A Guide for Dealership CFOs
Cyber Insurance Requirements for Car Dealerships: The Controls Underwriters Ask About
Somewhere in the renewal packet is a page of questions about MFA, backups and endpoint protection, and whoever signs it vouches for every answer on behalf of every store on the policy.
Or go straight to the ten-control checklist.
Cyber insurance requirements for a car dealership are the security controls the carrier’s application asks about, most often MFA, endpoint detection and response, tested backups, patching, email filtering, training, privileged access, an incident response plan and vendor access.
Last updated: November 5, 2026
For a lot of dealership CFOs, cybersecurity arrives once a year, with the renewal application.
The problem our team keeps running into is that these forms get answered from memory. Somebody is pretty sure MFA is on everything, nobody checks what’s actually installed, and the form goes back signed. Pretty sure isn’t a yes.
Those answers don’t stay on the form, either. On the AXIS form, for one, the application becomes part of the policy, and if a store ever files a claim, the carrier can check those answers against the network. Below we go through what the applications ask one control at a time, what each control looks like at a rooftop and what proof to keep, drawing on the work behind our dealership cybersecurity services.
If you take one thing from this page, make it this. Nobody signs until the IT lead has shown the proof.
Why Every Cyber Insurance Answer Has to Match What’s Installed
These questionnaires keep getting longer, and they’re written to protect the carrier, which is fair enough until a store files a claim. That’s when the carrier can send people in to check the application against the network, and when the controls a dealership said it had just aren’t there, the carrier can contest the claim. Missing controls can cost a dealership the policy before any claim, too. As Erik Nachbahr, our founder, puts it, “We’ve had clients come to us in the past because they were denied cyber liability insurance because they didn’t have things they needed.”
Honesty has its own cost, and we’ve watched that happen too, when an in-house IT person filled out the form truthfully and the self-report looked bad enough that ownership rethought who runs IT. But the failure we run into far more often is simpler. Nobody wants to be the person who writes no. After the Travelers case, the broker Lockton said organizations need to “accurately convey the current status of their controls” on the application.
A true no beats a false yes.
Travelers v. ICS, 2022
The application said MFA protected administrative and privileged access. After a ransomware attack, Travelers alleged it protected only the firewall, and the insurer sued. Both sides then agreed by joint stipulation to void the policy from its start.
The whole dispute was over control 1.
A client that answered no
One client of ours couldn’t honestly tell the carrier a control was in place 100% of the time. Our advice was to check no and use the comments to explain why nobody can promise 100%, and they still got coverage.
Explain the no. Don’t hide it.
Who’s Behind This Guide
Helion Technologies has worked only with automotive and heavy truck dealerships since 1997, and several of these controls also come up in our compliance work under the FTC Safeguards Rule, covered further down.
The checklist
The Cyber Insurance Requirements Checklist for Dealerships
No two carriers word these forms the same way, so treat these questions as the common ground rather than a copy of yours. They’re drawn from the broker Marsh’s twelve key controls, the ransomware supplements that AXIS and Admiral post on their own sites, and a Tokio Marine HCC cyber application written for medical practices, which asks some of the same questions.
Where Helion fits
We’re not an insurance agency, and we’d never tell you a premium will drop. What we can do is sit with your team, work out what each question is really after and check it against what your stores run, and a complimentary IT and cybersecurity assessment shows which of these controls are missing.
Ten controls carriers ask about Each numbered line is a question you’ll likely see in some form. The side note is the proof worth keeping on file.
1 Multifactor authentication
- 1.1 Is MFA required for email, including Microsoft 365 webmail?
- 1.2 Is it required for all remote access, such as VPN, remote desktop and remote management tools, for staff and for vendors?
- 1.3 Do administrator and privileged accounts need it too?
Ask IT for proof from the Microsoft 365 admin side that MFA is enforced for every user, not just a list of who has registered a phone. Then list every way into the network from outside. Yes, that includes the F&I manager working deals from home on a Saturday night.
2 Endpoint detection and response
- 2.1 Is EDR deployed on your workstations and servers? AXIS asks for the percentage of each.
- 2.2 Is somebody watching its alerts and acting on them?
One Tokio Marine HCC application asks whether EDR is deployed and monitored “on 100% of workstations and servers.” That’s a hard number to hit. One parts counter PC that got skipped in the last refresh is enough to make the honest answer no.
3 Backups
- 3.1 Are backups kept offline or immutable, so ransomware can’t reach them?
- 3.2 Do they need separate credentials or MFA to get into?
- 3.3 How often do you test a full restore, and how long would recovery take?
Honestly, the nightly success email doesn’t mean much on its own. Ask IT to restore something from last week while you wait, then put that date and the time it took on file, which is what backup and disaster recovery ought to give you.
4 Patching and end-of-life systems
- 4.1 How fast are critical patches applied? Some forms offer tiers from under 24 hours to over seven days.
