What your cyber insurance questionnaire is really asking

A few years ago, buying cyber insurance meant a short application and a signature. Today, many carriers send a detailed security questionnaire, and the answers can determine whether you get coverage, what it costs and — critically — whether a future claim gets paid.

Most small and mid-size businesses aren’t sure what the questions mean. Here is what the most common ones are really asking, and why carriers care.

This article is general guidance, not legal or insurance advice. Always review your policy and application with your broker.

Why the questions got harder

Ransomware and business email compromise turned cyber insurance into an expensive line for carriers. They responded by asking for proof that businesses have basic controls in place — the ones that stop the most common attacks.

The important thing to understand: your answers become part of the policy. If you answer “yes” to a control you don’t actually have, the carrier may have grounds to deny a claim. Accuracy matters more than a perfect score.

“Do you enforce multi-factor authentication?”

This is usually the first and most important question. Carriers often ask about MFA in several places:

• Email, including webmail and mobile access
• Remote access, such as VPN or remote desktop
• Privileged or admin accounts
• Cloud applications that hold sensitive data

What they’re really asking: If someone steals a password, can they log in with it alone?

Stolen credentials are one of the most common ways attackers get in. MFA blocks a large share of those attempts. “We have MFA for some people” is not the same as “MFA is enforced for all users,” so answer precisely.

“Do you use endpoint detection and response (EDR)?”

What they’re really asking: Do you have something on your computers and servers that watches behavior, not just known viruses — and can it stop an attack in progress?

Traditional antivirus looks for known malware. EDR watches for suspicious activity, like a program suddenly encrypting files or an admin tool being used in an unusual way, and can isolate a machine automatically.

Many carriers also ask whether alerts are monitored 24x7. That’s where managed detection and response (MDR) or a security operations center (SOC) comes in: people watching the alerts around the clock, including nights and weekends when many attacks begin.

“Are your backups offline, immutable or segregated?”

What they’re really asking: If ransomware hits, can the attacker also destroy your backups?

Attackers routinely look for backup systems and delete or encrypt them before launching the main attack. A backup on a drive that’s always connected to your network may not survive.

Carriers want to see at least one copy that is:

• Offline or segregated — not reachable with normal network credentials
• Immutable — can’t be altered or deleted for a set period, even by an administrator
• Tested — you’ve actually restored from it recently

If you can’t say when you last tested a restore, that’s the first gap to close.

“How do you protect privileged accounts?”

What they’re really asking: If an attacker gets in, how quickly can they become an administrator?

Good answers include separate admin accounts (not everyday logins with admin rights), MFA on every admin account, a short list of people with admin access, and logging of admin activity.

“Do you filter email and train employees?”

What they’re really asking: How likely is it that one convincing email leads to a loss?

Email remains the front door for most attacks. Carriers look for an email security layer beyond the default filtering, plus regular security awareness training — ideally with simulated phishing tests so you know whether it’s working.

“Do you verify payment and banking changes?”

What they’re really asking: If someone emails your bookkeeper pretending to be a vendor with “new bank details,” will the money go out?

This question targets funds-transfer fraud. A good answer is a written process: any change to payment instructions is verified by phone using a number you already have on file — never one from the email.

“Are your systems patched and supported?”

What they’re really asking: Are you running software that no longer gets security updates?

Carriers ask about patching timelines and end-of-life systems. An old server or operating system that no longer receives updates can be a significant risk, and some carriers will ask you to replace it or isolate it.

“Do you have an incident response plan?”

What they’re really asking: When something happens, do you know who to call and what to do in the first hour?

A plan doesn’t need to be long. It should list who makes decisions, who to contact (your IT provider, your carrier’s breach hotline, legal counsel), and the first steps to contain an incident. Many policies require you to use the carrier’s approved response vendors, so check that before an incident.

How to approach the questionnaire

1. Answer honestly. A “no” with a plan to fix it is better than a “yes” you can’t back up.
2. Fix the big ones first. MFA everywhere, EDR with 24x7 monitoring, and protected, tested backups address many of the most common questions.
3. Document what you have. Screenshots, policies and test results make renewals easier.
4. Start early. Some controls take weeks to roll out. Begin at least 60 to 90 days before renewal.

Where we can help

Jay Johnson has spent more than 25 years running managed IT and security, including hands-on recovery from ransomware and email compromise. We’ll walk through your questionnaire with you, explain what each question is asking, identify the gaps, and compare the security providers that can close them — at no cost to you.

Facing a renewal? Ask The Agent C “Help with our cyber insurance form,” or book a call with Jay.