Who asks and what they want
Small businesses meet IT questionnaires in several places. Cyber insurers ask at application and renewal. Larger customers, especially government agencies, banks and big corporates, send supplier security questionnaires before signing contracts. Accountants and auditors sometimes review IT controls as part of a financial audit. Industry bodies and franchisors may have their own requirements.
The wording varies but the substance is similar. They want to know that you are unlikely to be breached through an obvious gap, that you could recover if you were, and that someone in the business takes it seriously. They are rarely expecting enterprise-grade controls from a ten-person firm, but they do expect the basics to be in place and to be described accurately.
The controls almost everyone asks about
Multi-factor authentication is top of nearly every list: on email, remote access, admin accounts and cloud systems that hold sensitive data. Next come backups: what's backed up, whether a copy is kept separate from the main systems so ransomware can't reach it, and when a restore was last tested. Then updates and patching for computers, servers and network equipment, and endpoint protection on every device.
Expect questions about admin access (who has it and whether daily accounts are separate from admin ones), email security (filtering, and protections against spoofing such as SPF, DKIM and DMARC records), staff security training, and whether you have an incident response plan. Some questionnaires ask about firewall management, unsupported software, encryption of laptops and how payments are verified.
Gather your evidence
Start a folder for the review and collect proof for each control. Screenshots of MFA settings in Microsoft 365 or Google Workspace, a report from your endpoint protection console showing devices covered, a backup report and a note of the last restore test, your list of admins, and copies of policies such as the acceptable use policy and incident plan. If you use an IT provider, ask them for these; a good provider can produce most of them quickly.
Insurers sometimes ask for the date of your last security review or vulnerability scan, the number of devices running unsupported operating systems, and whether you have a separate offline or immutable backup. Know these answers before you start filling in forms, rather than guessing as you go, and keep the date you gathered each one so you can show the evidence is current.
Fix the quick gaps first
Reviews often expose small gaps that can be fixed in days: a few accounts without MFA, an old laptop running an unsupported operating system, a firewall still on default admin credentials, DMARC never configured, a backup that nobody has test-restored. Prioritise these before you submit, so you can answer yes truthfully rather than explaining an exception.
Bigger gaps, such as replacing an old server or moving to a new backup system, take longer. Don't hide them. Note what you're doing and when it will be finished. Insurers and customers are generally more comfortable with a known gap and a plan than with an answer that later turns out to be wrong.
Answer accurately
This is the most important point. Insurance questionnaires form part of the contract, and an inaccurate answer can give the insurer grounds to decline or reduce a claim. If you tick 'MFA is enforced on all accounts' and the breach comes through an account without it, that matters. Read each question carefully, ask your broker if the meaning is unclear, and qualify your answer where you need to. Have the person who actually manages IT check the answers before they go in. Owners often believe controls are in place because they were discussed once, when in fact they were never finished. A quick check by your IT provider avoids that mismatch.
Use the review as a plan
After the review, keep the evidence folder and the questionnaire. Next year you'll be asked the same questions, and having last year's answers makes renewal much faster. Any gaps you noted become your IT priorities for the coming months. Many businesses find that preparing for one review prepares them for all of them. The same evidence answers the insurer, the big customer and the auditor. Keep it current and the next questionnaire becomes an afternoon's work rather than a stressful week. It is also worth sharing a summary with your broker between renewals when you finish a significant improvement, such as rolling out MFA everywhere or adding an offline backup, since some insurers take that into account when setting terms.
In short
- Most reviews focus on MFA, backups, updates, endpoint protection, admin access and training.
- Collect screenshots and reports as evidence before you start the form.
- Fix quick gaps first so you can answer truthfully.
- Never overstate a control on an insurance questionnaire.
- Keep the evidence folder for next year's renewal.