Cyber insurance answer kit

Before you sign

The cyber insurance application or renewal is on your desk. It may run 80 pages, use unfamiliar terms and demand yes or no where the truth is partial or unknown.

This kit is for the signer. That may be a managing partner, practice administrator, CFO, controller or the solo IT director handed the PDF. CPA firms can also use it to gather the records behind their written security plan.

Work through the form before the signature date. You will end with sourced answers, the rows still open and a short gap list with owners and dates. Hire nobody to start.

Your answers become part of the policy

The application is not a survey. Most cyber policies attach or incorporate it, so your answers become representations to the insurer.

An answer rosier than reality can let the insurer reduce, deny or rescind cover. That risk is highest when a claim traces to the control you overstated.

The effect depends on your wording, your state and the facts. Ask your broker and counsel to show you the clause.

A truthful “no” beats an unchecked “yes”. A “no” costs money, and a wrong “yes” can cost the claim. Insurers price the risk they can see, not risk they were told did not exist.

Three sessions before the signature date

1. About 45 minutes. Read the form end to end without answering. Mark each question with one of the six states below, and do no research yet.
2. As long as it takes. Work the unknown and partial rows. Most firms find ten to twenty questions carry all the difficulty, and the rest are clerical.
3. About an hour. Fill the evidence index and write the notes. Then have the signer read it cold and challenge anything they could not defend to an adjuster.

Six answer states

State	Use it when
Yes	The control exists, covers everything asked, and you can show evidence today
No	The control does not exist, or does not cover what is asked
Partial	It covers some users, systems or offices, and not others
Unknown	Nobody can say for certain, and no evidence has been checked
Not applicable	You do not have the thing the question asks about
Ask the insurer	The question is truly ambiguous, and the answer changes with the reading

Partial and unknown are legitimate answers. To an underwriter, a precise partial with a scope note beats a bare yes that collapses in a claim.

If the form offers only yes or no and the truth is partial, add a comment or cover letter. Tell your broker you did.

Part 1: Ten evidence domains

Insurers’ forms differ in wording, order and depth, from short small-firm forms to full mid-market applications. The underlying questions vary little. Each domain below gives the real question, the evidence it needs, the honest no and the usual mistake.

Answer the form in front of you. Use these as a translation, never as a substitute for the insurer’s words.

1. Revenue, staff and sensitive records

Typical questions. Revenue, staff count, industry, records holding personal, health, card or Social Security data, locations and any work outside the US.

What it tests. Your size of exposure, against which every other answer is weighed. It sets your limit and much of your premium.

What satisfies it. Real counts from your system of record, not impressions. A CPA firm counts clients in its tax software, and a medical practice counts its patient roster. A law firm counts its client and matter database.

If you do not know. Say the number is an estimate and how you made it. “About 4,200 client records, from active clients in [system] on [date]” is a real answer. A round number with no basis is a guess the insurer treats as fact.

The usual mistake. Counting current clients and forgetting archives. Old files, former staff records and backups hold personal data too, including seven years of tax returns kept by law. Undercounting is the most common cause of a limit that proves too small.

2. Where MFA is enforced, and every exclusion

Typical questions. Is MFA required for remote access, email, admin accounts and backup access, and for all users or some?

What it tests. Whether one stolen password lets an attacker in. It is the most heavily weighted domain on most forms.

A wrong answer here is the likeliest to surface after a claim. The forensic report states whether MFA protected the breached account.

What satisfies it. An identity provider export showing the enforcement policy, its scope and the users in and out of scope. One user’s sign-in screen proves nothing about the rest.

These are usually separate questions with separate answers.

Scope	Common reality
Email, all users	Often yes
Remote access, all users	Often yes
Admin and service accounts	Often no, or unmonitored
The backup console	Often overlooked entirely
Older apps, VPN-only systems and on-site business software	Often exempted and forgotten

If the answer is no. Answer partial and name the exception in writing, such as the note below.

MFA is enforced for all users on email and remote access. Two service accounts on [system] are excluded, documented and due for fixing by [date].

An underwriter can price a named exception with a date, but not a surprise.

