How a mid-Michigan township passed its cyber-insurance renewal — without raising the IT budget

The situation

A township office in mid-Michigan was notified by its cyber-insurance carrier that it would not renew the policy without meaningful changes to its IT controls. The questionnaire had gone from one page to four, and the controls the office had in place — basic antivirus, one shared admin account, no MFA on email — were no longer enough to qualify for coverage.

The township operates on a fixed budget set by the board annually. A surprise IT spend was not an option. They needed a partner who could close the gaps fast, with predictable pricing the board could approve.

What we did

Discovery happened in the first week. We inventoried every endpoint, every account, every cloud service touching township data — and produced a single-page report mapping the current state to the carrier's questionnaire item-by-item.

• Endpoint coverage. SentinelOne EDR deployed across every workstation and server, replacing the basic antivirus that had been in place.
• Identity hardening. Microsoft 365 conditional-access policies enforced, MFA enabled on every account, shared admin accounts replaced with named accounts.
• Managed detection and response. Adlumin MDR connected to email, identity and endpoint signals, with 24/7 analyst monitoring.
• Backup and continuity. Cove immutable backups across the server and critical endpoints, with verified restore tests on a monthly cadence.
• Documentation. A one-page written incident-response plan, plus documented patch windows and access-control policies for the board's records.

The outcome

Forty-five days after the engagement started, the township resubmitted the cyber-insurance questionnaire with honest "yes" answers on every item. The carrier renewed the policy at the same premium as the prior year — and the township ended up with a meaningfully stronger security posture than the policy actually required.

The board was used to IT being a line item that grew every year. This was the first time in a while the renewal conversation was about results, not invoices.

Why it worked

Three reasons. First, our standard managed-IT engagement already includes the stack carriers ask about — EDR, MDR, immutable backups, MFA, written IR plan. There was nothing to upsell. Second, the team is small enough that the same engineers who scoped the work also did the work; nothing fell between handoffs. Third, the pricing was predictable from day one, so the board didn't have to vote on a series of surprise expenses.