No, cyber insurance is not legally mandatory in Ontario, but it is increasingly required by contract. Larger clients, lenders, and government tenders often insist that vendors carry it, so for many AEC and professional-services firms it has become a practical requirement for winning work.

Yes. MFA is the single most-watched control in underwriting, and its absence is the most common reason claims are denied. Enforcing MFA across all accounts can lower your premium and, more importantly, keep a future claim from being refused.

Antivirus matches known threats against a signature list; endpoint detection and response (EDR) watches behaviour, catches novel attacks, and lets responders isolate and investigate a compromised device. Insurers increasingly treat traditional antivirus as insufficient on its own.

For a typical small business, closing common gaps — MFA, EDR, backup testing, and a written incident response plan — usually takes a few weeks with the right help. Starting 60–90 days out leaves room to fix anything the questionnaire surfaces.

Yes. A good managed IT provider can complete the technical sections accurately, deploy any missing controls, and supply the evidence carriers now request — reducing the chance of an inaccurate answer that voids a claim later.