K-12 cyber insurance requirements: the questions to expect at renewal
Published September 4, 2026
Cyber insurance renewal used to be a checkbox exercise. It is now a questionnaire that asks for measurements, and the answers shape whether coverage is offered and on what terms. This article lists the questions a district should expect, explains what each one is really asking, and describes what a defensible answer looks like.
A note on what this article does not do: it does not predict premiums, name carriers, or promise that any answer secures coverage. Underwriting decisions belong to the carrier. What a district controls is the quality of its answers and the evidence behind them.
Identity and access
Multi-factor authentication. Expect to be asked for coverage three ways: all staff, administrators, and remote access. "Yes, we have MFA" is no longer an answer. A percentage for each group, with the date of the export it came from, is.
Administrator access. Who holds administrator or elevated rights in each system, when the list was last reviewed, and who signed off. A quarterly review with a named reviewer is the practice most questionnaires are looking for.
Local administrator rights. Whether everyday staff accounts can install software or change settings on their own devices, and what the exceptions are. A report from the device management console answers this in one export.
Endpoints and patching
Endpoint detection and response. EDR is the software that watches a device for malicious activity and reports back. The question is what share of district devices run it and which ones do not. Coverage as a fraction of the device inventory is the number to have.
Patching. How current devices and servers are on security updates and what the district's target window is. A dated compliance summary from the management tool is the evidence.
End of support software and equipment. Anything still in use past the date its maker stopped issuing security updates, and the plan for each item. A short table beats a paragraph.
Backups and recovery
This section usually gets the most scrutiny, because a district that can restore itself is a smaller loss.
- How often backups run and what they cover.
- Whether a copy exists that everyday accounts cannot change or delete, and where it is kept.
- When a restore was last tested, and what the result was. The date and the outcome, not the intention.
- The district's own estimate of how long it would take to bring key systems back.
The last tested restore is the single most useful record a district can hold. Testing means restoring real files or a real system, not checking that the backup job finished.
Training and phishing
Training completion. What share of account holders completed security awareness training, over what period. The export from the training platform is the evidence.
Phishing tests. The click rate in the most recent test and the direction compared with the one before. Two dated results tell a story; one does not.
Incident response
Whether a written incident response plan exists, when it was last reviewed, and when it was last practiced. Practice here means a tabletop exercise: a talk-through of an incident with the people who would be in the room, with the date and the roles of the participants recorded.
Email authentication
The district's published DMARC setting for its email domain: none, quarantine, or reject. DMARC is the rule that tells other mail systems what to do with messages that falsely claim to come from the district. The setting can be checked in minutes and recorded with the date.
What a good renewal pack looks like
For each question above: the answer as recorded, the date it reflects, and a pointer to the evidence behind it. Assembled in that order, the pack can be transcribed into any carrier's or broker's form without hunting. Kept from year to year, it also shows what changed, which is the conversation a district wants to be having at renewal.
Where DistrictReady fits
DistrictReady's insurance renewal pack is built in exactly this shape: one row per question, the answer as the district recorded it, the date, and the evidence index behind it. Anything the district has not recorded prints as "Not recorded" rather than a guess. It does not state that a district is insurable or predict any premium. It makes the answers ready.