Cyber insurance questionnaires: what insurers ask and how to answer honestly

Why the questions have become tougher

A few years ago, buying cyber cover meant ticking a box about antivirus. As ransomware claims rose, insurers learned which controls made the difference between a small claim and a catastrophic one, and their application forms grew accordingly. Today many forms ask detailed questions, and some insurers or brokers will scan your internet-facing systems before quoting. The questions are not arbitrary. Each one maps to a common cause of large losses. Understanding the reasoning helps you answer precisely and, more usefully, tells you which controls to prioritise if you cannot honestly say yes yet.

Multi-factor authentication

Expect questions about MFA on email, remote access, cloud services and administrator accounts, often as separate items. Read them carefully. Having MFA on most Microsoft 365 users is not the same as having it on all users, and an old service account or a shared reception mailbox without MFA can make a yes untrue. Remote access is often asked about specifically: VPN, remote desktop gateways and remote support tools. If any of those let someone in with just a password, fix that before you answer.

Backups

Insurers want to know how often you back up, whether at least one copy is offline, immutable or segregated from your main network, whether backups are encrypted, and when you last tested a restore. Some ask how long a full recovery would take. A backup drive plugged into the server permanently is not offline, and a sync service like OneDrive on its own is generally not treated as a backup. Have evidence ready: the backup product, the retention settings, where the immutable copy lives and a dated note of your last restore test with how long it took.

Endpoints, patching and privileges

Questions here cover whether you run EDR on every computer and server, who monitors it, how quickly critical patches are applied, whether any unsupported software or operating systems are still in use, and whether staff work without local admin rights. Answer the EDR question carefully: traditional antivirus is usually not what the insurer means. Unsupported systems are a common stumbling block. An old Windows server running a legacy application, or a PC in the workshop that never got upgraded, may need to be disclosed. Insurers often accept a documented plan to replace it, but they want to know it exists.

Email, training and payments

Expect questions on email filtering, whether external emails are tagged, whether staff receive security awareness training and how often, and whether you verify changes to supplier bank details by calling a known number. These relate to business email compromise and invoice fraud, which make up a large share of small business claims. If you have a payment verification process, write it down. A one-paragraph procedure that says who checks, how and when is far more convincing than a verbal assurance.

Incident plans and the honesty rule

Many forms ask whether you have a written incident response plan and whether it has been tested. A short, practical plan with names, phone numbers and first steps counts. A tabletop exercise once a year, with notes, shows it has been tested. Keep the attendance list and the actions that came out of it, because those are what an insurer would ask to see if they queried the answer later.

The overriding rule is to answer truthfully as of the day you sign. If a control is planned but not finished, say so and give a date. Policies typically rely on the information you provided, and a gap between what was declared and what was in place can affect cover. Keep a copy of the completed questionnaire and your evidence together, and update it at each renewal. If you would like help gathering that evidence, an Office IT health check can walk through each question against your actual setup.

Getting ready before renewal

Start the process a couple of months before your policy renews rather than the week it is due. Ask your broker for the current application form, because the questions change from year to year and between insurers. Go through it with whoever manages your IT and mark each answer as yes with evidence, partly, or no. The partly answers are where most of the risk sits: MFA on everyone except one shared account, EDR on laptops but not the server, backups that are separate but never tested.

Then decide which gaps you can close before signing. Turning on MFA for a missed account, removing an unused remote access tool or running and recording a restore test can often be done within a few weeks. Bigger items, such as replacing an unsupported server, can be disclosed with a dated plan. Arriving at renewal with a tidy evidence pack usually makes the conversation with the broker shorter and the terms easier to negotiate.