A few years ago, a cyber insurance application was often a page or two. Now many run several pages, full of questions about multi-factor authentication, backups and remote access.
The reason is simple. Insurers have paid out a lot on ransomware and fraud claims, and they've learned which safeguards make a claim less likely. The questionnaire is how they check.
Here's what those forms usually ask, what the questions mean, and why getting the answers right matters more than most business owners realize.
What insurers commonly ask about
Every carrier words things differently, but most renewal forms cover the same ground.
Multi-factor authentication (MFA). Do you require a second step, like a code on your phone, to sign in? Insurers often ask about several places separately: email, remote access to your network, administrator accounts and access to backups. A yes for email doesn't mean a yes for the others.
Device protection. Is every computer and server protected against viruses and ransomware? Many forms ask about endpoint detection and response (EDR), which goes beyond basic antivirus.
Backups. How often do you back up? Are copies kept separate from your network, so an attacker can't delete or encrypt them? Have you tested restoring from them?
Updates and patching. How quickly are security updates applied? Are you running any software or operating systems that no longer get updates?
Email filtering. Do you filter for phishing and scam emails before they reach inboxes?
Staff training. Do employees get security awareness training? Some forms ask whether you run practice phishing tests.
Admin access. Who has full administrator rights? Insurers want to see that only the people who need it have it.
Payment verification. Do you confirm changes to vendor bank details by phone before sending money? This one comes up because fake invoice scams are so common.
24/7 monitoring. Is someone watching your systems around the clock for signs of an attack?
An incident response plan. Do you have a written plan for what happens if something goes wrong?
Why an inaccurate answer is so risky
Your answers aren't just a formality. The application is typically part of what the insurer relies on when it issues the policy. If an answer turns out to be wrong, the insurer may deny a claim or try to rescind the policy, which means treating it as if it never existed.
There's a real example. In 2022, Travelers asked a federal court in Illinois to rescind a $1 million cyber policy after the company it insured suffered a ransomware attack. Travelers said the company had stated on its application that it required MFA for email, remote access, servers and other systems, when MFA was actually only in place on its firewall. Later that year, the court granted Travelers' request to rescind the policy.
Most inaccurate answers aren't lies. They're assumptions. Someone checks yes because they believe MFA is turned on everywhere, or because backups are "handled," without anyone confirming it.
How to answer honestly
- Answer for today, not for next month. If a safeguard is planned but not in place, the honest answer is no, or partially, with an explanation if the form allows one.
- Have your IT provider verify every yes. Don't let the person filling out the form guess. Each yes should be something your IT team can show you.
- Read each question closely. "MFA for remote access" and "MFA for email" are different questions. So are "we have backups" and "we test restores."
- Keep proof. Save reports or screenshots that show MFA settings, backup results and training records. If there's ever a claim, you'll be glad you did.
- Don't hand the form off and forget it. Your broker can help with the insurance side, but the technical answers should come from whoever actually runs your systems.
Start 60 days before renewal
The best time to look at the questionnaire is well before it's due. That gives you time to close gaps instead of explaining them.
- Get last year's application and a blank copy of this year's form.
- Go through each security question with your IT provider.
- Make a list of anything that's a no or only partly true.
- Fix what you can before renewal. MFA, email filtering and device protection can often be in place within weeks.
- Gather proof for each yes.
- Review the final answers together before anyone signs.
Closing gaps before renewal can also help with what you pay. Insurers price risk, and a stronger answer sheet can mean better terms, or simply the difference between getting coverage and not.
How we help
Our team holds CISSP, CISA and Security+ certifications, with a HIPAA Security Officer on staff. On Inventive Prime, help with everyday auditor and insurer questions is included. If your review turns up larger gaps, we'll quote that work up front so you can decide.
This article is general information, not legal or insurance advice. Your broker and attorney can tell you how your specific policy works.