How to Answer a Cyber Insurance Questionnaire

Cyber insurance applications have gotten longer and more specific. Insurers now ask about the exact controls that stop the attacks they pay claims on. Answering them well matters: an answer that turns out to be wrong after an incident can put a claim at risk.

What insurers usually ask about

The wording varies by carrier, but most applications cover the same areas:

• Multi-factor sign-in. Is it required for email, remote access and admin accounts? This is often the most important question on the form.
• Endpoint protection. Do you run endpoint detection and response (EDR), and is it monitored?
• Backups. Are backups separate from your main network, protected from deletion, and tested?
• Email security. Do you filter email and protect your domain against spoofing?
• Patching. How quickly are critical updates applied?
• Admin access. Who has admin rights, and are they separate accounts?
• Training. Do employees get security training and phishing tests?
• Payments. Do you verify changes to payment or bank details before sending money?
• Incident response. Do you have a written plan, and who do you call?

How to answer well

1. Answer for what is true today, not what you plan to do next month. If a control is partly in place, say so and explain.
2. Know what "yes" means. "MFA everywhere" means every user and every way in, not just the people who turned it on.
3. Keep evidence. Screenshots, reports and policy documents make a "yes" easy to stand behind if an insurer asks later.
4. Read the exclusions. Some policies limit coverage if a control you said you had wasn't in place.
5. Talk to your broker about coverage, limits and policy wording. That is their job, and they know the carriers.

Common gaps that cause trouble

• MFA on email, but not on remote access or admin accounts
• Backups that sit on the same network as everything else
• Endpoint protection installed but never monitored
• No written process for verifying payment changes

Getting ready before renewal

Start 60 to 90 days before your renewal date. That leaves time to close a gap rather than explain it. Pull last year's application, compare each answer with what is true today, and fix the easy items first.

Help with your yearly cyber insurance renewal is included in Elevaire Managed Security, and the controls it runs are the ones insurers ask about most. See also our security baseline checklist.