The short answer: A documented security program changes the terms of a cyber insurance renewal more than the price. It changes which answers you can prove. It gives you standing on limits, retentions and exclusions. And it changes how the underwriting conversation runs. Price mostly follows the market: Marsh reports US cyber rates fell 2% in the second quarter of 2026.
Written for nonprofit executive directors and CEOs who sign the cyber insurance application: it covers the security evidence, while coverage and pricing stay with your broker.
Only 25% of Washington nonprofits require multifactor authentication for every employee and volunteer. That’s from UC Berkeley’s CyberCAN Washington study of 100 organizations, published in April 2026 (UC Berkeley CLTC, 2026). Another 22% didn’t know whether they carried cyber insurance at all. The survey covers one state, but the renewal form it describes is national. It asks about MFA, backups and response plans. Someone fills it in, and the executive director signs.
That signature is easy to treat as a formality. The carrier reads every answer as a statement of fact, and a yes backed by a dated record looks exactly like a yes given from memory. The difference shows up later, usually at the worst possible moment.
This guide covers what documentation actually changes and how to bring evidence to your broker. It then sorts the terms documentation can move from the ones it can’t, sets out when to start, and names the numbers that show whether it paid off. It draws on regulator, insurer and broker research.
What Actually Changes When Your Controls Are Documented?
Documentation changes what you can prove, not what the market charges. The National Association of Insurance Commissioners reports that US cyber premiums fell about 7% in 2024 to roughly $9.14 billion, while claims reported by US-based insurers rose almost 40% to nearly 50,000. More claims are a reason to expect closer reading of each file.
The same report says it plainly: companies kept investing in cybersecurity controls, and underwriters look on that favorably (NAIC, 2025). Favorably is not a discount. It is a better conversation, and the conversation is where terms get set.
The second change is legal rather than commercial. Every answer on the application is a representation. In 2022, Travelers asked a federal court in Illinois to void a cyber policy. Its insured had attested to using MFA for privileged access, and the insurer alleged MFA protected only the firewall (Insurance Journal, July 2022). Weeks later the two sides stipulated that the policy was void from its inception, with no coverage for any claim (Insurance Journal, August 2022). That case involved a manufacturer, not a nonprofit. The lesson travels anyway.
A documented program turns each yes into a yes with an owner, a date and a record behind it. If your board still sees the questionnaire as paperwork, our earlier piece on the controls audit explains why underwriters stopped treating it that way.
How Do You Bring Evidence to the Broker Conversation?
Bring three things to your broker before the application is due. First, a map tying each answer to a system and an owner. Second, dated proof for the controls carriers weigh most. Third, known gaps with fix dates. Marsh says carriers view 12 hygiene controls as essential.
Most nonprofits have some of this already. It just lives in three inboxes and a vendor’s ticketing system. The work is assembling it in one place, in the order the application asks for it. For the contents of that file, see what to document.
1. Map every answer to a system and an owner
The detail most organizations miss is scope. The question is rarely whether MFA exists; it’s where. A yes that holds for email but not for remote access or administrator accounts is the exact gap in the Travelers case. Write down which systems each answer covers, who owns that control, and where the proof sits.
2. Date the proof for the controls carriers weigh most
Marsh McLennan’s Cyber Risk Intelligence Center found that organizations running tabletop exercises were 13% less likely to have a material cyber event. Phishing-resistant MFA carried a 9% lower breach likelihood than other MFA (Marsh McLennan, 2025). Each 25% increase in endpoint detection coverage was correlated with a further 10% drop. These are correlations from a broker’s client data, not guarantees. They still show where an underwriter’s attention goes, so put a date on each one.
3. Name the gaps before the carrier does
Every program has gaps, and the useful move is listing them first, each with an owner and a fix date. In UC Berkeley’s Washington study, 55% of nonprofits had no incident response plan and four in ten lacked separate, secure backups. A gap with a plan gives your broker something to say. C4’s Board-Ready Security Report is built in this shape: a risk register with owners and priorities, plus a 12-month remediation roadmap.
Open last year’s renewal application and find the MFA question. Your IT lead should be able to show which accounts it covers within a day. If nobody can, your signature is vouching for a guess. Want a second set of eyes? Let’s talk it through
Terms Move Before Price: Limits, Retentions and Exclusions
Price moves with the market; terms are where evidence gets a hearing. Marsh’s Global Insurance Market Index shows cyber rates fell 4% globally in the second quarter of 2026, the twelfth straight quarterly decline, and 2% in the US. In a softening market, documentation lets you ask for more than a smaller bill.
Some buyers already use a soft market this way. Among Marsh’s US clients at the end of 2024, 20% increased their limits and 18% reduced their self-insured retentions, while rates fell 5% on average (Marsh, 2025). Marsh doesn’t say documentation drove those changes. It shows what buyers asked for when the market gave them room.
The table below sorts the main renewal terms by how much documentation can influence each one.
| Renewal term | What documentation gives you standing on | What it can’t promise |
| Application answers | Answers you can prove, line by line | That every control is in place |
| Limit | A case for more coverage | The limit a carrier will write |
| Retention | A reason to ask for a lower one | Any change to it |
| Exclusions and sublimits | A specific ask to narrow one | Wording the carrier won’t change |
| Premium | Context for your broker’s negotiation | A lower price in a firm market |
| A future claim | A record that answers matched reality | Payment of any particular claim |
Why does evidence reach terms more than price? Rates move across the market, as Marsh’s index shows. Limits, retentions and exclusions are negotiated one policy at a time, which is where your file actually gets read.
