Cyber Insurance Security Requirements: MFA and Backups for Texas Small Businesses

Imagine a Friendswood restaurant that uses cloud email for invoices, a separate payroll portal, a point-of-sale system, and a shared drive for schedules. The owner checks “yes” next to multifactor authentication (MFA) on a cyber insurance application because everyone uses a code to open email. But the payroll administrator still signs in with only a password, and nobody has tried restoring the point-of-sale records from backup. Which answer is accurate?

It depends on the exact question, not on whether the business feels generally secure. Cyber insurance applications and renewals can ask about specific accounts, systems, backup arrangements, and past incidents. A control that works on one app may not work on another. This guide is a practical way for Texas business owners to get reliable answers before comparing policies—and to make those controls useful when something actually goes wrong. It does not replace your insurer’s application, an IT assessment, or the wording of a particular policy.

Start with the systems that would stop your business

Before asking your IT provider, “Do we have MFA and backups?” write down what your business needs to operate tomorrow. Keep the inventory short enough to use: business email, cloud files, accounting, banking, payroll, customer records, payment or point-of-sale systems, remote access, and the administrator accounts for each. Add any vendor-operated system you depend on, even if you do not manage its servers.

A New Braunfels contractor might start with estimating software, project photos, scheduling, supplier accounts, and the bank portal that pays subcontractors. A Houston-area medical practice might start with scheduling, billing, and electronic records, while recognizing that a healthcare provider may have additional privacy and security obligations. A San Antonio logistics firm may prioritize dispatch, freight portals, and accounts that change delivery or payment instructions. The examples are different because the interruption and data exposures are different.

For each system, record: who administers it; who can access it; whether MFA is enforced for every relevant user, including administrators and outside providers; what data it holds; what is backed up; and who could restore it. The NIST Cybersecurity Framework 2.0 small-business guide organizes this kind of work around identifying assets, protecting them, detecting problems, responding, and recovering. You do not need a large IT department to assign a name to each critical system.

MFA: check where it is enforced, not just where it is offered

MFA adds another step beyond a password. It can help when a password is stolen through a convincing email, reused from another site, or exposed in a breach. The FTC’s small-business cybersecurity guidance recommends MFA, limited access to sensitive information, software updates, backups, staff training, and an incident plan. MFA is important, but it is not proof that an account cannot be compromised.

Walk through the accounts most likely to create a serious loss:

• Email and identity administration. Can an attacker reset other passwords from the owner’s or office manager’s mailbox? Are the separate administrator accounts protected, or only ordinary staff logins?
• Remote access and outside IT support. If a managed service provider can reach your network, ask how its own access is authenticated and removed when a technician leaves.
• Money-moving systems. Check banking, payroll, accounting, and vendor portals separately. Email MFA does not automatically secure a bank login or a payee-change workflow.
• Customer data and essential operations. Include practice-management software, order platforms, scheduling, dispatch, and cloud storage. Ask whether individual users can bypass MFA or use shared accounts.

“Available” and “required” are different. An app may offer MFA while letting one old account sign in with a password alone. Ask your administrator to show the setting that enforces the rule, confirm enrollment for all active users, and check how a new phone or recovery method can be added. Where the system supports it, stronger phishing-resistant options such as security keys or passkeys can be worth discussing for highly privileged accounts; a one-time code is better than a password alone but can still be surrendered to a convincing fake login page.

Do not claim that all users have MFA if one critical system or external administrator does not. Document the exception, the reason, the person responsible for fixing it, and the expected date. If an insurer asks a narrowly worded question about email only, answer that question as written; if it asks about every remote or privileged account, check those separately. The carrier and form determine what the question means and whether a control is a condition of a particular quote or policy—not a blanket Texas rule.

Backups: prove you can get the business running again

A backup is only useful if it includes the information you need and someone can restore it. “The files are in the cloud” is not a complete answer: a hosted app, file sync, and a recoverable backup can be very different services. Ask the vendor or IT provider exactly what it retains, for how long, and how a deleted or encrypted record is recovered.

The CISA #StopRansomware Guide recommends offline, encrypted backups of critical data and regular tests of their availability and integrity. The reason is practical: ransomware may target backups it can reach. For a small business, the important questions are whether an attacker with an ordinary login—or with administrator access—could also erase the recovery copy, and whether your provider has demonstrated a restore.

Make a short restoration map:

1. List what must return first. For a retailer, that may be checkout, current orders, and inventory. For a contractor, it may be job schedules, plans, and open invoices. For a professional firm, client files and communications may be the first priorities.
2. Identify each copy and its owner. Include cloud services and vendor-managed systems. Ask whether a backup is segregated, offline, or otherwise protected from deletion by compromised production accounts. Do not describe it as “immutable” unless the provider confirms the configuration.
3. Test one real recovery. Restore a representative file or a nonproduction system, verify the contents, and record the date, elapsed time, and any missing dependencies. A successful backup-job notification is not the same as a successful restore.
4. Plan for access when normal systems are down. Keep current vendor and insurer contact details available outside the affected network. Decide how to take orders, reach staff, and document work during an outage.

