Cyber insurance questionnaires decoded

Why the questions got harder

A few years ago, many cyber insurance applications asked only a handful of general questions. As ransomware claims grew, insurers began asking specific technical questions and, in many cases, requiring certain controls before they would offer coverage or renew a policy. Small businesses now regularly receive questionnaires that read like a security audit.

The answers matter. Your application forms part of the basis on which the insurer agrees to cover you. If an answer is inaccurate, the insurer may dispute or deny a claim. Treat the questionnaire as a factual statement about your environment and involve your IT provider and your broker before signing.

Multi-factor authentication questions

Almost every questionnaire asks about multi-factor authentication, often in several separate questions. Insurers typically want to know whether it is enforced for email, for remote access such as VPN or remote desktop, for administrator accounts and for cloud services. A yes answer generally means it is required for all users of that system, not just turned on for a few people.

Check for exceptions before answering. Shared mailboxes with passwords, service accounts, an old remote desktop port opened for a vendor or a single executive who was exempted for convenience can all make a yes answer inaccurate. Your IT provider can run a report that shows which accounts are and are not covered, which gives you evidence to support your answer if the insurer ever asks for it.

Backups, endpoint protection and patching

Insurers want evidence that you could recover from ransomware without paying. Expect questions about how often backups run, whether they are kept offline or immutable, whether they are separated from your normal network credentials and when you last tested a restore. An untested backup is a common weakness. Note the date and result of your most recent restore test.

You will also see questions about endpoint detection and response tools, how quickly critical patches are applied and whether you run unsupported operating systems. Some terms are easy to misread, so confirm what the insurer means before you answer, and ask your broker if the wording is unclear. A few common points of confusion are listed below.

• Endpoint detection and response means more than basic antivirus
• Immutable backups cannot be changed or deleted for a set period
• Critical patch timelines are often measured in days, not months
• Unsupported systems include Windows 10 machines without extended updates

Email, training and incident response

Many questionnaires ask about email filtering, whether you tag external emails and whether you have procedures to verify payment or banking changes by phone. These questions reflect how often fraud starts with a convincing email to someone in accounts payable. A documented call-back procedure is simple to put in place and is often asked about directly.

Expect questions about security awareness training, phishing simulations and whether you have a written incident response plan. If the answer is no, it may still be better to say so and describe your plan to improve than to overstate where you are today. Your broker can explain how the insurer is likely to view a partial answer.

Answering accurately

Gather your IT provider, your broker and whoever signs the application. Go through each question, confirm what it actually asks and record the evidence behind each answer, such as a screenshot of MFA enforcement or a backup test report. Keep that evidence with your policy documents. Repeat the exercise at every renewal.

If you find gaps, fix the quick ones before submitting and note planned improvements where the application allows it. Finally, review the policy wording itself, including notification requirements, panel vendors and exclusions. Questions about coverage and legal obligations should go to your broker and your lawyer. Do not guess at an answer you cannot support with evidence.