Cyber Insurance Requirements in Illinois: What Underwriters Ask For in 2026

There is no Illinois statute that tells a business which security controls it must have to buy cyber insurance. The requirements come from the insurers, and they have hardened considerably since the ransomware losses of 2020 and 2021. What Illinois does have is a set of state laws that shape what a breach costs you, which in turn shapes what underwriters ask. This article covers both: the controls carriers now expect from a small or mid-sized Illinois business, and the Illinois-specific exposures your policy needs to cover.

What underwriters ask for in 2026

Cyber applications have moved from a few yes/no questions to detailed attestations, and carriers verify them after a claim. These are the controls that appear on nearly every application for a business with 10 to 200 employees. Missing one typically means a higher premium, an exclusion, or a declined application.

The common failure is answering “yes” to describe what the business intends rather than what it has. After a claim, the carrier’s forensic team checks. If MFA was not actually on the account that was breached, the claim can be reduced or denied. A conservative answer and a plan to fix the gap is better than an optimistic one. The underwriter questions are covered in more depth in what cyber insurance underwriters actually ask for, which our technical reviewer has vetted.

The Illinois laws that shape your exposure

These do not tell you how to secure your business, but they determine what an incident costs, and underwriters price Illinois risk accordingly.

• Personal Information Protection Act (815 ILCS 530). Illinois’s breach notification law. A business that exposes Illinois residents’ personal information (Social Security numbers, driver’s license numbers, account numbers with access codes, medical and health insurance information, biometric data, and online credentials) must notify affected residents in the most expedient time possible and without unreasonable delay. If more than 500 Illinois residents are affected, the Attorney General must be notified as well. The Act also requires businesses to maintain reasonable security measures and to dispose of personal information securely.
• Biometric Information Privacy Act (740 ILCS 14). If your business collects fingerprints, face scans, or similar identifiers, including for time clocks, BIPA requires written consent, a published retention policy, and secure storage, and it allows individuals to sue. BIPA claims are a distinct category on Illinois cyber applications; expect specific questions if you use biometric timekeeping.
• Industry rules that apply regardless of state. HIPAA for medical and dental practices, the FTC Safeguards Rule for accounting and tax firms, PCI DSS for anyone taking cards, and CMMC for defense subcontractors. Carriers ask about these because a regulatory fine is a covered loss on many policies.

What the policy should cover

Read the policy for these items, and ask the broker directly about any that are missing or sub-limited.

• Breach response costs: forensics, legal counsel, notification, and credit monitoring. Illinois notification obligations make this the first money out the door.
• Business interruption: lost income during downtime, with a waiting period measured in hours, not days.
• Ransomware and extortion: including the cost of recovery whether or not a ransom is paid.
• Funds transfer and social engineering fraud: often sub-limited to a small amount. If you make large payments, this is the limit to negotiate.
• Regulatory defense and penalties: including BIPA claims if you use biometrics.
• Dependent business interruption: losses when a vendor or cloud provider you depend on goes down.

Getting the controls in place before renewal

Most businesses find out about a gap when the renewal application arrives. The practical sequence, which a managed IT provider should run for you, is: MFA everywhere first, since it is fast and closes the most common entry point; endpoint detection and response with 24/7 monitoring; backups made immutable and a restore tested and dated; email filtering plus a written payment verification rule; then documentation, training records, and an incident response plan you can hand to the broker. Ninety days is enough for a business starting from a reasonable baseline. The same controls are what you would want even without insurance, so the work is not wasted if your premium does not move.

How Corporate Technologies helps Illinois businesses

We support businesses across Illinois from our Chicago office, with a 24/7 help desk and security operations center shared across our 21 locations. Our Secure Advantage package maps to the application controls above: 24/7 SOC monitoring, next-generation antivirus with endpoint detection and response, multi-factor authentication, spam filtering, security awareness training, CEO fraud protection, website restrictions, and application and storage control. We also help clients complete the application accurately and gather the evidence a carrier may ask for. If you want to see where you stand first, the network health check takes about three minutes. For the Maryland version of this topic, see cyber insurance IT requirements in Maryland.

This article is general information, not legal or insurance advice. Policy terms vary by carrier; read yours and ask your broker.

Frequently asked questions

Will meeting these controls lower our premium?

Usually it affects whether you can get coverage and on what terms more than the headline price. Carriers tier applicants by controls; missing MFA or EDR can mean a decline or a ransomware exclusion. Meeting the baseline moves you into the standard market.

Should we answer “yes” if we are in the middle of rolling out MFA?

No. Answer accurately and give the completion date. An inaccurate attestation is grounds to contest a claim. Brokers would rather see an honest partial answer and a plan.

We are small. Does BIPA really apply to us?

If you collect biometric identifiers from anyone in Illinois, yes, regardless of size. Fingerprint time clocks are the common trigger. Written consent and a retention policy are required before collection begins.

What is the single most important control?

Multi-factor authentication on every account, because stolen credentials are the entry point for most incidents and underwriters treat its absence as disqualifying. Immutable, tested backups are a close second because they determine whether a ransomware event is a bad week or a closure.