- 4.2 Does anything still run on software or hardware the maker no longer supports?
Windows 10 support ended on October 14, 2025, so any PC still on it without Extended Security Updates belongs on this list, along with any firewall the maker no longer patches. Write each one down with a replacement date.
5 Email filtering
- 5.1 Is inbound mail filtered, and are suspicious attachments opened in a sandbox first?
- 5.2 Are SPF, DKIM and DMARC set up for your domain?
- 5.3 Is mail from outside the company tagged as external?
Marsh calls email phishing one of the top ways attackers get in, especially in ransomware attacks, which is why carriers care, and why email security at a store has to cover all three of these settings.
6 Security awareness training
- 6.1 Does every employee get training at least once a year?
- 6.2 Do you run phishing simulations, and do you know the click rate?
Records, by name. Porters and lot attendants with an email account count, and so do your last few phishing test results.
7 Privileged access
Erik Nachbahr, our founder, describes how admin rights pile up at stores. “Historically, they’ve always copied employees, rather than having templates set for their role, and that’s how people get permissions they shouldn’t have.” The application wants to know how you keep that in check.
- 7.1 Are local admin rights removed from everyday users?
- 7.2 How are administrator accounts secured, and who holds them?
One page. Every admin account, who owns it and when somebody last reviewed it.
8 Incident response plan
- 8.1 Is there a written plan, including how the business keeps running during a ransomware attack?
- 8.2 Has it been tested or walked through?
No plan yet? Start from the incident response plan template, then write the date of your last tabletop walk-through right on the front page.
9 Vendor access
- 9.1 Do vendors and contractors need MFA to connect?
- 9.2 Who are your most critical vendors, and what services do they provide?
As Erik puts it, “dealers have historically never known where their data is going, and it’s still like that today.” If you’ve filled in the vendor inventory worksheet, its vendor list answers 9.2, and its data access section shows what each vendor can reach.
10 Logging and monitoring
- 10.1 Are security logs collected, and does a security operations center watch them?
- 10.2 Is the network segmented, so one infected PC can’t reach everything?
Marsh puts logging and monitoring on its list of twelve. One way to cover 2.2 and 10.1 together is managed detection and response.
What to Do When a Control Is Missing Before You Sign
-
1
Check last year’s answers
Pull last year’s application and go down it line by line with your IT lead.
-
2
Answer no where it’s no
Every no gets an explanation. Admiral’s form even asks for one.
-
3
Close the quick gaps first
Turning on MFA for admin accounts or running a test restore can often happen before the bind date. Bigger projects get a dated plan.
-
4
Keep the evidence file
Put the reports behind every yes in one folder. And if something changes before the policy starts, tell your broker.
Safeguards overlap
How Cyber Insurance Requirements Line Up With the FTC Safeguards Rule
If you’ve been through an FTC Safeguards Rule review, more than half of this list will look familiar, because the rule already requires several of the same controls of covered dealerships. Keep the evidence once and it’ll usually serve both. Here’s where they meet in 16 CFR 314.4.
| Control | What applications ask | Where the Safeguards Rule covers it |
|---|---|---|
| 1 Multifactor authentication | Email, remote access and admin accounts. | 314.4(c)(5) requires MFA for anyone accessing an information system, unless the Qualified Individual approves an equivalent in writing. |
| 4 Patching | How fast critical patches go on, and what’s past end of life. | Closest match: 314.4(d)(2) calls for a yearly penetration test and vulnerability assessments at least every six months, unless systems are monitored continuously. |
| 6 Training | Yearly training and phishing simulations. | 314.4(e) requires security awareness training for staff. |
| 8 Incident response plan | A written plan, including ransomware. | 314.4(h) requires a written incident response plan. |
| 9 Vendor access | MFA for vendors, and your critical vendors. | 314.4(f) requires overseeing service providers, including periodic assessment. |
| 10 Logging and monitoring | Log collection and who watches it. | 314.4(c)(8) requires monitoring and logging of authorized users’ activity. |
Backups and EDR aren’t named in the rule, but carriers ask about both. Our FTC Safeguards Rule checklist covers the rest of the program, and CISA’s own MFA guidance explains what control 1 protects against.
Common Questions
Renewal coming up?
Bring the application to a complimentary IT and cybersecurity assessment and we’ll go through the answers with you. If you’d rather see a number first, you can also get a price quote.
What happens if an answer on the application turns out to be wrong?
Should we answer no if a control isn’t fully in place?
What do cyber insurers require from a car dealership?
Can a dealership get cyber insurance without MFA?
Who at the dealership should fill out the application?
Do cyber insurance requirements match the FTC Safeguards Rule?
Can Helion lower our premium?
Before the next renewal, find out which of these ten controls your stores can prove today.
Get Your Complimentary IT & Cybersecurity Assessment →