Healthcare organizations paid 50% higher insurance premiums than the market average in 2023 and 2024.¹ With the highest per-breach average cost of any industry at $7.42 million in 2025, the healthcare sector is considered high risk. ² If you’re the healthcare executive who inherited cybersecurity responsibilities on top of your job, you’ve been saddled with understanding cyber insurance premiums and all the factors that go into the quote you’ll get from a provider.

After 30 years of helping healthcare organizations get the best cyber insurance premiums, we can tell you that the biggest mistake Accidental CISOs make is not prioritizing security fundamentals. You’d be surprised how the basics truly get you a better premium. Here are the ones you need to implement today before shopping for insurance:

The Fundamentals That Move Your Premium

Insurers offer a price based on your specific control set, and five items should be at the top of your list:

1. Phishing-resistant MFA

Most insurance carriers now require multi-factor authentication (MFA) on all remote access and privileged accounts before they even give you a quote. You need to set up and enforce MFA on more than just email. Make sure to include admin accounts, VPN, and backup systems. Underwriters want to see hardware keys and FIDO2.

2. EDR and MDR

Endpoint detection and response (EDR) and managed detection and response (MDR) are essential across every device. If you have basic antivirus, that’s not going to cut it. Legacy systems are where healthcare organizations get caught without this fundamental, and there’s a reason it raises a red flag to an insurer. Cybercriminals target legacy systems because they know the protection gap persists.

3. A Tested Incident Response Plan

Insurers want proof of a tabletop exercise run within the last year at least, and don’t forget to include a documented after-action report. It’s important to have more than just a plan sitting in a drawer to demonstrate to insurers that your team is prepared in the event of a breach.

4. Patch Management on a Schedule

Establish a cadence for patching, and make sure to document what patches were made and when. You don’t need to have the most mature patching program, but insurers want to see a defined timeline for addressing vulnerabilities. It’s also a good idea to implement least-privileged access.

5. Restorable, Immutable Backups

An immutable backup is a backup that “cannot be modified, deleted, or encrypted for a defined period.”³ Insurers now expect organizations to have immutable, offline-capable backups because ransomware groups increasingly target backups before they trigger encryption. You’ll also need a documented, tested restore.

Checking These 5 Boxes Is Easier Than You Think

While insurers will still make you fill out a questionnaire, they’re doing more these days by requiring proof of the above. The good news is that by implementing these five fundamentals, you’re also shoring up your security posture in measurable ways. If you’re beginning to put together any security program today, these elements are the place to start.

There’s more good news: none of these five controls require an enterprise security budget. They just require a diligent expert to oversee their integration into your environment and their success therein.

GuideIT has decades of experience helping healthcare organizations quickly establish security fundamentals with cyber insurance in mind. We recently helped a senior living organization meet a set of requirements issued by a cyber insurer so they could maintain coverage. Read that story here.

The key to getting a decent premium isn’t having the biggest budget or even a dedicated in-house CISO; it’s simply prioritizing these non-negotiables and creating the documentation to prove they work. Our security leaders would be happy to speak with you about the right next steps for your organization. Get in touch with them here or learn more about our security partnership.

• ¹ https://comparecheapssl.com/cyber-insurance-statistics
• ² https://www.hipaajournal.com/average-cost-of-a-healthcare-data-breach-2025/
• ³ https://www.veeam.com/blog/immutable-backup.html