Cyber-insurance underwriters commonly ask about multifactor authentication, endpoint detection and response with around-the-clock monitoring, tested backups with offline or immutable copies, email security, privileged access, patching, security awareness training and a tested incident response plan. To be ready, put those controls in place, answer every application question literally and accurately, and keep dated evidence that supports each answer.
Applications and renewal questionnaires have become detailed security assessments in their own right. They ask how you sign in, how you back up data, who watches for threats and what you would do in an incident. For many organizations, the application is the first time anyone has written those answers down.
Requirements vary by carrier, policy and the size and type of your organization, and they change over time. Still, a common set of controls appears on many applications. This guide explains what underwriters commonly ask about, what a strong answer usually looks like, and how to keep the evidence that supports it.
A note on our role: ACS Cyber does not sell insurance, and we do not decide coverage, pricing or eligibility. Your broker and carrier do. We help organizations prepare: assessing gaps, strengthening controls and organizing evidence.
Every carrier and application is different. Use this as a preparation guide, and confirm the specific requirements of your application with your broker.
Why underwriters ask about controls
Insurers price risk. The controls they ask about tend to be the ones that reduce the likelihood or the impact of common claims, such as ransomware, Business Email Compromise and data theft. Your answers become part of the application, which is why accuracy matters as much as the controls themselves.
The controls underwriters commonly ask about
Multifactor authentication
MFA is one of the most frequently asked-about controls. Applications commonly ask whether it is required for email, for remote access such as VPN and remote desktop, for administrator and privileged accounts, for cloud applications and for access to backups.
Pay attention to scope. A question about “all users” or “all remote access” is answered differently if a few accounts or a legacy system are excluded. Our Microsoft 365 security baseline covers MFA and Conditional Access in detail.
Endpoint detection and response, and monitoring
Many applications ask whether endpoint detection and response (EDR) is deployed across workstations and servers, and whether its alerts are monitored around the clock, either by internal staff or a managed provider. Having the software installed and having someone watching it are often separate questions.
If the distinction is unclear, our guide to EDR vs. MDR explains it, and our managed detection and response service provides 24/7 security monitoring by our in-house SOC.
Backups with offline or immutable copies
Backups are central to recovering from ransomware, so underwriters often ask detailed questions about them:
- Whether at least one copy is offline, immutable or otherwise separated from the main network
- Whether backups are encrypted and protected by MFA and separate credentials
- How often backups run for critical systems and data
- Whether restores are tested, and when the last successful test took place
- How long it would take to restore critical systems
Email security
Email remains a common way into an organization. Expect questions about filtering for phishing and malware, scanning of links and attachments, tagging of external senders, and email authentication with SPF, DKIM and DMARC.
Applications that include funds-transfer or social-engineering coverage often ask about payment procedures as well, such as whether changes to bank details are verified by phone using a known number and whether large transfers require a second approver.
Privileged access
Underwriters want to know how administrative access is controlled. Common questions cover separate admin accounts for IT staff, the number of people with domain or global administrator rights, whether everyday users have local administrator rights on their computers, and how service accounts are managed and monitored.
Patching and vulnerability management
Applications often ask how quickly critical security updates are applied, whether you scan for vulnerabilities, how internet-facing systems are protected, and whether any unsupported or end-of-life software remains in use. A documented process matters as much as the speed itself. Our vulnerability management service covers scanning, prioritization and validation after remediation.
Security awareness training
Expect questions about how often staff complete security training, whether you run phishing simulations, and whether people in finance or executive roles receive training on payment fraud and impersonation. Security awareness training with completion records answers these questions directly.
Incident response plan
Underwriters commonly ask whether you have a written incident response plan, whether it has been tested, for example through a tabletop exercise, and whether it includes your insurer’s claims process and contacts. A plan that has never been rehearsed is far less useful when it matters.
Vendor and third-party management
Incidents can start with a supplier. Applications may ask how vendors access your systems, whether vendor remote access requires MFA, how you review the security of critical vendors, and whether contracts address security and incident notification.
