Cyber Insurance Renewal Checklist for West Texas Businesses

If you run a small or mid-size business in Lubbock, Amarillo, Abilene, Midland-Odessa or a South Plains town like Levelland, Brownfield or Lamesa, cyber insurance renewal has probably gotten more detailed than it used to be. The questionnaire is longer. Underwriters want proof, not just a yes or no. And the controls they care about most, multifactor authentication (MFA), endpoint detection and response (EDR), and tested backups, are the same ones that actually reduce how bad a ransomware or email fraud incident can get.

This checklist is for owners and office managers who need to walk into renewal prepared. It is not legal or insurance advice, and every carrier writes policies differently. Use it to organize what you already have, spot gaps, and decide what to fix before the broker asks.

Why renewals feel harder now

Carriers have spent years paying claims for ransomware, business email compromise and stolen credentials. Industry analysis from CBIZ describes a clear shift: underwriters now treat a stronger baseline of controls as a prerequisite for coverage, and they are validating those controls more carefully than a self-reported checklist alone. MFA across critical systems, advanced endpoint protection such as EDR (or managed detection and response), and immutable or offline backups that have been tested for restore are repeatedly named as essentials. A documented incident response plan, patching discipline and security awareness training show up on the same list.

That pattern matches what West Texas businesses are seeing on renewal forms. The questions are less "do you have antivirus?" and more "is MFA enforced on email, remote access and admin accounts, and can you show it?"

The renewal checklist

Work through these items 60 to 90 days before your policy renews. Gather screenshots, console exports and dates as you go. Carriers increasingly want evidence that controls are deployed and working, not only that you bought a product.

1. Multifactor authentication (MFA)

MFA should be on for email, remote access (VPN or similar), administrator accounts and cloud apps that hold business data. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, urges small and medium businesses to require MFA wherever possible and to prefer stronger methods over text-message codes when they can. CISA's guidance for small businesses is here: Require Multifactor Authentication.

What to collect for the questionnaire:

• Which systems have MFA enforced (not only "available")

• Whether admin and privileged accounts are covered

• Whether legacy sign-in methods that skip MFA are blocked

• Coverage reports or conditional-access screenshots from Microsoft 365 or your identity provider

A weak answer is "we turned MFA on for some people." A stronger answer names the systems, shows enrollment coverage and notes any approved exceptions.

2. Endpoint detection and response (EDR)

Basic antivirus is no longer enough for many carriers. They want endpoint detection and response, tools that look for suspicious behavior on laptops and servers and support investigation, not only signature-based blocking. CBIZ notes that antivirus alone is often treated as insufficient and that advanced endpoint protection (EDR, XDR or managed detection and response) is part of the baseline many underwriters expect.

What to collect:

• Product name and whether it is installed on workstations, servers and remote devices

• A coverage or deployment report (how many devices are protected versus how many you own)

• Confirmation that alerts are reviewed by someone, whether that is your staff or your cybersecurity provider

• Any unmanaged or offline devices and a plan for them

If your inventory still has machines without an agent, list them. Carriers prefer honesty plus a remediation plan over a claim of 100% coverage that cannot be proven.

3. Backups that survive ransomware

A backup job that runs every night is not the same as a backup an attacker cannot encrypt or delete. Underwriters commonly ask about offline, air-gapped or immutable copies, separate credentials for the backup system, encryption and whether restores have been tested recently. CBIZ specifically calls out immutable or offline backups that are encrypted and tested regularly.

What to collect:

• What is backed up (file servers, Microsoft 365 mail and files, line-of-business apps, databases)

• How often backups run and how long they are kept

• Whether a copy is offline, immutable or otherwise isolated from the production network

• Dates and results of the last successful restore tests

• Who can administer backups, and whether that account uses MFA

If you have never restored a test file or mailbox, schedule that before renewal. For help designing and testing restores, see our backup and disaster recovery services in Lubbock.

4. Email security and fraud controls

Business email compromise still drives expensive claims. Expect questions about spam and phishing filtering, SPF, DKIM and DMARC email authentication, and controls around wire transfers or changes to vendor payment details (callbacks on known numbers, dual approval and so on). Law firms, title companies, CPA firms and anyone who moves money by wire should treat this section as high priority.

5. Patching and vulnerability management

Known, unpatched software remains a common entry point. Be ready to describe how you track critical updates on Windows, servers, firewalls and major apps, and how quickly high-severity issues get addressed. Keep a simple log of recent patch cycles. You do not need a perfect enterprise program; you do need a repeatable process you can explain.

6. Incident response plan

Carriers increasingly assume a breach is possible and want to know what you would do next. A short written plan beats nothing. Include who to call (internal lead, IT provider, insurer breach coach, legal counsel), how you isolate systems, how you communicate and where backups and logs live. A yearly tabletop walkthrough with managers is useful evidence that the plan is real.

7. Training and documentation

Many questionnaires ask whether staff receive security awareness training and how often. Keep attendance records or completion reports. Also keep current inventories of devices, users with admin rights and critical vendors who touch your data. Those lists make the rest of the application faster and more accurate.

A simple 30-day prep plan for West Texas offices

Week 1: Export MFA coverage from Microsoft 365 (or your identity provider). List every admin account. Turn MFA on anywhere it is missing for email and remote access.

Week 2: Pull an EDR deployment report. Compare it to your device inventory. Schedule installs for gaps, including field laptops used around the Permian Basin or South Plains.

Week 3: Confirm backup jobs and run at least one restore test of a sample file share or mailbox. Document the date, what you restored and who did it.

Week 4: Update the incident response contact list, gather training records and sit with your broker to review last year's answers against this year's evidence. Fix wording that overstates what you have.

Businesses with multiple locations, for example a main office in Lubbock and a second site in Midland-Odessa or Amarillo, should make sure remote sites are included in MFA, EDR and backup coverage. Carriers ask about the whole environment, not only headquarters.

How this ties to day-to-day IT

Cyber insurance requirements are not a separate project from good managed IT services. The same work that keeps your office running, patching, monitored endpoints, tested backups, clean Microsoft 365 sign-in policies, is what underwriters want to see. If your team is already stretched, this is often where an outside IT partner helps most: collecting the evidence, closing gaps and translating technical settings into plain answers for the broker.

Double Technologies helps West Texas businesses with the technical side of cyber insurance applications and renewals: reviewing MFA and endpoint coverage, strengthening backups, and answering the IT questions on the form. We bring 30 years of combined experience across IT support and cybersecurity. We can work remotely and we can come to you when something needs hands on site. Our hours are Monday through Friday, 8 AM to 7 PM, and Saturday, 9 AM to 5 PM Central.

Ready for renewal?

If your renewal is coming up and you are not sure you can prove MFA, EDR and tested backups across every office, call Double Technologies at (806) 319-8521. We will walk through the checklist with you, help gather the evidence carriers ask for and fix the gaps that usually slow renewals down.

Sources for further reading: CBIZ — Minimum Controls for Cyber Insurance; CISA — Require Multifactor Authentication.