Cyber insurance applications have changed. Renewals that once asked a handful of yes or no questions now run several pages, and insurers want specific security controls in place before they will quote. This guide explains what they commonly ask and how to answer with confidence.
Why insurers ask
Ransomware and business email compromise claims have grown sharply, and insurers have learned which controls make claims less likely and less severe. Requiring those controls is how they manage risk. It also means your security posture now affects your premium and your eligibility.
Controls commonly required
Requirements vary by insurer and policy, but these appear on most applications:
- Multi-factor authentication on email, remote access, admin accounts and backups.
- Endpoint detection and response on workstations and servers, not only basic antivirus.
- Backups that are separate from the main network, protected from deletion and tested.
- Patching of operating systems and key software on a regular schedule.
- Email security that filters phishing and flags outside senders.
- Security awareness training and phishing practice for staff.
- Privileged access controls, such as separate admin accounts.
- An incident response plan that says who to call and what to do.
Documenting your answers
The most dangerous answer on an application is a yes that is not quite true. If the form says MFA is on for every account and one remote access tool was missed, an insurer may dispute a claim tied to that gap. Before you sign:
- List every question and the evidence for your answer.
- Check the details: every account, every remote access method, every backup.
- Fix gaps before you answer, or answer honestly and ask your broker about options.
- Keep the evidence, such as MFA reports and backup test results, with your policy records.
Questions that trip people up
Some questions look simple but hide details that matter. Read these carefully:
- “Is MFA required for all remote access?” That includes vendor support tools, VPNs, remote desktop gateways and cloud admin portals, not only email.
- “Is remote desktop exposed to the internet?” Insurers scan for open remote desktop ports. A single forgotten one can change your answer.
- “Is endpoint detection installed on all endpoints?” All means servers, laptops that rarely come to the office and the old PC running equipment in the back room.
- “Are backups offline or immutable, and how often are they tested?” A backup on the same network, with the same admin password, does not count.
- “Do you run software the vendor no longer supports?” Old servers and unsupported Windows versions are a common reason for higher premiums or exclusions.
Common exclusions and limits
Policies differ, so read yours with your broker. Points to check:
- Social engineering and funds transfer fraud coverage is often limited to a smaller amount than the main policy, or requires call-back verification procedures.
- War and state-backed attack exclusions were tightened by many insurers after 2023. Ask how your policy treats them.
- Failure to maintain clauses can limit coverage if controls described in the application were not actually in place.
- Contractual liability for client data may need specific coverage if your contracts require it.
When something goes wrong
Most policies include a breach hotline and a panel of approved lawyers, forensic firms and negotiators. Many require you to notify the insurer before hiring outside help, or they may not pay for it. Keep the hotline number, your policy number and your broker’s contact in the incident response plan, printed and stored outside your network.
Before any ransom discussion, involve your insurer and counsel. The U.S. Treasury’s Office of Foreign Assets Control has warned that paying ransoms to sanctioned groups can violate federal sanctions rules.
Start renewals early
Give yourself time. Start reviewing the renewal questionnaire 60 to 90 days before your policy ends. That leaves room to close gaps, collect evidence and compare quotes, instead of signing a form under deadline pressure. If you add new locations, acquire a company or change major systems during the year, tell your broker, because the answers on your last application may no longer be true.
Clients and contracts may require coverage
More contracts now require vendors to carry cyber coverage and to meet specific security standards. Health care, financial and government clients are the most common. Keep a list of those requirements next to your policy so renewals and contract reviews line up.
Build an evidence folder
Insurers increasingly ask for proof, and a claim adjuster may ask again after an incident. Keep a folder, updated at least quarterly, with:
- An MFA report showing which accounts and remote access tools are covered.
- An endpoint detection coverage report listing every protected device.
- Backup reports, plus notes from your most recent test restore.
- Patch compliance reports for workstations and servers.
- Security training completion records and phishing test results.
- Your incident response plan, with the date it was last reviewed.
- A list of software you still run that the vendor no longer supports, with a plan to replace it.
When the renewal arrives, most answers come straight from this folder.
Practice before you need it
A tabletop exercise is a short meeting where leadership walks through a pretend incident, such as ransomware on a Monday morning or a fake wire request that worked. Who makes decisions? Who calls the insurer’s hotline, the bank and the lawyer? How do staff keep working if email is down? What do you tell customers? Running through these questions once a year finds gaps in the plan while the stakes are low. Some insurers ask whether you have done one, and some offer free resources to help.
Coverage for the business you are now
Businesses change faster than policies. New services, new data, more remote staff and new clients with strict contracts can all change the coverage you need. Review limits and retentions with your broker every year, not only when the premium changes.
Vendors and remote access tools
Many claims start with a vendor’s access rather than your own staff. Accounting software support, equipment makers and line-of-business vendors often keep remote access tools installed for convenience. Insurers want to know who can reach your systems and how. Keep a list of every vendor with remote access, require MFA on their accounts, turn access on only when they need it and remove tools you no longer use. That list also answers a common question on renewal forms.
How we help
As part of managed IT, we put the commonly required controls in place, keep them running and produce the reports that prove it. When your renewal arrives, we review the questionnaire with you, flag anything that is not fully true yet and help you close the gap. Coverage questions belong with your broker; we handle the security side. Read more about our cybersecurity services.