Cyber insurance questionnaire help
Answering yes to a control you do not actually have is the fastest way to turn a paid policy into a denied claim. Here is what carriers mean by the eight questions that trip up small businesses most, and the evidence you should have on hand before you sign.
Answers on a cyber application are warranties. If a control you claimed was not in place at the time of loss, the carrier can rescind coverage. Accuracy matters more than a good score.
Question 01
Do you enforce multi-factor authentication for email and remote access?
What they mean: The carrier means enforced for every user by policy, including the owner and any shared mailbox, not merely available or enabled for most people.
Evidence to have ready: Be ready to show a conditional access or MFA enforcement policy and a report listing users without MFA registered.
Question 02
Do you use endpoint detection and response (EDR) on all endpoints?
What they mean: Traditional antivirus does not count with most carriers. They are asking for a managed detection product with alerting and rollback.
Evidence to have ready: A device inventory reconciled against your EDR console, showing coverage percentage and any unmanaged machines.
Question 03
Are backups tested, encrypted, and stored offline or immutably?
What they mean: Three separate claims. The backup must exist, it must be protected from your own compromised admin account, and a restore must have been tested recently.
Evidence to have ready: A dated restore test record. The test is the part almost every applicant skips and the part adjusters check after a claim.
Question 04
Do you have email authentication in place (SPF, DKIM, DMARC)?
What they mean: DMARC at p=none is monitoring, not protection. Carriers increasingly want quarantine or reject to count this as a yes.
Evidence to have ready: Your published DNS records. The free scan on this site checks all three in about fifteen seconds.
Question 05
Do you have a written incident response plan?
What they mean: A named decision-maker, a call order, your carrier's claims hotline, and a definition of what triggers the plan.
Evidence to have ready: The document itself, plus a record of at least one tabletop exercise walking through it.
Question 06
Do you patch critical vulnerabilities within a defined timeframe?
What they mean: They want a stated window, usually 14 or 30 days for critical severity, and evidence you meet it.
Evidence to have ready: Patch compliance reporting from your RMM or endpoint management tooling.
Question 07
Do you provide security awareness training and phishing simulations?
What they mean: Annual click-through training is the floor; simulated phishing with tracked results is what earns credit.
Evidence to have ready: Completion records by employee and simulation results over time.
Question 08
Do you perform verification callbacks before changing payment details?
What they mean: This is the fraudulent-funds-transfer question. A verbal callback to a known number, not the number in the email.
Evidence to have ready: A written procedure and proof your finance staff have acknowledged it.
Start with what the carrier can already see
Underwriters run external scans of your domain before they quote. Run the same kind of check yourself first.
Walk the application with someone who reads them
The $250/month Managed IT + Cyber Insurance Readiness plan covers your carrier's exact form: we track MFA, backups, EDR, training, and email authentication, keep the evidence current, and maintain a written answer sheet you can hand to your broker at renewal.
Book a call