New federal contract requirements mandate cybersecurity insurance minimums for contractors handling federal data, with insurers requiring evidence of specific security training programs as underwriting criteria.
A new Defense Federal Acquisition Regulation Supplement rule mandates minimum cybersecurity insurance coverage for defense contractors handling Controlled Defense Information. A parallel civilian FAR rule is under development and expected to be finalized by mid-2026.
The new requirements specify minimum coverage limits of $5 million for contractors handling CUI, $15 million for contractors handling defense critical information, and $50 million for prime contractors on major weapons systems.
Cybersecurity insurers have responded to the expanded federal market by introducing underwriting requirements that directly link insurance eligibility and premium rates to specific security practices. Training completion is increasingly cited by insurers as a leading indicator of mature security culture.
Major federal cybersecurity insurers including Beazley, Chubb, and AIG Government now require evidence of structured employee security training as a condition of coverage, including phishing simulation, incident response procedures, and role-specific security training for IT staff.
GovAcademy's Cybersecurity Awareness Instructor Kit (GA-019) enables contractor training officers to build and deliver compliant employee security awareness programs that meet insurer requirements. The Secure Remote Work for Agencies course (GA-022) addresses the remote workforce security practices that insurers specifically require.
Several insurance brokers specializing in federal contractor cyber insurance have begun recommending GovAcademy's security training catalog to their clients as a cost-effective way to meet underwriting training requirements.
The intersection of insurance requirements and federal contract requirements creates a dual accountability mechanism for contractor security training, creating stronger incentives than either mechanism would provide alone.