Cyber insurance applications used to be one page. After several years of heavy ransomware claims, insurers made the forms much longer and more detailed. What arrives now is a technical questionnaire written by people who see thousands of incidents a year, sent to a business owner who has seen none, usually two weeks before renewal.
The questions themselves are usually clear. The trouble is that they assume controls many small businesses have only partly in place, and the form has no box for partly.
Here's how I'd work through one honestly and still get a good result.
Why honest answers protect the claim
Every answer on the form is a statement your coverage is written against. Nobody checks it when you submit. It gets read carefully once, when you file a claim, by people whose job is to read it carefully.
If the attacker got in through an exception the form said didn't exist, your claim can be contested or your policy rescinded at the worst possible time. You would have paid a premium for coverage that doesn't pay out.
I think of the form as free security advice. Every question is there because its absence cost someone a very bad year, and the questions are roughly ordered by what actually causes claims. I've written separately about what a cyber insurance application is really asking, and this post goes question by question.
What each question is asking
Multi-factor authentication
The form asks whether multi-factor authentication (a code or phone prompt on top of the password) is enforced for email and remote access, and usually for administrator accounts as well. The word I'd pay attention to is enforced. "Available" is a different answer, and so is "turned on for most people."
The underwriter wants to know whether a stolen password is enough to get in. At many businesses the honest answer is that it is enough for two or three accounts, and that's all an attacker needs.
Backups
This question covers more than it looks like. They want to know whether backups exist and whether they're kept separate from your network, so an intruder with your administrator password can't reach them. They also want to know whether anyone has actually restored from them.
In my experience, that last part is the one businesses answer optimistically. Insurers know an untested backup is only an assumption, because they have paid for the ones that turned out not to work.
Patching and supported software
They want to know whether you run software its maker still issues security updates for, and whether those updates get installed on a schedule someone owns. Any machine still on an operating system past its end of support belongs in this answer. That's why the Windows 10 question is an insurance question and not only a security one.
Administrator rights and accounts
They ask whether everyday accounts can install software and change settings, and whether accounts for former staff are actually disabled. What they want to know is how far an intrusion spreads once it starts, and how many of your logins belong to people who no longer work for you.
Email security and training
They ask whether messages are filtered, and whether staff have been trained and tested. The underwriter knows many incidents start with a person clicking a link or replying to the wrong message.
Payment verification
They ask whether anyone independently confirms requests to change bank details. This question is about fraud, and it's on the form because impersonation fraud is expensive, even though it happens one payment at a time. The FBI's Internet Crime Complaint Center has reported more than $2.7 billion a year in business email compromise losses since 2022, far more than the ransomware losses reported to it.
Detection and response
They ask whether something is watching for malicious activity, and whether someone would notice outside business hours. That's the job of managed detection and response. In other words, they want to know how long an intruder gets to work undisturbed.
How to answer when the true answer is partly
Nearly everyone is in this position, and I see two legitimate options.
The first is to fix it before you submit. That's the best option whenever the gap is small, and it often is. Turning on multi-factor authentication for the four accounts that lack it takes an afternoon, and disabling six former employees' accounts takes about an hour. A lot of the honest no answers on a typical form can become honest yes answers in less than a week of ordinary work.
The second is to disclose the gap accurately. A no with a dated plan to fix it is a normal answer that underwriters can price. It can cost you something on premium, but it won't cost you the claim.
Underwriters see partial environments all the time. What they cannot price is an answer that turns out to be false.
Where the form allows a comment, use it to describe the exception precisely. "Enforced for all users except one legacy service account, which is restricted to internal network access only" is a better answer than yes, especially if that account is ever involved in an incident. What I'd never do is round mostly up to yes because the renewal is due Friday.
What to fix first if you have two weeks
I'd go in this order. It is roughly how the questions are weighted, and it is also the order of what actually causes claims.
- Multi-factor authentication on every account that can reach email or the network from outside, with no exceptions you haven't written down.
- A restore test, done on purpose, with the date and the time it took recorded.
- Former staff accounts disabled everywhere, including the applications outside your main system.
- Administrator rights removed from everyday accounts.
- A written rule about changing payment details, understood by the people who actually process payments.
I'd do every one of those whether or not you were buying insurance. None of them exists only to satisfy a form.
Using the renewal date as your deadline
Security work drifts without a date attached to it. The renewal gives you one, and it's why I'd rather see the questionnaire eight weeks before it's due than two days before.
This is the sequence I'd follow:
- Get the actual form.
- Check each answer against your actual environment.
- Fix what you can in the time you have.
- Write down the exceptions that remain.
- Submit answers that are true.
The usual result is a form where every yes holds up and a business that's harder to attack. It often means a better premium too, because insurers price the controls they ask about.
We're an IT company and not an insurance advisor, so what coverage you need, and from whom, is a conversation for your broker. What our cybersecurity services can do is make sure the answers are true, and that's what decides whether the coverage holds up when you need it.
If a renewal is on your calendar, bring us the form before it's due. Closing the gap between partly and yes costs much less on your own schedule than during a claim.