Does cyber insurance require employee training?
See who on your team would click, for free Request a free baseline phishing test for up to 25 staff, or start a free trial of the training platform. Request the free test → Many small business owners buy a cyber policy and later find out it comes with questions. “Do you have MFA?” “Do you train your staff?” “Do you test them?”
So, does cyber insurance require employee training? Here is what we know, and how to get ready without guessing.
Does cyber insurance require security awareness training?
It depends on your insurer. We looked for a standard list of insurer rules and found none. Each carrier has its own application and its own wording. What we can point to:
- A Triple-I and Fenix24 report says insurers “establish security requirements as conditions of coverage,” and that all the insurers it studied require multi-factor authentication for administrative accounts. It does not list staff training as a rule.
- CISA’s small business guidance says to make training a regular part of onboarding and ongoing development, and to measure it by tracking incidents and phishing simulation reporting.
So training is a smart control and a likely question on your form. But check your own paperwork before you answer.
What do cyber insurance applications usually ask?
Applications differ, so treat this as a warm-up list, not a rulebook. Expect questions about the basics you control:
- Do you use multi-factor authentication on email and admin accounts?
- Do you back up your data, and have you tested a restore?
- Do you train staff on phishing and fraud?
- Do you have a plan for a security incident?
- How do you check a change of bank details before paying?
If you cannot say yes to one of these, the application is a good prompt to fix it. Many items are cheap and quick.
What 5 questions should I ask my broker?
- Does my application ask about staff security training or phishing tests?
- What proof do you accept?
- Which controls are conditions of coverage (MFA, backups, patching)?
- What happens if an answer on the application turns out to be wrong?
- Does the policy cover wire fraud and business email compromise?
Number 4 matters. If you say “yes, we train everyone” and it is not true, a claim can get harder. So only answer what you can prove.
What proof of training should I keep?
Keep one folder with six items. It takes an hour to set up and saves a lot of stress at renewal or claim time.
| Item | What it shows |
|---|---|
| Staff list with dates | Who was trained, and when |
| Course outline | What they were taught |
| Completion records or certificates | Each person finished |
| Quiz scores | They understood it |
| Phishing test reports | Real behaviour, not just a tick |
| Policy and reporting steps | What staff do when something looks wrong |
Our guide on what auditors ask for uses the same idea.
What can I do before renewal?
Five quick wins:
- Turn on multi-factor authentication, starting with email and admin accounts. CISA explains how.
- Train everyone, and write down the date.
- Run a phishing test and keep the report.
- Put a payment rule in place for bank changes. See business email compromise.
- Write a one-page “what to do if something goes wrong” and share it. Our clicked a phishing link guide is a good start.
A simple example
Say your renewal form asks, “Do you provide security awareness training to all employees?”
A safe answer is “Yes” only if you can open your folder and show the staff list, the dates and a few completion records. If you trained half the team, say that, and fix the rest before you sign. An honest “partly, and here is our plan” is better than a “yes” you cannot back up.
How we help
You can request a free phishing risk test for up to 25 staff. It gives you a baseline report. For ongoing lessons and tracking, look at our pricing or book a free demo.
How often to train is a common next question. We cover it in How often should employees do security awareness training?
Questions people ask
Does my cyber insurance require security awareness training?
It depends on your insurer and policy. Read your application and policy wording and ask your broker. We did not find a single standard rule that every insurer follows.
What proof of training should I keep?
Keep a list of who was trained, the dates, the lesson content, quiz results and any phishing test reports. Save them where you can find them when you renew or file a claim.
Will training lower my premium?
We cannot promise that. Ask your broker whether showing a training program and MFA changes your terms.
What else do insurers look for besides training?
The Triple-I study says all insurers it looked at require multi-factor authentication for administrative accounts. Backups, patching and an incident plan are common basics to have ready.
Does cyber insurance cover fake invoice and wire fraud?
It depends on the policy. Wording on fund transfer fraud varies. Ask your broker in plain words whether a fake bank-change email is covered, and what you must do first.