What this means
Cyber insurers may ask whether all servers and workstations have endpoint protection, EDR, MDR, or monitored security tooling. The details matter because unsupported devices and exceptions can weaken the answer.
Coverage across every relevant device is more useful than a tool installed on only some machines.
When it shows up
This usually appears during a cyber application, renewal, client security review, or broker conversation about whether the business is ready to quote.
In practice, the requirement is rarely only about buying insurance. It is also about showing that you understand the client's risk concern, can produce the right evidence, and know which details belong with a broker, IT/security contact, operations owner, or legal reviewer before you sign.
What to look for in the contract
Look for which systems, users, vendors, and security controls are in scope, then gather evidence instead of relying on memory.
Exact policy names or phrases, such as cyber liability, technology E&O, or professional liability.
Per-claim, aggregate, sublimit, deductible, and any contract-specific amount.
Certificate holder, due date, endorsement wording, and delivery instructions.
How to use this guide
Treat this page as preparation for a more precise conversation. Start with the checklist, gather the evidence you already have, and split unanswered items into coverage questions for a broker and readiness questions for IT, security, or operations.
Checklist
- Inventory workstations, servers, and remote devices.
- Confirm security agent status.
- Document who reviews alerts.
- Remove stale or unmanaged devices.
Who should help with what
This is primarily an IT/security handoff, with broker guidance on what the insurer or client will expect.
Ask a broker which controls are required for eligibility, pricing, renewal, or client acceptance, and what evidence is useful to keep.
Ask IT or security to verify the control across users, devices, cloud systems, vendors, and exceptions instead of answering from memory.
Common mistake to avoid
The common mistake is answering control questions too broadly, especially when only some users, devices, or cloud systems are covered.
Questions for the right specialist
Coverage questions
- Is antivirus enough or is EDR required?
- Do contractor devices count?
- What reports should we keep?
Readiness questions
- Where can we export or screenshot evidence for this control?
- Does the control apply to every relevant user, device, system, or vendor?
- What exceptions, stale devices, shared accounts, or untested processes need to be fixed?
Build your packet
If this requirement is tied to a real client contract, use the CoverReady checklist to turn the wording into a readiness packet: coverage questions for your broker, technical evidence for IT/security, certificate needs, and items to clarify before making commitments to the client.
Start checklistCoverReady is a practical education tool. Specific insurance requirements can vary by contract, policy, carrier, state, and business facts, so bring real requirements to a licensed broker or attorney before you rely on them.