Cyber insurance used to be a box an East Texas business checked once a year. It is now an exam. Federal reviews have documented the shift: a U.S. Government Accountability Office, GAO-21-477, Cyber Insurance found that insurers raised premiums, lowered coverage limits, and tightened the terms and conditions of policies as cyberattacks grew more frequent and expensive. The practical effect for a Longview manufacturer or a Tyler clinic is simple. The application now asks, in writing, whether you run specific controls, and the answer decides both your price and whether a future claim gets paid.
What insurers now ask for
The questionnaire varies by carrier, but the core list has settled into a recognizable shape:
- Multi-factor authentication on email, remote access, and administrative accounts.
- Tested backups kept offline or otherwise out of an attacker's reach, with restores actually verified.
- Endpoint detection and response on every machine that touches company data, not just free antivirus.
- Email filtering and phishing awareness, because most incidents still start with a message someone was meant to trust.
- Patching on a schedule, especially for anything facing the internet.
- A written incident response plan that names who gets called and what gets disconnected.
Answer dishonestly and you have bought a policy that will not pay. Answer honestly without the controls and your premium, if you are offered one at all, prices in the gap. The cheaper order of operations is to put the controls in place first, which is what our small business cybersecurity checklist walks through.
Why Texas raises the stakes
Insurance offsets cost; it does not remove the legal duty. Under the Texas Identity Theft Enforcement and Protection Act, a business that suffers a breach of sensitive personal information must notify affected Texas residents without unreasonable delay and no later than the 60th day after it determines the breach occurred, and must report the breach to the Texas Attorney General when at least 250 Texas residents are affected. Those deadlines run whether or not you have a policy, so the response plan your insurer wants to see is the same plan Texas law effectively requires you to be able to execute.
HIPAA and PCI change the questionnaire
If you hold health data or take card payments, the stakes climb again. A clinic is bound by the HIPAA Security Rule and its breach notification timelines; a retailer is bound by PCI DSS. Insurers price that exposure, and a weak compliance posture shows up as a higher premium or an exclusion. Our guide to HIPAA and PCI for East Texas clinics and retailers covers what each one demands.
Get ready without buying the wrong thing
The mistake we see most is a business buying a pile of security tools to satisfy a form, then maintaining none of them. Start instead with a risk assessment that maps what you actually run and ranks the gaps by business risk. That tells you which controls the insurer cares about are missing, in what order to close them, and what evidence to keep. The result is a cleaner application, a defensible premium, and a claim that pays when you need it.
Questions
What do cyber insurers require from a small business?
Most applications now ask for multi-factor authentication, tested backups, endpoint detection and response, email filtering and phishing awareness, scheduled patching, and a written incident response plan. The answers affect both your premium and whether a claim is paid, so the controls should be real before you sign.
Does an East Texas business have to report a data breach?
Yes. Under Texas law, a business that suffers a breach of sensitive personal information must notify affected Texas residents no later than the 60th day after it determines the breach occurred, and must report the breach to the Texas Attorney General when at least 250 Texas residents are affected. That duty applies whether or not you carry cyber insurance.
How do we get ready for a cyber insurance application?
Start with a security risk assessment that maps what you run and ranks the gaps by business risk. That shows which required controls are missing and in what order to close them, so the application is accurate and the premium is defensible. Call (903) 376-3747 to begin.