Other areas that often come up
- Whether remote desktop services are exposed directly to the internet
- Network segmentation between critical systems and the rest of the environment
- Logging and how long logs are retained
- Encryption of laptops and sensitive data
- The types of sensitive records you hold, such as personal information, health information or payment card data
- Compliance obligations that apply to you, such as the HIPAA Security Rule or PCI DSS
How to answer applications accurately
An application is a set of statements about your environment. Treat it with the same care you would give any document you sign.
- Read each question literally. “All users” means all users. “Enforced” usually means more than available.
- Answer for today, not for your plans. If a control is in progress, say so where the form allows, rather than answering yes.
- Involve the people who know. Ask your IT team, IT provider or security partner to review technical answers before you submit.
- Disclose exceptions honestly. A single legacy server without EDR or a service account without MFA is better explained up front.
- Ask when a term is unclear. If you are not sure what a question means, ask your broker rather than guessing.
- Keep a copy of what you submitted. You will want it at renewal, and you may need it if you file a claim.
- Revisit answers before every renewal. Your environment changes, and so do the questions.
Inaccurate answers can create problems if you ever need to make a claim. If you are unsure how to answer a question, work with your broker and your legal counsel.
Keep evidence that supports your answers
Underwriters may ask for proof, and a claim may require you to show that controls were in place. Evidence is easiest to produce when you collect it as you go. Useful records include:
- MFA policy settings and registration reports showing coverage
- EDR deployment reports showing which devices are protected
- Backup job reports and dated records of restore tests
- Training completion records and phishing simulation summaries
- Patch status reports and vulnerability scan results
- Your incident response plan and notes from tabletop exercises
- An inventory of vendors with access to your systems
Store these records securely, date them, and refresh them on a regular schedule. Treat them as confidential: they describe how your defenses work.
A practical approach before renewal
- Start early. Review last year’s application and any new questions from your broker well before the renewal date.
- Run a gap assessment. Compare each question with what is actually in place today. A cybersecurity assessment from Atlantic Computer Systems, our parent company, is one way to do this.
- Close the most significant gaps first. MFA, monitored EDR and tested backups usually come before lower-impact items.
- Collect the evidence. Gather the reports and records that support each answer.
- Complete the application with your technical team. Review it together before it is submitted.
- Maintain the controls. Readiness is ongoing, not a once-a-year project.
Atlantic Computer Systems, our parent company, also outlines the cyber insurance requirements medical practices commonly face.
If you have an incident: working with your insurer
Readiness also means knowing what to do when you need the policy. Many cyber policies set notice requirements, and some assign a response firm or ask you to use approved providers. Decisions made in the first hours can affect how a claim is handled, so plan them in advance.
- Keep the carrier’s claims line and your policy number with your incident response plan, somewhere you can reach if email is down
- Notify the carrier as the policy requires, and check whether outside costs need the carrier’s approval before you commit to them
- Bring in legal counsel early; counsel advises on notification obligations and may direct parts of the response
- Ask your broker now whether your carrier assigns a response firm, and whether your own security partner can work alongside it
ACS Cyber works alongside insurer-assigned response firms where your policy permits, and when you authorize it, we coordinate with your insurer and legal counsel. Our forensic investigation is performed in-house, with documented evidence handling and chain of custody, so your carrier and counsel can work from a clear, documented record.
If you have already been compromised, our Have you been compromised? page explains how we contain the threat, find out what happened, work with your insurer and counsel, help you restore operations and prevent a repeat. Our 24/7 incident line at 1-650-300-7557 is open to clients and non-clients alike. For the first actions to take, including when to call your carrier, see what to do if you think you have been compromised.
How we help
Our risk and compliance team supports cyber-insurance readiness through gap assessments against the controls in your application, remediation of the gaps we find, and evidence preparation. Our advisory and vCISO services add incident response planning and tabletop exercises, and our managed detection and response service provides 24/7 monitoring between renewals.
We cannot promise any particular coverage decision or premium; those belong to your carrier. What we can do is help you answer accurately and strengthen the controls behind your answers.
Get ready for your next renewal
If an application or renewal is coming up, book a free 30-minute consultation with our security team. We will review where you stand and which gaps to close first. If you are dealing with an active incident, call our 24/7 incident line at 1-650-300-7557.