Cyber insurance applications used to be one page. Name, revenue, industry, do you have antivirus, sign here.
They are not one page anymore. The applications crossing my desk now ask whether multi-factor authentication is enforced on remote access and on email and on privileged accounts, as three separate questions. They ask how often backups are tested, not whether they exist. They ask about endpoint detection and response by name.
If you’re the person at a 20–50 person firm who ends up filling this in, and it’s usually the office manager or the finance lead, not anyone technical, the honest problem is that you’re being asked to attest to things you have no direct way to verify. So the form gets filled in from last year’s copy, or from a reasonable-sounding guess, and everyone moves on.
That’s the part worth fixing. Not because the form is important in itself, but because an inaccurate answer on a signed application is a reason a claim gets denied later, at the exact moment you need it to pay out.
This post is a short list of cyber insurance questions for your IT provider. Send them before you fill in the form, not after.
Why the questions got harder
Carriers wrote a lot of cyber policies, then paid out on a lot of ransomware claims. The underwriting tightened in response. What used to be a general question about your security posture is now a specific question about named controls, because those controls turned out to correlate with whether a claim happened.
The practical consequence for you: the application is now a technical document. It needs a technical answer from someone who can look at your actual configuration. Your IT provider is that someone.
Seven questions to send your provider
Copy these into an email. You want written answers, because written answers are what you’ll rely on when you attest to the application.
1. Is multi-factor authentication enforced on every email account, including shared and service mailboxes? “Enforced” is doing the work in that sentence. Available and enforced are different states. The shared mailboxes are the ones that get skipped. info@, billing@, admin@. They’re often the ones with the broadest access.
2. Is MFA required for remote access, and does that include the VPN, the remote desktop gateway, and any third-party remote support tool? Carriers ask about remote access as its own category. So should you.
3. Which accounts have administrator privileges, and can you send me the list? If the list is longer than you expected, that’s the finding. If nobody can produce the list quickly, that’s a bigger one.
4. When did we last restore from backup, and what did we restore? Not “are backups running.” A date and a description of what was recovered. Many applications now ask specifically about restore testing frequency.
5. What endpoint protection is deployed, on how many machines, and how many machines are we missing? The gap between “we have EDR” and “EDR is on every endpoint” is where incidents start. Ask for the count both ways.
6. Do we run security awareness training, and can you show me who has and hasn’t completed it? Applications increasingly ask about user training with a frequency attached. A tool that exists but nobody completed doesn’t answer the question truthfully.
7. If we were hit tomorrow, what’s the first hour? Who do I call, who calls the insurer, who decides whether to take systems offline, and where is that written down. An incident response plan that lives in someone’s head is not a plan you can attest to.
The four gaps that show up most often
When we go through a questionnaire with a client for the first time, the same four gaps account for most of the corrections.
MFA that isn’t universal. Enabled for staff, missed on shared mailboxes, missed on the one executive who asked to be exempted, missed on the service account that runs the scanner.
Backups that have never been restored. The job runs. The dashboard is green. Nobody has ever pulled a file back out of it, so nobody knows whether the restore works or how long it takes.
Endpoint coverage with holes. New laptops that went out before the agent was installed. The conference room PC. The machine in the warehouse that nobody thinks of as a computer.
Training that was bought but not finished. The license is paid for. Completion sits well under a hundred percent, and the application asks about completion.
None of these are catastrophes. All four are fixable in weeks rather than quarters, and all four are the difference between an application you can sign confidently and one you’re hoping nobody checks.
Cyber insurance is not a substitute for the controls
Worth saying plainly, because I hear the opposite: a policy does not replace security. Carriers expect both. The controls are increasingly a condition of the policy, not an alternative to it, and a policy priced on answers that don’t reflect reality is a policy that may not respond when you need it.
Think of the questionnaire as a free security assessment written by someone with a financial interest in being thorough. It’s a useful document even if you never file a claim.
If you’re in Massachusetts, check the grant first
Before you buy anything new to close a gap, it’s worth looking at the Massachusetts Small Business Cybersecurity Grant, the state is currently covering part of the cost of security monitoring for qualifying small businesses. We wrote that one up separately because the eligibility details matter more than the headline.
How we handle this for clients
Going through the questionnaire is part of the job here, not a separate engagement. When a renewal comes up, we sit with the form and the environment side by side, answer what we can answer truthfully, and give you a short list of what needs to change before you sign.
The controls themselves, identity, MFA, endpoint protection, backup and restore testing, user training, sit inside cloud solutions and cybersecurity and the ongoing managed IT engagement. For financial services, legal, and healthcare clients there’s usually a second questionnaire behind the insurance one, from a regulator or a client’s own vendor review, and the answers need to be consistent across both.
What to do this week
Send the seven questions. Give it three business days. If the answers come back with specifics and dates, you’re in good shape and the application will be quick. If they come back vague, you’ve learned something more valuable than an insurance renewal.
Renewal coming up? Send us the questionnaire. We’ll go through it against what’s actually running in your environment and tell you which answers hold up and which ones need work before you sign.
Book a consultation · Contact form · 617-322-5155
