Your cyber policy renewal is coming up. Your broker sends you a subscription questionnaire: a hundred questions, ten pages, and in the first five, a series of very specific questions about your ERP. Not about your antivirus. Not about your firewall. About your ERP.
That is not a coincidence. Insurers have analysed their claims data and drawn a simple conclusion: in the majority of ransomware incidents and data breaches, the ERP was either the entry point or the system that was paralysed. They have adapted their underwriting accordingly.
This guide presents the 8 ERP controls that cyber insurers systematically check in 2026, what they accept as evidence, and how your security posture affects your premium.
Why Cyber Insurers Are Now Scrutinising Your ERP
ERP as the Primary Ransomware Attack Vector
The ERP is no longer treated as just another application in the IT perimeter. Insurers have reclassified it as critical infrastructure, on a par with Active Directory or backup systems. The reason is straightforward: it concentrates financial data, customer data, HR data, and operational secrets on a single system. Compromising the ERP means paralysing the business.
Ransomware groups — including variants targeting European mid-market organisations in 2025 — have built this logic into their attack playbooks. Manufacturing, financial services, and mid-sized enterprises are their priority targets.
What Insurers Have Learned from Claims
According to data compiled by several brokers and insurers in 2025–2026, 82% of denied claims or claims subject to high deductibles involved organisations that had not deployed MFA on critical access points, including ERP. This figure has structurally reshaped subscription questionnaires.
The Marsh Europe Cyber Claims 2025 report indicates that personal data breaches are present in 73% of European cyber claim notifications. The manufacturing sector accounts for nearly 20% of notifications — precisely the sectors where ERP plays a central role.
The Evolution of Subscription Questionnaires
In 2020, a cyber insurance questionnaire contained between 10 and 15 generic questions. In 2026, it easily runs to 50 to 80 questions for a mid-sized organisation, with a dozen specifically focused on the ERP. Typical questions you will encounter:
- Is MFA enabled on all access to your ERP, including end users and service accounts?
- Do you have a segregation of duties (SoD) report dated within the last 12 months?
- Are your ERP backups tested and isolated from the production network?
- What is your average time to patch critical ERP vulnerabilities?
Analysis of multiple 2026 subscription questionnaires shows that 99% now include specific MFA questions, and a large majority require documented evidence rather than simple declarative attestation.
The Exclusion Clauses That Keep Multiplying
Explicit ERP-related exclusions have become standard in cyber policies renewed in 2025–2026:
- Exclusion for absence of MFA on ERP administrator access.
- Exclusion for ERP unpatched for more than 90 days.
- Exclusion for backups not tested or permanently connected to the network.
- Increased deductible for untracked shared super-user accounts.
These are no longer edge cases. Insurers write them into the special conditions or define them as eligibility criteria for ransomware coverage.
The 8 ERP Controls That Have Become Non-Negotiable
Control 1: MFA and SSO Across All ERP Access Points
MFA is the most scrutinised control. Insurers do not simply ask whether you have MFA in general — they ask whether MFA covers your ERP access, including end users, administrators, and service accounts used by third-party integrations.
What insurers accept as evidence: IAM configuration audit report, screenshot of SSO settings, authentication policy export.
Implementation timeline if absent: 1 to 3 months depending on your ERP’s complexity.
Control 2: Segregation of Duties (SoD) — Audited and Documented
Insurers have learned from internal fraud claims: a user who can both create a vendor and approve a payment represents a direct financial risk. SoD — distributing incompatible rights across multiple individuals — is now verified at the ERP policy level.
What insurers require: SoD report dated within the last 12 months, produced by native tools (SAP GRC Access Control, Odoo access rights module, Oracle IAM) or an independent specialist.
Key risk areas: emergency overrides that were never reversed, generic accounts shared across multiple employees.
Control 3: Privileged Account Management (PAM)
Super-user accounts — DDIC in SAP, SYSADMIN in certain Microsoft ERPs, root access to the ERP database — are priority targets for attackers. Insurers require a documented privileged access management (PAM) plan.
PAM solutions commonly referenced in subscription questionnaires: CyberArk, BeyondTrust, Wallix. Their presence in your declaration is typically noted positively by underwriters.
Minimum acceptable standard: super-user password rotation, session logging, emergency access revocation within 72 hours.
Control 4: Audit Logging and Retention (12-Month Minimum)
The ability to reconstruct an attack after an incident has become an insurable requirement. Without sufficient logs, the insurer cannot establish the scope of the incident, which complicates and delays settlement.
Native modules: SAP Security Audit Log, Oracle Audit Vault and Database Firewall (AVDF), Microsoft 365 Compliance Manager for D365.
What insurers want to see: documented retention policy (minimum 12 months), proof that logs are stored outside the ERP itself (SIEM or immutable storage), proof that logs cannot be modified by a standard ERP user.
NIS2 imposes the same logging requirements. If you fall within NIS2 scope, these two compliance objectives reinforce each other.
