What your cyber insurance company will ask you, and how to get ready

Why applications got harder

Cyber insurance applications used to be short. Claims tied to ransomware and business email compromise changed that. Insurers now ask pointed questions about specific controls, because those controls are strongly linked to whether a claim happens at all.

What insurers typically ask about

• Multi-factor authentication (show definition) on email, remote access, and admin accounts.
• Endpoint detection and response (show definition) on computers and servers.
• Backups that are tested and kept separate from the main network, sometimes called immutable backups (show definition).
• Security awareness training for staff, often on a recurring schedule.
• A documented incident response plan (show definition).
• Limits on who has administrator access (show definition) and how that access is reviewed.
• How quickly known vulnerabilities get patched (show definition).

Answer accurately

If you do not have a control in place yet, say so. Many insurers will still offer coverage, sometimes with conditions or a plan to add the control within a set time. What creates real problems is an answer that does not match reality.

Getting ready before you apply

• Turn on MFA for email, remote access, and any admin accounts.
• Confirm endpoint protection is installed and active on every device.
• Test that your backups actually restore, not just that they run.
• Schedule or confirm recurring security awareness training.
• Write down, even briefly, who to call first if something goes wrong.
• Review who has administrator access and remove anyone who does not need it.

If your renewal is coming up

Start the checklist above a few weeks before your renewal date. Insurers may ask for evidence, not just a checkbox answer, so having documentation ready for each control saves time during underwriting.

This is general information, not legal or insurance advice. Talk with your broker or carrier about your specific policy language.