A cyber insurance application asks whether your business has a specific set of security controls in place: multi-factor sign-in, tested and offline backups, endpoint protection, patching, staff training, email filtering, an incident response plan and a procedure for verifying wire transfers. Most questions are yes or no. The honest way to answer is to check each one before you tick it, answer for the whole company and not just the main office, and explain anything that is only partly true. The application becomes part of your policy, so a wrong answer can cause trouble at the worst moment: when you file a claim.
I am an IT person, not an insurance agent, and every carrier’s form is different. Your agent or broker is the right person for coverage questions. What I can do is explain what each question area means in practice and how to check your own answer.
1. Multi-factor sign-in
What they ask: Is multi-factor authentication (MFA) required for email, for remote access to your network, and for administrator accounts?
What it means: After the password, a second proof is needed, such as a code from an app on your phone. The key word is required. If it is switched on for most people but the owner and the shared scanner mailbox are exempt, the honest answer is not a plain yes.
How to check: In Microsoft 365 or Google Workspace, an administrator can list every account and whether a second factor is enforced. Check remote access too: VPN, remote desktop tools and any cloud accounting or payroll system.
2. Backups: how often, where, and whether they are tested
What they ask: Do you back up critical data? How often? Is a copy kept offline or separate from your network? Have you tested restoring from it?
What it means: Insurers care about ransomware, and ransomware goes after backups that are plugged in or reachable from the network. An offline or isolated copy is one the attacker cannot reach. “Tested” means you actually restored files and opened them, not that the software shows a green tick.
How to check: Find the date of the last successful backup and the date of the last restore test. If you cannot find the second one, the answer is no for now. Our backup checklist walks through a restore test.
3. Endpoint protection
What they ask: Is antivirus or endpoint detection and response (EDR) installed on all computers and servers?
What it means: Traditional antivirus blocks known bad files. EDR also watches for suspicious behavior and lets someone investigate and isolate a machine. Some forms ask which one you have and whether anyone monitors the alerts.
How to check: Count your computers, then count the devices in the security tool’s console. The numbers should match. The laptop that lives at someone’s house counts.
4. Patching
What they ask: Are security updates applied on a regular schedule? Do you run any software that is no longer supported by its maker?
What it means: Updates close known holes. Unsupported software no longer gets them at all.
How to check: Look at the update status on each computer, and do not forget the firewall, the Wi-Fi equipment and any server in the closet. List anything too old to update.
5. Staff training
What they ask: Do employees receive security awareness training? Do you run simulated phishing tests?
What it means: A recurring program, with a record of who completed it. A talk at one staff meeting two years ago is not what the question is after.
6. Email filtering
What they ask: Do you filter incoming email for malicious links and attachments? Are SPF, DKIM and DMARC set up for your domain?
What it means: Filtering scans mail before it reaches the inbox. SPF, DKIM and DMARC are three records published for your domain that help other mail systems tell real mail from you apart from forgeries.
How to check: Whoever manages your domain can look up all three records in a few minutes.
7. An incident response plan
What they ask: Do you have a written plan for a security incident?
What it means: It does not need to be long. One or two pages: who decides, who to call (IT, the insurance carrier’s claims line, your bank, your attorney), how to disconnect an affected computer, and where the plan is kept on paper in case the network is down. Many policies expect you to call the carrier first, so put that number at the top.
8. Wire-transfer and payment verification
What they ask: Before you send a wire or change a vendor’s bank details, do you confirm the request by calling a known phone number?
What it means: A common fraud is an email that appears to come from a vendor, or from the owner, asking to change payment details. The control is a call to a number you already had on file, never one from the email itself, and ideally a second person approving the payment.
Other questions you may see
- How many records with personal information you hold, and whether they are encrypted.
- Whether remote desktop is exposed directly to the internet.
- Whether everyday accounts have administrator rights.
- Whether you have had an incident or claim before.
- Which vendors hold your data.
Why an inaccurate answer is a problem at claim time
The application is a set of statements the insurer relies on to price and issue the policy, and it is signed by an owner or officer. After a loss, the insurer investigates how it happened. If the investigation finds that a control you said was in place was not, the insurer may have grounds to reduce or deny the claim, or in serious cases to cancel the policy. How that plays out depends on the policy wording and the law, which is a question for your agent or attorney. The practical point is simple: a wrong yes can cost far more than an honest no.
How to answer honestly
- Do not fill it out alone. Sit down with whoever handles your IT and go question by question.
- Verify before you tick. Use the checks above. “I think so” is not a yes.
- Answer for every location and every account. “All” means all.
- Use the comment box. If MFA covers email but not yet the accounting system, say so, and give the date you expect to finish.
- Ask your agent when a question is unclear. Get the clarification in writing.
- Keep evidence. Screenshots and reports dated the week you signed.
- Tell the agent when things change. And revisit your answers at each renewal.
If several answers are no, that is useful to know. Most of the controls on these forms are the same ones in our 15-point security self-check, and most can be put in place in weeks, not months. They are also part of everyday managed IT and our security assessments. If you would like help working through a form before you sign it, get in touch.