the alerts, Microsoft 365 or Google Workspace email security, security awareness training with phishing simulations, and the managed IT foundation underneath. We complete the carrier questionnaire with you, produce the evidence pack above, and if a control is missing on day one, the proposal says what it costs to close it and when it will be done.

"The questionnaire stopped being paperwork years ago. Insurers verify now, and the businesses that struggle are the ones answering yes from memory," says Duane Epperly, founder of EDG.tech.

EDG.tech serves small businesses in Gaithersburg, Rockville, Bethesda, Germantown, Washington, DC, and Frederick from offices in Brookeville, Gaithersburg, and Frederick. Start with a free security assessment, which checks each control on this list against your environment, or a free 30-minute consultation with a fixed price within two business days.

FAQ

Will better controls lower our premium?

Often. Carriers price to risk, and verified multi-factor authentication plus monitored endpoint detection and response moves a small business into a better band. We cannot promise a number; the carrier sets it.

What happens if we answer the questionnaire inaccurately?

Claims get denied over misrepresented controls. Answer accurately, fix the gaps first, and keep the evidence.

How fast can a small business become insurable?

The core technical controls deploy in days across a small environment once we have access. Training and the first tested restore take a few weeks to produce the records carriers ask for.

Does EDG.tech Essentials meet cyber insurance requirements?

Not on its own. Essentials covers monitoring, patching, endpoint and DNS protection, and a business-hours helpdesk at $45 per device per month. The controls carriers verify, especially monitored endpoint detection and response and enforced multi-factor authentication across identity and email, are in Complete.

Do you work with our insurance agent or broker?

Yes. We will join the renewal call, answer the technical questions directly, and send the evidence pack to the agent.

Sources

• Coalition, "5 essential cyber insurance requirements"
• Md. Code, Com. Law § 14-3504 (45-day notice)
• Maryland Attorney General, business guidelines under PIPA
• FBI IC3, 2025 Internet Crime Report