Key takeaways
- Applications now read like security questionnaires
- MFA, EDR and tested offline backups are asked about most
- Answer from evidence, since inaccurate answers can affect claims
- Coverage for wire fraud and ransomware varies by carrier
Why insurers ask about security
Ransomware and business email compromise made cyber claims expensive, so carriers began underwriting the way they do for fire risk: they ask what protection is in place. A missing control can mean a higher premium, a lower limit, an exclusion or a declined application.
The answers matter after a claim, too. If the application said MFA was enforced everywhere and it was not, the carrier may question the claim. Answer accurately, and close gaps before you sign.
Controls insurers commonly ask about
- Multifactor authentication on email, remote access, admin accounts and backups
- Endpoint detection and response on every workstation and server, not only antivirus
- Patching on a regular schedule, with critical updates applied promptly
- Backups that are encrypted, kept offline or immutable, separated from the network and tested by restoring
- Email security that filters spam, phishing and malicious attachments
- Security awareness training and phishing simulation for staff
- Privileged access: separate admin accounts, with no everyday work done as an admin
- Remote access through a VPN or secure gateway, with no remote desktop open to the internet
- End-of-life systems identified, isolated or replaced
- An incident response plan in writing, with contacts and first steps
- Payment verification: a call-back process before changing bank details or sending a wire
How to prepare your application
Get the questionnaire early
Ask your broker for the renewal application well before it is due, so there is time to close gaps rather than explain them.
Answer from evidence
Check each answer against reports and settings, not memory. Yes for most users is not the same as yes.
Close the quick gaps
MFA on the remaining accounts, removing old admin rights and confirming EDR coverage on every device are often fast fixes.
Keep the proof
Save reports, screenshots and policies. Carriers sometimes ask for evidence, and it helps if you ever need to make a claim.
Coverage questions to ask your broker
Controls get you insured; the policy wording decides what is paid. Terms differ between carriers, so ask your broker how your policy handles each of these.
- First-party costs: forensics, data restoration, business interruption and extortion
- Third-party liability: claims from clients, regulators and card brands
- Social engineering and funds transfer fraud, often limited or added by endorsement
- Required vendors: whether you must use the carrier’s panel for incident response
- Waiting periods before business interruption coverage starts
- Exclusions, such as for unpatched systems or acts of war
How we help
Insurance applications ask direct questions, and we help you answer them accurately. With managed IT from ManagedITServices.Tech, Endpoint MDR Plan I runs on every managed workstation and server, email filtering and security awareness training come with every supported user, and patching is part of each managed workstation. Backup and disaster recovery, with air-gapped copies and failover testing, is available as an add-on.
We document the controls in place so you can complete the security questions, and the security roadmap in your vCIO plan is aligned with your cyber insurance and compliance needs.
Sources
- CISA: Cyber Essentials
- CISA: Require multifactor authentication
- CISA: #StopRansomware Guide
- NIST Cybersecurity Framework
Information on this page is general and is not legal or compliance advice.