Get ready for your cyber insurance questionnaire
Cyber insurers now ask detailed questions about multi-factor sign-in, backups, patching and admin accounts. We help you understand each question, answer it truthfully and close the gaps before renewal rather than after a claim.
Cyber insurance readiness for small and medium businesses
The renewal form arrives with forty questions, half of them full of technical terms, and it lands on the desk of whoever handles the insurance, often an office manager or business owner with no IT background. The temptation is to tick yes and move on. That is risky. If a claim is investigated and an answer turns out to be wrong, such as saying every account uses multi-factor sign-in when the shared reception login does not, the insurer may have grounds to reduce or decline the claim.
We go through the questionnaire with you line by line and check each answer against what is actually configured. Where the true answer is yes, we note how it is done and keep a record you can point to later. Where it is no or partly, we explain what the insurer is really asking about, why it matters to them, and what it would take to change the answer. Some gaps close in an afternoon; others, like replacing an unsupported server, need a plan and a budget.
Insurers tend to focus on a familiar set of controls: multi-factor sign-in on email and remote access, separate admin accounts, endpoint protection, regular patching, backups kept offline or unchangeable, email filtering and staff awareness training. We put those in place in a sensible order and keep them running. You end up with better protection, a more confident renewal and evidence on hand if you ever need to make a claim.
What's included
Questionnaire walk-through
We read each insurer question with you, explain the technical terms and check the real answer against your systems rather than guessing.
Gap list
A short, ranked list of the controls you are missing or only partly have, with the effort and rough cost of fixing each one.
Multi-factor sign-in rollout
MFA set up on Microsoft 365, remote access, admin portals and cloud apps, including the awkward shared and service accounts insurers ask about.
Admin account separation
Everyday accounts stripped of admin rights, with separate privileged accounts used only when needed and protected more tightly.
Backup evidence
Confirmation that backups are kept separately, protected from deletion and test-restored, with dates and results you can show an insurer.
Endpoint protection and patching
Business-grade protection on every computer and a steady update routine, both reported so you can prove they are working.
Staff awareness
Short, practical training on phishing and payment fraud, with records of who completed it, which many insurers now ask for.
Evidence pack
Screenshots, settings summaries and reports gathered in one folder, ready for renewal or for the questions that follow a claim.
Who is cyber insurance readiness for?
This is worth doing if:
- Your cyber insurance renewal is due in the next few months
- You were declined cover or quoted a much higher premium than expected
- You ticked answers on last year's form and are not sure they were right
- A client contract now requires you to hold cyber insurance
- Your broker has asked for proof of multi-factor sign-in or backups
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkCyber insurance readiness questions
Can you fill out the insurance form for us?
We help you answer it accurately, but the form is a declaration by your business, so someone in the business should sign it. We give you the facts behind each technical answer and a record of how we checked them.
Do you sell insurance or recommend insurers?
No. We are not insurance brokers and do not earn anything from a policy. Your broker or insurer advises on cover; we help with the technical controls and the questions about them.
What do insurers ask about most?
Questions vary between insurers, but multi-factor sign-in, backups, patching, endpoint protection, admin rights and email security come up again and again. Those are also the controls that prevent many common attacks, so the work is worth doing anyway.
We use Microsoft 365. Are we already covered?
Not automatically. Microsoft 365 includes many security features, but several must be switched on and configured, and some depend on your licence level. We check what is actually enabled rather than what is available.
How long does it take to get ready?
A questionnaire review and gap list usually takes a few hours. Closing the gaps can take days or weeks depending on what is missing. Starting a couple of months before renewal gives you room to fix things properly.
How much does readiness work cost?
The review is billed at our hourly rate. Several of the controls insurers ask about are part of our plans, such as email filtering and Microsoft 365 backup in Managed, and multi-factor sign-in policies and staff training in Complete. Larger changes are quoted in writing first.
Will this lower our premium?
We can't promise that, because pricing is up to the insurer. What good controls do is let you answer honestly, avoid nasty surprises at claim time and reduce the chance of needing to claim at all.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT supportCyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security