The usual mistake. Someone says “yes, we have MFA” because they personally have it. Exemptions pile up quietly, for the travelling partner, the shared reception account, the scanner or the accounting package. Check the policy, not the perception.

3. Everyone with admin access

Typical questions. They ask how many users have admin rights and whether admin accounts are separate. They ask about privileged access tools, how credentials are stored and whether former staff keep access.

What it tests. Blast radius, meaning how much goes when one account is taken.

What satisfies it. A current directory export of admin accounts, each with a person’s name. Service accounts need owners too, and usually lack them.

If the answer is no. Give the number of admin accounts and say they are not separate from daily use. Then fix it, since it is cheap and cuts risk more than most purchases.

The usual mistake. Leaving out the outsourced IT provider. Your MSP almost certainly holds domain admin credentials, which are privileged accounts in your estate. Answering “two” while six of the provider’s technicians have access is a wrong answer.

4. The last restore test

Typical questions. Do you back up critical data, and how often? Are backups offline, off-site or immutable, and separated from production? When did you last test a restore, and how long would a full one take?

What it tests. Whether ransomware ends in a payment or a restore. That is why insurers care about backups more than most security products.

What satisfies it. A restore test record with the date, what was restored, how long it took and who checked. A job success log does not count, and an unrestored backup is a hypothesis.

If the answer is no. Write “Backups run nightly to [destination], with no full restore test on record. A test is set for [date].” Then run it, which takes an afternoon.

The usual mistakes, from most to least common.

• Answering yes to “offline or immutable” when the backup sits on a network share the same stolen credentials can reach.
• Repeating the vendor’s description of immutability without checking the retention setting on your own tenant.
• Answering yes with no restore ever tested, because the dashboard is green.

5. Protected devices against all devices

Typical questions. Is EDR on all endpoints and servers, and what share is covered? Is there 24/7 monitoring or a managed detection service? Who responds to alerts, and how fast?

What it tests. Detection time, meaning whether an intrusion is noticed in hours or months.

What satisfies it. A console report of enrolled devices against all known devices, with the gap explained. The gap is the number that matters.

If the answer is no. Give the real coverage percentage and name what is uncovered. Usually it is servers, personal devices used for work and the two unmanaged back-office machines.

The usual mistake. Claiming round-the-clock monitoring because the tool runs all the time. Continuous scanning is not continuous monitoring.

The question is whether a person looks at an alert at 2 a.m. on Saturday. If alerts land in an inbox read on Monday, say so, since it is common.

You need not buy managed detection to get through the form. You need to answer correctly and understand what the answer means for detection time.

6. Patching and unsupported systems

Typical questions. They ask how fast critical patches go on and whether you scan for vulnerabilities. They ask about unsupported systems and whether internet-facing systems are patched on a schedule.

What it tests. Whether published, already-fixed flaws stay open. Underwriters increasingly scan your public footprint before quoting, so they may already know.

What satisfies it. Your patch policy, a fleet compliance report and a list of everything past its support date.

A current example. Windows 10 support ended on 14 October 2025, with no more help, updates or security fixes. Commercial Extended Security Updates start at US$61 per device in year one and double each year. List any Windows 10 devices with a count, whether they have ESU, and a replacement date.

If the answer is no. Name the unsupported systems, the count, why they still run, the controls around them and the retirement date. An underwriter can work with three isolated machines behind a segmented network and a retirement date. A blank gives them nothing.

The usual mistake. Remembering workstations and servers but forgetting firewalls, switches, printers, phone systems and the door controller. Their firmware is usually years old.

7. Email controls and training completion

Typical questions. They ask about email filtering, tagging outside mail and DMARC, SPF or DKIM. They ask about phishing simulations, how often you train and what share of staff complete it.

What it tests. The two attack paths behind most claims, credential phishing and business email compromise.

What satisfies it. Dated completion records with a denominator. “Yearly training, completed by 47 of 52 staff as of [date]” is evidence, and “we do training” is not.

If the answer is no. Say so. Training is among the cheapest items on the form, and this no can become a yes by next renewal.

