Cyber insurance applications have become detailed security questionnaires. Answering “no” to key questions can raise premiums or lead to a declined policy, and inaccurate answers can put a future claim at risk. Here’s what insurers commonly ask about and what each control means for your business.
Multi-factor authentication
Expect questions about MFA on email, remote access, and administrator accounts. This is usually the first thing underwriters check because it prevents so many attacks.
Endpoint detection and response
Many insurers now ask whether you use EDR rather than basic antivirus, and whether it’s monitored around the clock by a security team.
Backups
You’ll likely be asked how often you back up, whether backups are encrypted, whether a copy is kept offline or separate from your network, and whether you test restores.
Patching and outdated systems
Insurers want to know how quickly critical updates are applied and whether you still run software or equipment that no longer receives security updates.
Email security and training
Questions often cover email filtering, whether employees receive security awareness training, and whether you run simulated phishing tests.
Access and payments
Many applications ask whether admin rights are limited and whether you verify changes to payment or banking details with a phone call before sending money.
Incident response
A written plan for what to do in a cyber incident (who to call, how to contain it, how to recover) is increasingly expected.