Guide · 5 min read

Cyber insurance applications: answering honestly

Cyber insurance applications have become detailed security questionnaires, and your answers matter long after the policy is issued. Here are the questions insurers ask, why accuracy protects you, and how to improve your answers before renewal.

Why your answers matter so much

Your application is part of the basis for your policy. If you file a claim and the insurer finds that a key answer was inaccurate (for example, you said MFA was required everywhere, but it wasn’t on the account that was breached), it may dispute or deny the claim. An honest “no” might raise your premium. An inaccurate “yes” can cost you the coverage when you need it most.

The questions you’ll almost always see

Multi-factor authentication: Is MFA required for email, remote access, and admin accounts? Insurers often ask about each separately. Answer for each one specifically.
Backups: Are backups kept separate from your main network (offline or immutable), and have you tested restoring them?
Endpoint protection: Do all computers run up-to-date antivirus or endpoint detection and response (EDR)?
Patching: How quickly are critical security updates installed?
Email security: Do you filter malicious email and protect your domain with SPF, DKIM, and DMARC?
Training: Do staff receive phishing awareness training?
Payments: Do you verify changes to payment or wire instructions by phone before sending money?
Incident response: Do you have a written incident response plan?
Sensitive data: How many records of personal, health, or payment information do you hold?

How to answer well

Read each question literally. “MFA for all remote access” includes the old remote desktop connection your IT provider set up years ago.
Check, don’t assume. Confirm settings with your IT provider before answering, and keep a note of who confirmed what, and when.
Use the comments field. If the honest answer is “partly,” explain it: “MFA enforced for all staff email; rollout to finance system scheduled for May.”
Keep a copy. Save the submitted application with your policy, and start from it at renewal.

Improve your answers before renewal

Start 60 to 90 days before renewal. The highest-impact fixes, which also tend to lower premiums, are usually MFA on email and remote access, separated and tested backups, and verified payment-change procedures. The security essentials checklist covers all three.

Need help?

I help organizations answer cyber insurance applications accurately, flag the gaps, and fix them in priority order. See Due-Diligence Support, or book a free intro call.

This guide is general information, not legal or insurance advice. Your policy wording and your broker set the actual terms.