The usual mistake. Counting training bought instead of training completed. The insurer asks about completion.

8. Transfer limits, callbacks and approvers

Typical questions. They ask about wires and ACH payments and their usual and largest amounts. They ask whether you confirm changed instructions by calling a known number. They ask whether large transfers need two approvers, and about past fraud attempts.

What it tests. Social engineering fraud, often covered under a separate sublimit with its own conditions.

What satisfies it. A written payment verification procedure, the threshold and the named approvers. Know whether staff follow it under pressure before the insurer asks.

If the answer is no. Write the one-page procedure. Calling back on a number from your own records, never one in the request, stops most of this fraud. It is the highest-value, lowest-cost control on the whole form.

The usual mistake. Law and accounting firms that handle client funds, escrow or trust accounts think only of their own payroll. Client money is in scope, and the social engineering sublimit may sit far below your policy limit. Ask your broker what yours is, since many buyers learn it only when they need it.

9. Vendors, their access and their contracts

Typical questions. They ask whether you outsource IT, to whom, and which vendors have remote access. They ask whether you assess vendor security, require it in contracts or rely on one provider for critical work.

What it tests. Access you do not control directly. The 2025 Verizon Data Breach Investigations Report covered 22,052 incidents and 12,195 confirmed breaches. Third parties were involved in 30% of the breaches.

Its data is contributed cases, not a population sample, so treat it as direction.

What satisfies it. A vendor list with each one’s access, data and contract terms. Include your identity provider, backup provider, case or practice management SaaS and outsourced IT firm. Add anyone with remote access tools on your machines.

If the answer is no. Most small and midsize organisations have no formal vendor review. Say so, list the vendors and note which contracts you have read. The list is worth more to you than the answer is to the insurer.

The usual mistake. Answering only about software vendors. Your outsourced IT provider is usually your largest third-party risk, since it holds admin access to everything.

10. Plans, tests, incidents and obligations

Typical questions. They ask for your written security policy and incident plan, and when each was last tested or updated. They ask about a security officer and any incident, claim or inquiry in three to five years. They ask which rules apply, such as HIPAA, GLBA or state privacy laws.

What it tests. Whether anyone owns security, and your loss history.

What satisfies it. The documents themselves, with version dates. A policy from 2018 never reviewed answers “yes” truthfully but fails the underwriter’s real question.

Obligations you may need to name. Get these right, since a misstatement can affect both cover and your regulatory position.

If you are	The obligation	Source
A tax or accounting practice	GLBA treats you as a financial institution, so a written data security plan is required. The duty comes from GLBA and FTC rules, with guidance in IRS Publication 4557, revised May 2024	GLBA, the FTC and the IRS
A financial institution under the FTC Safeguards Rule	Keep a written security program. Report certain events affecting 500 or more consumers to the FTC within 30 days of discovery. The rules took effect on 9 June 2023, and notification in May 2024	The FTC Safeguards Rule
A HIPAA covered entity or business associate	Notify individuals without unreasonable delay and within 60 calendar days of discovery, under 45 CFR 164.404 and 164.408. Timing for HHS depends on breach size	HHS, under 45 CFR Part 164
A financial services company regulated by NYDFS	Notify the Superintendent within 72 hours of determining a defined cybersecurity incident occurred, including at an affiliate or third-party provider	NYDFS, 23 NYCRR Part 500
A public company	Generally file within four business days of deciding an incident is material, with that decision made without unreasonable delay	The SEC’s cybersecurity disclosure rule

Whether any of these applies is a legal question. Never answer a regulatory question on an insurance form without counsel confirming it.

The usual mistake. Answering the prior incident question with big breaches in mind. Firms forget the 2023 wire fraud attempt, a contained ransomware event or a lost laptop.

Read the exact wording, lookback period and definition, and answer that. Hiding a prior incident is one of the cleanest grounds for an insurer to contest a claim.

Part 2: Answers that hurt you

Each of these can be fixed before you sign.