Control 5: Encryption of Data at Rest and in Transit
Encryption protects your data in the event of exfiltration: if an attacker steals files but cannot decrypt them, both the business impact and GDPR exposure are reduced. Insurers value this control.
Verification points: TLS 1.2 or 1.3 on all ERP APIs and inter-module connections, encryption of ERP backups, encryption of data exports to third-party systems (BI, WMS, CRM).
For cloud ERPs: verify that encryption is enabled on the cloud provider side and that you control your own keys (BYOK), or that contractual terms confirm encryption activation.
Control 6: Backups — Tested, Documented, and Isolated
This control is frequently underestimated: many organisations have backups but never test them. An insurer who discovers that the last restoration test was two years ago may apply an increased deductible or an explicit ransomware exclusion.
What insurers require in 2026: daily backups of transactional data, at least one offline copy (air-gap or immutable storage), annual restoration test documented with outcome and measured recovery time.
Critical point: backups permanently connected to the production network are now an explicit exclusion factor in some policies, because ransomware can encrypt them simultaneously with primary data.
Control 7: Documented ERP Patch Management
ERP vendors regularly publish security patches. Failing to apply them within a reasonable timeframe exposes you to known, exploitable vulnerabilities. Insurers have integrated this risk into their questionnaires.
Timeline required by some insurers in 2026: critical patches applied within 30 days of publication, high-severity patches within 60 days.
What you must document: your ERP patch management policy, your update frequency, any justified deferrals (regression testing on critical environments) with a planned catch-up timeline.
SAP note: SAP publishes its Security Patch Days on the second Tuesday of each month. The application of critical patches must be tracked and documented to satisfy underwriting requirements.
Control 8: Documented and Tested Incident Response Plan
An incident response plan (IRP) that exists on paper but has never been tested carries limited weight with insurers. The 2025–2026 trend is to require evidence of an annual simulation exercise including an ERP scenario.
What insurers require: documented IRP with escalation paths and notification timelines (GDPR: 72 hours to the authority, NIS2: 24-hour initial notification), evidence of a tabletop exercise with a “ransomware on ERP” scenario within the last 12 months.
Practical note: the ERP scenario must include the decision to switch to degraded mode (paper invoicing, manual data entry), vendor emergency support contacts, and the escalation process to executive leadership.
Readiness Audit: How to Assess Your ERP Posture Before Renewal
Before responding to the subscription questionnaire, an internal pre-audit of 2 to 4 weeks allows you to identify gaps and either correct them or document them.
Native tools by vendor:
- SAP: Security Audit Log, SAP Solution Manager with Configuration Validation view, USOBHAU report for rights.
- Oracle: Audit Vault and Database Firewall (AVDF), Oracle Identity Governance.
- Microsoft D365: Microsoft Secure Score (for Azure/Microsoft 365 environments), Compliance Manager.
- Odoo: rights module with group and profile report, access logs in technical settings.
When to engage an external assessor:
If your native tools are not sufficient to produce a readable and exportable SoD report, or if you do not have a formalised PAM policy, a specialist provider (ERP penetration test, IAM audit) can produce the evidence elements that underwriters will request. The cost of such an audit (typically £5,000 to £15,000 for a mid-sized organisation) is often lower than the premium surcharge applied for an undocumented posture.
Premium Impact: 2026 Market Data
Figures drawn from broker and specialist insurer publications provide a consistent range:
- MFA deployed and documented: estimated premium reduction of 15% to 22% depending on the market.
- Tested immutable backups: additional reduction of 5% to 10%.
- Audited PAM and SoD: further variable reduction.
- Complete documented posture (MFA + EDR + backups + IRP + PAM + patch management): total observed reduction of 20% to 40% compared to an equivalent profile without documentation.
Conversely, organisations without MFA on the ERP see their premium increase by 15% to 40% at renewal, or are offered coverage with explicit ransomware exclusions.
The deductible is another lever: some insurers do not refuse coverage outright but double or triple the deductible for organisations with an insufficient ERP posture. For a median ransomware incident (5-day outage for an organisation of 300 employees, representing £50,000 to £200,000 in business interruption losses), an increased deductible translates directly into a significant uncovered charge.
Cyber insurance carriers active in the European market in 2026 (non-exhaustive list, no endorsement): AXA XL, Chubb, Hiscox, Beazley, Coalition, Zurich. Each has its own questionnaire, but the 8 controls described in this article appear in the vast majority of them.
Further Reading
For deeper coverage of ERP security controls and their relationship to current regulations, these related articles address adjacent topics:
- Zero Trust, IAM, PAM and MFA for ERP: The CIO Security Guide 2026 for a detailed look at secure access architectures.
- NIS2 and ERP: Evidence Checklist for the 2026 Cybersecurity Audit to align NIS2 compliance with your insurer’s requirements.
- ERP and Operational Risk Management: ERM, DORA, NIS2 for the broader digital risk management framework.
