Preparing for cyber insurance renewal in Georgia

What does cyber insurance renewal preparation involve?

Preparing for cyber insurance renewal means documenting, with evidence, the security controls your district actually runs before the application is due. Underwriters commonly ask about multi-factor authentication, endpoint detection, backups, patching, privileged access, training, incident response and vendors. Start about 90 days out, involve your broker or pool administrator, and answer accurately. The policy terms, not the questionnaire, control what is covered.

The market has asked more of public schools for several years. The U.S. Government Accountability Office reported that insurers reduced coverage limits for some sectors, including education, that underwriting capacity contracted for education and public-sector entities, and that underwriters were scrutinizing applicants more carefully [1]. The useful news is that the controls underwriters ask about are the same ones that shorten outages and protect student data, so renewal work doubles as risk reduction.

This week: find your policy's expiration date, the name of your broker or pool contact, and a copy of last year's application.

What underwriters commonly ask about

Every carrier and risk pool writes its own application, so wording and thresholds differ. A State of Indiana cyber insurance toolkit lists typical underwriting question areas, including MFA for privileged access and web email, endpoint detection and response, patching, security awareness training with phishing simulations, response planning, vendor management, and backups with MFA on the backup environment and restore testing [2]. K12 SIX notes that its essential protections for districts address threats identified by sources that include school insurance carriers [3], and CISA's K-12 report names MFA, fixing known exploited vulnerabilities, tested backups, exercised incident response plans and training as the first investments to make [4].

This week: compare last year's application with this table and mark each answer as confirmed, partial or unknown.

Build an evidence pack, not a stack of answers

An evidence pack is a short, dated folder that supports each answer on the application. It protects the district in two ways: answers are accurate when submitted, and the district can show what was true on that date if a question arises later. Treat the application as a formal statement by the district. If a control is partial, say so, describe the scope, and note the plan and date to close the gap.

• One named owner for each answer, usually the technology director for control facts
• Date-stamped screenshots or exports, with counts shown as numbers and denominators (for example, 412 of 430 staff enrolled in MFA)
• A written list of exceptions, such as legacy systems, with compensating controls
• The most recent restore test and tabletop records
• Current incident response plan, with carrier notice steps added after binding
• A one-page summary for the business official and superintendent

In the K12 Cyber Forward portal, the insurance readiness question set links common application topics to rubric context, and the evidence locker keeps supporting files with human review. Answers stay with your district; nothing is sent to a carrier or pool.

This week: create the folder and assign an owner to each row of the table above.

A 90/60/30-day renewal timeline

1. 120 days out. Confirm the renewal date, application format and submission deadline with your broker, agent or pool administrator. Ask whether questions have changed from last year.
2. 90 days out. Hold a joint kickoff between the business office and technology office. Walk through last year's answers and list gaps, unknowns and quick wins.
3. 60 days out. Collect evidence, close quick wins such as enforcing MFA on remaining administrator accounts, and brief the superintendent on any material gaps.
4. 30 days out. Draft answers, have the technology director verify every control statement, and send the draft to the broker. Route questions about exclusions, retentions or notice duties to your risk manager and board attorney.
5. After binding. File the final policy and application together. Add the carrier's claim-reporting steps, hotline and any required vendor panel to the incident response plan.

This week: put the 90, 60 and 30-day dates on both the business and technology calendars.

Georgia items to line up alongside renewal

House Bill 156 (2021) added O.C.G.A. § 38-3-22.2, which defines "agency" to include every school district. It requires agencies to report cyber attack incidents, data breaches or identified malware that meet thresholds set by the director of the Georgia Emergency Management and Homeland Security Agency (GEMA/HS). Where an incident is reported to the federal government, the duty is met if substantially the same information goes to GEMA/HS within two hours. Reports and records produced under the section are exempt from Georgia's Open Records Act, and the law does not relieve other duties to notify affected people [5]. GEMA/HS accepts these reports through its Georgia Cybersecurity Incident Reporting System [6], and the Georgia Technology Authority advises school districts to contact their local emergency management agency within an hour of recognizing an incident [7]. Your incident response plan should place state reporting and carrier notice side by side so that neither waits on the other.

For funding, GEMA/HS administers the State and Local Cybersecurity Grant Program with GTA. In March 2026 it announced $9,873,903 in awards to 44 Georgia entities, with special consideration for K-12 projects in the FY23 round, and said FY 2024 and FY 2025 application windows would open on April 1 and September 1, 2026 [8]. GTA notes a 40% match requirement [9]. Check current status with GEMA/HS before planning around a grant.

This week: confirm your local EMA contact and the GEMA/HS reporting route are written into your incident response plan.

How the business office and technology office share the work

Renewal goes best when each office owns what it knows. The business official manages the broker or pool relationship, budget, the signature process and board reporting. The technology director owns control facts and evidence. The superintendent sponsors the work and decides how to present material gaps to the board. The district's risk manager and board attorney review policy terms, exclusions and notice obligations, because policy terms control coverage and no checklist can substitute for that review.

Business officials will find more on their role at For business officials, and the ransomware tabletop checklist can supply the exercise evidence underwriters ask for.

This week: schedule a 45-minute meeting between the business official and technology director to agree on owners and dates.