The play most nonprofits miss sits in the fine print. Check whether social engineering losses carry their own sublimit, separate from the headline limit. Coalition, an insurer reporting on its own policyholders, found business email compromise and funds transfer fraud made up 58% of its 2025 claims. Of the transfer fraud claims, 71% came from social engineering (Coalition, 2026). The FBI logged 24,768 business email compromise complaints in 2025, with adjusted losses above $3 billion (FBI IC3, 2026). Documented payment-verification steps support the ask. Your likeliest loss deserves your attention first.
Documentation also has limits worth naming. It can’t change the market, your claims history or a carrier’s appetite for nonprofits. And it can’t make a missing control exist. Finding a gap is not the deliverable, as our piece on why assessment isn’t the deliverable argues; fixing it is.
Three Moments to Start the Evidence File
Start the evidence file at three moments rather than one: well before renewal, whenever a control changes, and at each board meeting. In UC Berkeley’s Washington study, 64% of nonprofits had no full-time IT staff. When knowledge sits with a vendor or a volunteer, the file has to be kept current by habit.
About four months before renewal. This is a working rule, not an industry standard. Ask your broker for this year’s application early, map each answer to its proof, and list the gaps you can close before the deadline.
Whenever a control changes. A new email platform, a new managed service provider or a retired backup tool can quietly turn last year’s yes into a no. Update the map the same week the change goes live.
At every board meeting. Give the board one line on evidence status: answers proven, gaps open, fixes due. The Cybersecurity and Infrastructure Security Agency’s performance goals also call for a single leader who is accountable for cybersecurity (CISA).
Automate the reminders, never the review. A calendar can tell you the file is due; a person has to look at the proof and confirm it still matches the answer. The stakes run beyond nonprofits. Verizon’s 2026 Data Breach Investigations Report, covering all sectors, found 31% of breaches started with a software vulnerability and 48% involved ransomware (Verizon, 2026). Patch dates belong in the file too.
Who would answer an underwriter’s follow-up question tomorrow? It should be one named person with the evidence file open. If it’s a vendor nobody has called this year, those answers aren’t really yours. Not sure where the file stands? Compare notes with us
Three Numbers That Show Next Year’s Renewal Went Better
Three numbers show whether documentation paid off. Track the share of answers backed by a dated record, the count of underwriter follow-up questions, and the terms you asked for against the terms you got. Aim for proof behind every answer, and record this year’s numbers before the work starts.
Without a baseline, next year’s numbers describe effort, not improvement.
Proof coverage. Count the application answers you could back with a dated record this year, then again next year. The target is all of them.
Follow-up questions. Count the questions the underwriter sent back after the application went in. As a working rule, fewer questions means the file did its job.
Asked versus got. List what your broker requested on limits, retentions and sublimits, and what came back. Keep the list for the next cycle.
Read them together. If proof coverage rose but follow-up questions didn’t fall, the evidence isn’t reaching the underwriter, so send it with the application rather than on request. If questions fell but terms didn’t move, the limit is the market or the carrier’s appetite, and that’s a conversation for your broker. When proof coverage stalls, it usually means a control has no owner, which is the kind of gap C4’s IT consulting team works on alongside your staff.
Frequently Asked Questions
Documentation Buys Standing, Not a Discount
Claims rose almost 40% in a single year while US premiums fell about 7%, by the regulator’s count. That pairing is a reason to expect closer reading of files as prices soften. The nonprofits that do best at renewal treat the application as a summary of a program they can show, not a form they fill in once a year.
The policy terms are your broker’s to negotiate and the carrier’s to set. The controls, and the proof behind them, are where C4 Technical Services works. We document what’s in place, help fix the gaps that matter most, and put it in a form a board and a broker can both read. To see that format first, request the report or ask our cybersecurity consultants what your file is missing.
References
“CyberCAN Washington: A Regional Assessment of Nonprofit Cybersecurity.” UC Berkeley Center for Long-Term Cybersecurity. Published April 17, 2026. Verified live October 12, 2026.
“Report on the Cybersecurity Insurance Market.” National Association of Insurance Commissioners. Published November 10, 2025. Verified live October 12, 2026.
“Travelers Wants Out of Contract With Insured That Allegedly Misrepresented MFA Use.” Insurance Journal. Published July 12, 2022 (cited as a historic case). Verified live October 12, 2026.
“Travelers, Policyholder Agree to Void Current Cyber Policy.” Insurance Journal. Published August 30, 2022 (cited as a historic case). Verified live October 12, 2026.
“Cybersecurity Signals: Connecting Controls and Incident Outcomes.” Marsh McLennan Cyber Risk Intelligence Center. Published August 27, 2025. Verified live October 12, 2026.
“Global Commercial Insurance Rates Fall 6% in Q2 2026.” Marsh. Published July 23, 2026. Verified live October 12, 2026.
“US Cyber Insurance Market Update: Rates Decrease, Threats Evolve.” Marsh. Published May 22, 2025. Verified live October 12, 2026.
“2026 Cyber Claims Report.” Coalition. Published 2026 (claims from January 1 to December 31, 2025). Verified live October 12, 2026.
“2025 Internet Crime Report.” FBI Internet Crime Complaint Center. Published April 9, 2026. Verified live October 12, 2026.
“Cross-Sector Cybersecurity Performance Goals.” Cybersecurity and Infrastructure Security Agency. Published undated. Verified live October 12, 2026.
“2026 Data Breach Investigations Report.” Verizon Business. Published May 19, 2026. Verified live October 12, 2026.