A backup can help restore data after ransomware; it cannot reverse a fraudulent wire or make copied customer information secret again. That distinction matters when comparing cyber business interruption, data recovery, breach response, and fraud coverage. If you rely on one payment processor or hosted platform, ask whether a policy’s dependent-system or provider-outage wording applies, what waiting period begins before lost income is payable, and what records you would need to substantiate a loss.

Pair technical controls with a payment-verification routine

An AI-written phishing email can sound polished, and a synthetic voice can make a hurried phone request seem familiar. The underlying business problem is still the same: someone is trying to change where money goes or obtain a login. MFA may block a stolen-password attempt, but it will not stop an authorized employee from sending a payment to the wrong account after trusting a forged instruction.

For a restaurant paying a food distributor or a contractor paying a subcontractor, establish a rule that a bank-detail change is verified through a phone number already in your records—not a number in the new email, invoice, voicemail, or video call. Have a second person approve changes above a threshold you choose for your business. Preserve the original message and callback record. If the request appears to come from the owner, the same independent check still applies. This is more dependable than asking staff to spot every telltale spelling mistake.

Our vendor bank-change playbook walks through that workflow. The separate question for insurance is whether a payment initiated by an authorized employee after deception is treated differently from a transfer directly initiated by an intruder. Do not assume that an MFA setting, a cyber policy, or a commercial crime policy settles both scenarios.

Match the loss to the policy, not the policy name

The FTC’s cyber insurance overview distinguishes first-party costs—such as forensic work, data recovery, notification, and certain interruption losses—from third-party claims by affected customers or other parties. Those are categories for comparison, not a promise that every form covers every listed expense. Limits, retentions, exclusions, sublimits, waiting periods, and required response procedures can change the result.

Bring your agent three concise scenarios and ask what would respond:

• Compromised mailbox and diverted payment. An employee receives a fake vendor message and sends money. Ask about social engineering or funds-transfer fraud under cyber and commercial crime, any verification conditions, and whether coverage differs if the attacker directly accesses online banking.
• Ransomware and lost operating time. A logistics company cannot dispatch while its systems are restored. Ask about response vendors, data restoration, cyber business interruption, provider outages, waiting periods, and whether backups or security controls affect eligibility or coverage conditions.
• Customer data or professional service claim. A healthcare practice or professional firm finds evidence of unauthorized file access, or a client alleges a service error involving technology. Ask where cyber privacy liability ends and professional liability/errors and omissions begins. General liability and a business owners policy should not be assumed to cover electronic-data or payment losses simply because the business owns them.

If an agent says two policies may both matter, ask how they coordinate and which is primary for the particular event. Read endorsements and definitions, not just a quote summary. BIG – Brock Insurance Group can help review cyber and professional liability options alongside the business’s existing insurance, including any commercial crime coverage, property, commercial auto, and employee exposures where relevant. No policy replaces a working response plan.

Answer the application with evidence, not optimism

At renewal, ask whoever manages technology to walk through the exact application with you. A useful evidence folder can contain the current system inventory, screenshots or provider confirmations showing MFA enforcement, the most recent restore-test note, backup ownership and frequency, the incident contact list, and a record of open exceptions. Protect that folder because it may contain sensitive security details; share only what the insurer or agent needs through an appropriate channel.

Ask the agent these questions before signing:

• Does “MFA for all users” include administrators, remote access, vendors, and every cloud app, or only named categories?
• What does the insurer mean by “backups”—frequency, offline or segregated storage, testing, and third-party systems?
• Are any controls required before the policy starts, subject to a deadline, or merely information for underwriting?
• What changes during the policy period should be reported, and what documentation should we keep?
• Who do we call first after an incident, and must we obtain approval before hiring forensic counsel or an IT recovery firm?

Do not invent a universal list of insurer requirements. Different carriers ask different questions and issue different forms. If an answer is uncertain, ask for clarification and correct the underlying record before submitting it. An application answered carefully today is easier to revisit after a new platform, a vendor change, or a real claim.

A manageable first month

Week 1: Name a business owner for the review and list the ten or so accounts and systems that control money, customer information, or daily operations. Ask vendors where they hold your data and who administers it.

Week 2: Verify MFA on email, administrator, remote-access, banking, payroll, and other critical accounts. Fix the highest-risk gaps first, and document anything the software cannot support. Remove stale users and shared logins where possible.

Week 3: Confirm what is backed up, where it is kept, and who can delete it. Arrange one small restore test and write down what did and did not work. Put essential contact numbers somewhere accessible during an outage.

Week 4: Compare two or three plausible loss scenarios against the policy wording, the application, and your payment-verification practice. Ask your agent and IT provider to help resolve mismatches. Repeat the inventory when your business changes systems; repeat the restore test on a schedule that fits your operations and insurer questions.

If you discover a suspected intrusion in the meantime, secure affected access with your IT provider, preserve available logs and messages, and promptly use your policy’s reporting channel. If money has moved, contact the bank’s fraud team immediately. Whether a breach notice is legally required depends on the facts and the information involved; get appropriate legal advice rather than assuming every suspicious login triggers the same notice.

For a practical review of cyber insurance alongside the rest of your Texas business coverage, call BIG – Brock Insurance Group at (281) 482-4244 or request a quote. Its independent carrier network lets the team compare suitable coverage and value, with personal guidance for the risks your business actually faces.