Cyber insurance applications have changed. A few years ago they were a page of general questions. Now many insurers ask detailed questions about how your systems are protected, and the answers affect whether you are offered cover, what it costs, and whether a claim is paid.
Questionnaires vary between insurers, but the same themes come up again and again. Here is what they usually ask, and what they are really checking.
Multi-factor authentication
“Is MFA enforced for email, remote access and administrator accounts?”
This is often the first and most important question, because stolen passwords are behind so many incidents. Note the word enforced. MFA that is available but optional does not count. Check that it covers every user, remote access tools such as VPNs, and every administrator account, including the one someone set up years ago and forgot.
Endpoint protection
“Do you use endpoint detection and response (EDR) on all devices?”
Insurers increasingly distinguish between traditional antivirus and EDR, which watches device behaviour and can isolate a compromised machine. “All devices” means servers and every laptop, not just most of them.
Backups
“Are backups kept offline or immutable? Are they tested?”
The concern is ransomware, which targets backups first. Insurers want at least one copy that an attacker cannot delete or encrypt, and evidence that restores actually work.
Email security
“Do you filter inbound email? Do you use SPF, DKIM and DMARC?”
Phishing remains the most common way in. Filtering reduces what reaches the inbox, and email authentication makes it harder for criminals to impersonate your domain.
Patching and end-of-life software
“How quickly are critical patches applied? Do you run unsupported software?”
Unpatched systems and software past its end of support are easy targets. Know your patching schedule and whether anything in the business, such as an old server or a legacy application, is out of support.
Remote access
“Is remote desktop exposed to the internet?”
Remote desktop left open to the internet is a well-known route in for attackers. Remote access should go through a VPN or a zero-trust service with MFA.
Staff training
“Do staff receive security awareness training or phishing simulations?”
Insurers see training as part of reducing human error. Even a simple, regular programme is better than none.
Privileged access
“Are administrator accounts separate from everyday accounts?”
Using an admin account to read email and browse the web gives any malware that gets in full control. Separate accounts for admin work limit the damage.
Incident response
“Do you have an incident response plan?”
A short written plan covers who to call, how to contain an incident, who contacts the insurer, and how staff and clients are told. Insurers often want to be called early, and some require you to use their approved responders.
Why accuracy matters
It is tempting to tick “yes” to questions that are mostly true. Do not. If an application misrepresents your controls, an insurer may be able to deny a claim or void the policy, and they find out exactly when it hurts most: after an incident, when investigators look at what was actually in place.
A better approach:
- Answer precisely. “MFA enforced for all users except two service accounts” is better than an unqualified yes.
- Keep evidence. Screenshots or reports showing MFA, EDR and backup status make renewals and claims easier.
- Fix gaps before renewal where you can, or disclose them along with a plan and a date.
- Ask your broker when a question is unclear, rather than guessing.
Where to start
If you are filling in an application now, list each control the questionnaire asks about and mark it as in place, partly in place or missing. The missing ones are your priority list.
Our managed security service covers most of what insurers ask about, including EDR, email security, patching and account protection, and we can help you answer an application accurately. Backups and recovery testing sit under backup and disaster recovery.