1. Yes to MFA when it is partial. It is the most consequential answer on the form. If the breached account was an exception, the forensic report will say so.
2. Yes to immutable backups that are reachable. Production credentials may reach the backups. Ask your provider to show you, in the console, the setting that blocks deletion and who can change it.
3. Yes to a tested incident plan. The test may have been a read-through. A plan that has been read has not been tested. If the decision-makers never walked a scenario together, the plan exists but is unexercised.
4. Undercounting records. It rarely raises premium, but it leaves a limit too small, found during a claim. Notification costs grow with record count.
5. Leaving out a prior incident. See domain 10.
6. Signing without checking the technical answers. An executive often signs, while IT or a provider fills the technical part. Ask the provider for the evidence behind each yes, remembering that it is grading its own work.
7. “We plan to” with no date. Underwriters read an undated plan as a no. A dated plan is a real answer and sometimes earns conditional terms.
8. Answering a question you do not understand. Use “ask the insurer”. Brokers are paid to get you that clarification.
9. Copying last year’s answers. Your estate changed, and so did the form. Last year’s answers can become this year’s misstatements.
10. Naming a product instead of a control. “We have [product]” does not answer “is MFA enforced for all remote access”. A product licensed but not deployed, or deployed but not enforced, is not a control.

Part 3: The evidence index

Build this once and reuse it. It turns next year’s renewal from three weeks into two hours.

#	Question or domain	Answer	Control owner	System	Proof file	Proof date	Test result	Exception owner	Notes

• Control owner. A named person, not a department. If no name fits, that is your finding.
• System. The product or platform where the control lives.
• Proof file. The exact artefact, such as an export, a settings screenshot, a policy PDF, a training report or a restore log. Keep them together, with filenames recorded here.
• Proof date. When the artefact was made. Most evidence goes stale within a year.
• Test result. Whether someone independently checked it works, and when. Most firms leave this blank, and it separates a real control from a claimed one.
• Exception owner. For every partial, who closes the gap and by when.

Part 4: One status sheet for the signer

Track progress so you know when you are done.

Domain	Questions	Yes	No	Partial	Unknown	N/A	Ask insurer	Evidence attached	Owner	Due
1. Organisation and data
2. MFA
3. Admin access
4. Backup and recovery
5. Endpoints and monitoring
6. Patching and end of life
7. Email and social engineering
8. Funds transfer controls
9. Third parties and vendors
10. Governance and history

You are done when unknown is zero. Each unknown left on the form is a decision handed to someone else.

Part 5: An owner and date per gap

You will end with a list of no and partial rows. Sort them into three groups before anyone recommends a purchase.

• Group A costs only attention. Write the callback procedure, and remove stale admin accounts. Turn on MFA your licence already supports, and run a restore test. Switch on the enforcement policy your identity platform already has. Most firms find a third to half of their gaps here.
• Group B costs configuration or time. Segment backups, and separate admin accounts from daily ones. Set up DMARC, write the vendor list, and retire or isolate end-of-life systems.
• Group C costs money. Endpoint detection where none exists, managed detection and response, or replacing hardware that cannot be secured.

Finish A and B before anyone quotes C. Underwriters do not weigh your controls by what they cost.

If a vendor answers your gaps with a proposal, ask which gaps are in Group A. Then ask why those were not its advice.

Part 6: Four questions for your broker

1. The social engineering sublimit. What is it, and what conditions apply? It is often far below the policy limit and may require callback verification.
2. Which answers most affected the quote? A broker who can say is worth keeping, and it shows where fixes would pay.
3. Is the application part of the policy, and what does it say on misrepresentation and rescission? Ask to see the clause.
4. Business interruption. How long before cover starts, and how is the loss measured? Firms are often surprised here after an incident.

Your broker is usually paid by the insurer through commission. That is no reason for distrust. It is a reason to ask questions a commissioned party might not raise.

Keep the form and evidence together

This kit is general guidance on how cyber insurance applications work and how to answer them accurately. It is not legal or insurance advice, and it does not interpret your policy. Cover terms, which rules apply and the effect of each answer depend on your policy, jurisdiction and facts.

Have your counsel and broker review the completed application before you sign.

SBK reviews questionnaire evidence, starting with the unknown and partial rows you are left with. Call (718) 407-4169.