As cyber‑insurance premiums continue to rise, it’s no longer enough to just “have MFA.” Insurers now demand strong, phishing‑resistant implementations—or they won’t provide coverage. Meeting the mfa requirements for cyber insurance means understanding which MFA types are accepted, how to upgrade legacy systems, and what it means for policy costs and risk.

Why Insurers Are Raising the Bar

MFA is now one of the top technical requirements insurers look at when assessing cyber-risk. Insurance carriers have seen an increase in claims tied to account takeovers, many of which succeeded because the organization relied on outdated MFA like SMS codes. As a result, insurance underwriters are demanding stronger controls across the board.

Understanding Phishing‑Resistant MFA

Not all MFA is created equal. Traditional methods—like SMS or mobile app prompts—can be intercepted or spoofed. “Phishing-resistant MFA” refers to methods that verify the user and device in a cryptographically secure way. Examples include hardware security keys (like YubiKeys) and certificate-based authentication. These methods drastically reduce the risk of credential phishing attacks.

Business Risks of Weak MFA

• Policy denial or voiding: Insurers may reject your claim if your MFA does not meet their underwriting criteria.
• Higher premiums: Basic MFA often leads to increased costs. Some insurers offer reduced rates for phishing-resistant MFA adoption.
• Regulatory exposure: Financial and healthcare regulators increasingly expect strong authentication methods as part of compliance obligations.

Five Steps for Business Leaders

1. Audit Your Current MFA

Identify how users are authenticating. Are you using SMS, push notifications, app-based codes, or security keys? Review login methods across email, VPN, remote access, and internal applications.

2. Upgrade to Phishing‑Resistant Methods

Start with your most privileged accounts—executives, finance, and IT administrators. Implement FIDO2-based hardware tokens or certificate-backed smart cards that validate both user identity and device integrity.

3. Confirm Requirements with Your Insurance Provider

Talk directly with your broker or carrier. Ask for a list of MFA methods that meet current underwriting standards and get confirmation in writing where possible.

4. Train Your Staff

Phishing-resistant MFA only works if it’s understood and used correctly. Provide step-by-step training for security key use and make adoption easy across departments.

5. Monitor and Report Compliance

Keep records of your MFA rollout, including coverage by user group and authentication method. This information may be required during insurance renewals or audits.

Helpful Resources

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers guidance on phishing-resistant MFA. Learn more from their official publication here:
Implementing Phishing-Resistant MFA (CISA).

Where Cost+ Can Help

Cost+ helps businesses meet the latest Security+ standards required by insurers. We assess existing MFA, implement compliant solutions, and document everything to help you secure coverage at the best possible rate.

Bottom Line

If your company still relies on SMS or app-based MFA, it may no longer meet mfa requirements for cyber insurance. Upgrading to phishing-resistant MFA isn’t just smart—it could be essential to keeping your business protected and insured.

By Thomas McDonald
Vice President

As extreme weather, aging infrastructure, and rising energy demands continue to strain the U.S. power grid, businesses face increasing risks of unexpected outages and rolling blackouts. For many organizations, even a short disruption can lead to significant financial losses, reputational harm, and operational chaos. This brief outlines why executives should prioritize power contingency planning, what questions to ask IT and facilities teams, and how to build a resilient business strategy in the face of grid instability. For related guidance, see our Executive Brief on backup testing and validation.

The Growing Challenge of Grid Reliability

Power reliability has become a growing concern for organizations of all sizes. According to the U.S. Department of Energy, demand for electricity is outpacing upgrades to transmission infrastructure in several regions, increasing the likelihood of grid stress during peak periods. Summer heatwaves, winter storms, wildfires, and cyberattacks have all contributed to a noticeable uptick in outages over the past five years.

For businesses, the impact can be significant: lost sales, halted production, data loss, and damaged customer trust. Yet many executives assume that power contingency planning is purely a facilities or IT responsibility, rather than a boardroom priority. Engaging your Recovery+ team early can help close this gap.

Why Executives Need to Lead

While operational teams handle day-to-day technical details, executives are ultimately responsible for ensuring the organization can meet its obligations — to customers, partners, and regulators — even during adverse events. Without top-down leadership, power contingency plans often remain incomplete, untested, or underfunded.

Leadership should focus on three core goals:

• Uptime: Keep critical systems online, even if at reduced capacity.
• Safety: Protect employees and customers during disruptions.
• Continuity: Maintain communications, data integrity, and core operations.

What Questions to Ask Your Teams

Executives don’t need to be electrical engineers or IT architects to lead effectively. Instead, they should ask the right questions to ensure accountability and clarity:

• Do we have an updated power contingency plan that includes IT, facilities, and key business functions?
• Which of our systems and operations are mission-critical, and what level of backup power do they require?
• Have we tested our uninterruptible power supplies (UPS) and generators within the last six months?
• Do we have vendor relationships in place for emergency fuel, generator rental, or co-location if our main site is offline?
• Are our backup and recovery processes resilient to a sudden outage in the middle of business hours?
• Do employees know who to contact and what procedures to follow during an outage?

Simply asking these questions — and demanding clear answers — can uncover vulnerabilities and motivate proactive improvements. For help with structured policies and audits, consult our Security+ services.

Key Elements of a Resilient Strategy

Here are some specific components your team should consider as part of a robust power contingency plan:

Invest in Backup Power

At a minimum, critical systems such as servers, network equipment, and emergency lighting should be connected to UPS systems capable of bridging short outages or providing enough time to shut down gracefully. For longer outages, diesel or natural gas generators are often the best solution — but they require regular maintenance and fuel contracts to remain reliable.

Identify Tiered Priorities

Not every system needs to stay online during an outage. Work with IT and operations teams to map out which systems are truly critical, which can operate in reduced mode, and which can pause safely. This helps optimize the use of limited backup power resources. For more insight, see our Recovery+ page.

Test and Review Regularly

Even a well-designed plan can fail if not regularly tested. Conduct at least annual — and ideally quarterly — simulated outages to verify equipment, employee readiness, and communication channels. Capture lessons learned after each exercise and update plans accordingly.

Plan Beyond IT

Power planning is not just about data centers and computers. Consider HVAC for employee comfort and safety, emergency lighting, security systems, refrigeration (if applicable), and customer-facing systems such as point-of-sale. A holistic approach ensures nothing is overlooked. Partnering with Support+ can help align facilities and technology priorities.

Don’t Wait for a Crisis

Power disruptions rarely announce themselves in advance. By the time a storm hits or the grid operator issues a blackout warning, it’s often too late to react effectively. Leaders who invest in planning now not only reduce risk but also strengthen customer confidence and organizational resilience.

As the Department of Energy’s summer reliability assessment makes clear, outages are no longer rare, isolated events. They are becoming part of the business environment — and executives who treat them as such are far better positioned to maintain competitive advantage during disruption.

Final Thoughts

Power outages and grid instability may seem like operational issues, but they have strategic consequences. Executive oversight is crucial to ensure plans are comprehensive, tested, and aligned with organizational goals. By asking the right questions and insisting on accountability, business leaders can ensure their organizations remain resilient — no matter what happens to the grid.

For more insight into national power grid risks, see the U.S. Department of Energy’s 2024–2025 Reliability Assessment.