What cyber insurers now require, and how to pass the questionnaire

A few years ago, buying cyber insurance meant filling in a short form and paying the premium. After waves of ransomware claims, insurers changed the deal. Today the application reads like a security audit, and the wrong answer can mean a higher premium, a lower limit, an exclusion or a declined policy.

Worse, answering “yes” to a control you don’t actually have can give the insurer grounds to deny a claim later, exactly when you need it most.

The controls insurers ask about most

Every carrier’s questionnaire is a little different, but the same handful of controls come up again and again:

• Multi-factor authentication (MFA). On email, remote access (VPN, remote desktop) and administrator accounts, at minimum. This is usually the first question, and often a deal-breaker.
• Endpoint detection and response (EDR). Traditional antivirus increasingly doesn’t satisfy insurers. They want behavior-based protection, like SentinelOne, that can detect and contain an attack in progress.
• Backups that survive ransomware. Backups that are separated from your network or immutable, so attackers can’t encrypt or delete them, and that have actually been tested.
• Patching. A process for applying security updates promptly, especially for critical vulnerabilities.
• Email security. Filtering for phishing and malicious attachments, and often email authentication (SPF, DKIM, DMARC).
• Security awareness training. Regular training and phishing simulations for staff.
• An incident response plan. A written plan for who does what when something goes wrong.
• Privileged access management. Limiting and protecting administrator accounts.

Where small businesses get caught out

The gaps are rarely dramatic. They’re usually small and easy to miss:

• MFA is on for most staff, but not for the owner’s account or the old shared mailbox.
• Backups run every night, but nobody has tried restoring from one in a year.
• The office has antivirus, but not true EDR, and nobody is watching the alerts.
• The remote desktop port on the office server is still open to the internet.
• The person filling in the form is guessing.

How to get ready before renewal

1. Get the questionnaire early. Ask your broker for the renewal application a couple of months ahead, so there’s time to close gaps.
2. Assess honestly. Go through each control and confirm it’s actually in place, everywhere it needs to be.
3. Close the high-impact gaps first. MFA, EDR and tested backups make the biggest difference, both to your premium and to whether you’d survive an attack.
4. Keep evidence. Screenshots, reports and policies showing the controls are in place. They help with the application, and with a claim.
5. Answer accurately. If something isn’t fully in place, say so and explain the plan. An honest “in progress” is far better than an inaccurate “yes”.

The upside

The controls insurers want aren’t busywork. They’re the same ones that stop most real-world attacks. Getting insurance-ready and getting genuinely safer turn out to be the same project.

Every carrier’s requirements are different, and pricing and coverage decisions are up to your insurer. This article is general information, not insurance or legal advice.