Preparing for a cyber insurance questionnaire

Cyber insurance applications have grown from a few questions to several pages of security controls. Answering inaccurately can create problems if you ever need to file a claim, so it's worth understanding what's being asked and where you actually stand.

Questions that commonly appear

• Multi-factor authentication: is it required for email, remote access, and administrator accounts?
• Endpoint protection: do computers and servers run endpoint detection and response (EDR) or similar protection?
• Backups: are backups kept separate from your main network, tested, and protected from being altered or deleted?
• Patching: how quickly are security updates applied?
• Email security: is incoming email filtered, and do you use SPF, DKIM, and DMARC?
• Training: do employees receive security awareness training?
• Incident response: is there a written plan for responding to an attack?
• Payment verification: are changes to payment instructions confirmed by phone?

How to prepare

Gather your answers before the renewal deadline, not the week it's due. For each question, note whether the control is in place, partially in place, or missing, and what evidence you have. Where controls are missing, prioritize the ones insurers weigh most heavily, which are usually MFA, backups, and endpoint protection.

Answer accurately

If a control only covers some users or systems, say so. Your insurer and broker can advise on how partial controls affect coverage. An accurate application with a plan to close gaps is better than an optimistic one that doesn't match reality.

Zach Albano

Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.