A few years ago, buying cyber insurance meant a short form and a signature. Today, picture a renewal email that arrives with a long security questionnaire and a deadline.
Consider a New York company that has "done everything right". It has multi-factor authentication, nightly backups, and antivirus on every laptop. When the underwriter asks for proof, the owner finds that MFA was never switched on for two shared accounts, nobody has ever tested a restore, and the incident response plan lives only in the IT manager's head. This is a hypothetical, but it is a common pattern.
The lesson is that being secure and being able to prove it are different things. That gap is where an IT consulting advisory firm in NY earns its fee.
The New Question Is "Can You Prove It?"
Cyber insurance underwriting guides for 2026 describe a shift in underwriting: the question has moved from whether you own a control to whether you can prove it was fully enforced across every account. The same pressure comes from several directions.
Insurers
Carriers now ask for evidence, not reassurance. Commonly cited requirements include MFA, endpoint detection on every endpoint, tested immutable backups, a written incident response plan, and security awareness training. Requirements vary by carrier, so treat this as a common baseline rather than a rulebook.
Auditors and grant funders
Financial statement auditors, nonprofit funders, and compliance reviewers want to see that IT controls exist and are monitored. A verbal assurance rarely satisfies them. Written policies, dated reports, and named control owners do.
Customers and lenders
Larger customers and lenders increasingly ask vendors about their security programmes before signing. A business that can hand over a clean, current evidence package often moves through that review faster.
The stakes are real. Verizon's 2025 Data Breach Investigations Report found ransomware in 44% of breaches, with a median ransom payment of $115,000. Insurers and customers ask for proof because the losses are common and costly.
What "Proof" Actually Looks Like
Evidence is a document, a report, or a log that a stranger could read and understand. Here is how common controls translate:
| Control | Weak answer | Strong evidence |
|---|---|---|
| MFA | "We turned it on." | Report showing enforcement on every account, including admin and shared accounts |
| Backups | "They run every night." | Dated restore-test results showing recovery time and what was recovered |
| Vulnerability management | "We patch regularly." | Scan reports with findings, owners, and closure dates. |
| Incident response | "IT knows what to do." | Written plan with roles, contacts, and a recent tabletop exercise record |
| Staff training | "Everyone got an email." | Completion logs and phishing-simulation results |
| Vendor risk | "We trust our vendors." | Vendor inventory with review dates and risk ratings |
One detail from the underwriting commentary is worth remembering: partial MFA was treated as no MFA. Evidence only counts when it is complete.
Organising Evidence Around NIST CSF 2.0
A framework keeps an evidence file from becoming a pile of screenshots. The NIST Cybersecurity Framework 2.0 groups security work into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
- Govern: Who owns security decisions? Look for policies, risk appetite statements, and leadership reporting.
- Identify: What do you have, and what could go wrong? Look for an asset inventory and a risk assessment.
- Protect: What stops common attacks? Look for access controls, MFA enforcement, patching, and training records.
- Detect: How would you notice a problem? Look for monitoring and scan results.
- Respond: What happens in an incident? Look for the response plan and exercise notes.
- Recover: How do you get back to work? Look for tested backups and recovery objectives.
Frameworks like NIST CSF and CIS Controls are exactly what MMB Accounting uses when assessing control maturity and compliance readiness for clients.
Where an IT Consulting Advisory Firm in NY Fits
Your internal team or managed IT provider builds and runs your systems. An advisory firm's value is different: it provides independent validation. Because it isn't operating the controls it reviews, its findings carry weight with insurers, auditors, and boards.
At MMB Accounting, IT advisory work covers four areas that map directly onto the evidence table above:
- Risk assessment: evaluating controls and governance, then building a remediation roadmap tied to compliance expectations.
- Vulnerability scanning: internal and external scanning with prioritised remediation guidance.
- Penetration testing: simulated attacks that show how far an intruder could get, with both executive and technical reporting.
- Compliance readiness: alignment with NIST CSF and CIS Controls, plus audit preparation and documentation.
The firm also offers cyber compliance support, vendor due diligence, user awareness training, and incident response planning. Because the same advisors bring financial, tax, and operational experience, the reporting is written for finance and audit readers as well as engineers. That matters when the person reading your evidence is an underwriter or auditor.
New York's SHIELD Act adds a legal reason to keep records. It requires reasonable safeguards for the private information of New York residents, and small businesses can scale those safeguards to their size and the sensitivity of their data. Documented controls are the easiest way to show your safeguards are reasonable.
Three Evidence Gaps We See Most Often
These gaps are common in industry guidance on cyber insurance readiness:
- Controls that are on but not enforced. MFA on most accounts, with exceptions for old or shared logins.
- Backups that exist but have never been restored. A backup you haven't tested is an assumption.
- A response plan that isn't written down. Underwriters and auditors can't accept a plan that lives only in someone's head.
Each is cheap to fix before a renewal or audit and expensive to discover during one.
A Quarterly Rhythm for Keeping Evidence Current
Evidence goes stale. A report from eighteen months ago says little about today. A simple quarterly cycle keeps the file ready:
- Quarter 1: Refresh the risk assessment and confirm control owners.
- Quarter 2: Run vulnerability scans, track closure of findings, and test backup restores.
- Quarter 3: Hold a short incident response tabletop and update the plan, vendor list, and contacts.
- Quarter 4: Consider penetration testing of your most critical systems, run staff training, and compile everything before renewal season.
Store the results in one shared folder with dates and owners. When someone asks for proof, you can answer in hours instead of weeks.
Conclusion
Security has moved from "Do you have it?" to "Can you show it?" Insurers, auditors, lenders, and customers all ask the second question now, and an independent assessment is the most credible way to answer.
A good IT consulting advisory firm in NY helps you find gaps, fix the important ones, and turn the work into evidence others will accept. If you want to see how your current controls would hold up to an insurer or auditor, contact MMB Accounting to discuss a risk assessment.
Comments