Cyber Insurance Requirements for Nevada Small Businesses: What Insurers Ask For | High Sierra Cyber

Ten years ago, a small business could buy cyber insurance by ticking a few boxes. Today the application reads more like a security audit. If you own a business in Reno, Sparks, Carson City, or around Lake Tahoe and you are buying or renewing a policy, here is what insurers typically expect and how to prepare.

This is general information from a security awareness firm. We are not insurance brokers or agents, and we cannot promise coverage, eligibility, or pricing. Your broker is the right person to advise on the policy itself.

Does Nevada require cyber insurance?

Generally, no. We are not aware of a Nevada statute that requires a small business to carry cyber insurance. The pressure comes from other places:

Contracts. Larger customers, franchisors, and property managers increasingly ask vendors to prove coverage.
Lenders and landlords. Some financing and lease agreements include insurance requirements.
Risk. Nevada does require businesses that hold personal information to use reasonable security measures (NRS 603A.210) and to notify affected residents after a breach (NRS 603A.220). See NRS Chapter 603A. A breach response with legal help, forensics, notification, and credit monitoring can cost far more than a small business has on hand.

What cyber insurance usually covers

Policies vary widely, so read yours. Most combine some mix of:

First-party costs: forensic investigation, data recovery, business interruption, ransomware response, and public relations.
Third-party liability: legal defense, regulatory response, and claims from customers whose data was exposed.
Breach response: legal advice, notification to affected people, and credit monitoring.
Funds transfer or social engineering fraud: money lost when an employee is tricked into sending a payment. This is often a separate, much smaller sublimit, which we cover below.

The controls insurers commonly require

Exact questions differ by carrier, but these come up on almost every application.

Multi-factor authentication (MFA)

This is the big one. Insurers ask whether MFA is enforced, not just available, on email, remote access such as VPN or remote desktop, cloud services, and administrator accounts. Some carriers will decline to offer coverage at all if MFA is missing on email or remote access.

Backups you can restore

Expect questions about how often you back up, whether at least one copy is offline or immutable so ransomware cannot encrypt it, and whether you have actually tested a restore. Keep the date of your last successful test.

Endpoint protection

Insurers increasingly want modern endpoint detection and response (EDR) on computers and servers, ideally with someone monitoring the alerts, rather than basic antivirus alone.

Patching and unsupported software

Automatic updates, and no operating systems or applications that the vendor no longer supports.

Email security

Spam and malicious link filtering, and proper SPF, DKIM, and DMARC settings for your domain.

Employee training and phishing simulation

Applications commonly ask whether employees receive security awareness training, how often, and whether you run phishing simulations. Dated records are what you want when the question is asked.

Incident response plan

A written plan that says who to call, in what order, and how to reach them if your systems are down. Even one page helps.

Payment verification procedures

For social engineering coverage in particular, insurers want to know that you verify payment or bank detail changes by calling a known number, and that large payments need a second approver.

Business email compromise and fake invoice scams are among the most common small business losses, so this coverage matters. Two things to check with your broker:

The sublimit. According to Amwins, social engineering sublimits often fall between $25,000 and $250,000, far below the overall policy limit. Compare that number to the largest wire your business ever sends.
Verification conditions. Some endorsements pay only if you followed a specified procedure, such as calling back a known number or requiring dual authorization above a set amount. If the policy says you must do it, and you did not, the claim can be denied. See this overview from the National Law Review.

Your crime or fidelity policy may also address some of this, so ask how it interacts with the cyber policy.

Answer the application honestly and accurately

This is the part that surprises people. The application is a legal document, and the insurer relies on your answers when it decides whether to insure you and at what price.

In a widely reported 2022 case, Travelers v. International Control Services, Travelers sued to rescind a cyber policy after a ransomware attack. It alleged the company had said it used MFA broadly when it had only protected its firewall. The case ended with a judgment declaring the policy void from the start. Carriers have since moved toward verifying answers, including outside scans of your systems.

Practical rules:

Do not check “yes” for MFA, EDR, or backups unless it is true across your environment. “Mostly” and “on the important accounts” are not the same as “yes.”
Have the person who actually knows your systems, or your IT provider, review the answers before you sign.
Keep a copy of the submitted application.
If you were not in compliance yet, fix it first. A denied application is better than a voided policy after a loss.
If your controls change during the policy term, ask your broker whether you need to tell the carrier.

How to prepare in 30 days

Get a copy of last year’s application, or a sample one from your broker, so you know the questions.
Turn on MFA for email, remote access, banking, and admin accounts. Confirm it is enforced for every user.
Verify your backups and do a test restore. Note the date.
Confirm endpoint protection is installed and reporting on every device.
Write the one-page incident response plan and store a printed copy.
Adopt the call-back rule for payment changes, in writing, with dual approval above a dollar threshold.
Schedule training and a baseline phishing test, and keep the records.
Fix unsupported software or document a plan to retire it.
Collect it all in one folder. Policies, screenshots, training records, backup test results. Your broker and the underwriter will thank you.

Questions to ask your broker

What is my social engineering or funds transfer fraud sublimit?
Do I need to follow specific procedures for that coverage to apply?
Do I need the insurer’s approval before hiring a forensics or legal firm?
How quickly must I report an incident?
Are ransomware and business interruption sublimited, and is there a waiting period?
Does the policy cover incidents caused by my vendors or IT provider?
What happens if my security controls change during the term?

How we can help

High Sierra Cyber does not sell insurance, but we help Northern Nevada businesses prepare the security side of an application or renewal. That means plain-English guidance on what insurers ask, a prioritized list of gaps, and dated training and phishing test records you can hand to your broker. Learn more about cyber insurance readiness, or contact us for a free consultation and tell us when your renewal is due.

This article is general information, not insurance or legal advice, and High Sierra Cyber cannot guarantee coverage, eligibility, or premiums. Speak with a licensed insurance broker and your attorney about your situation.