Why insurers ask these questions
Insurers use your answers to decide whether to offer coverage and at what price. The questions focus on the basics that stop the most common attacks, like stolen passwords and ransomware. Your answers need to match how things really work in your business, since the application is part of your policy.
What the common questions mean
Wording varies by insurer, but these come up often:
- What the insurer asks
- Do you use multifactor authentication (MFA)?
- What it means
- Is there a second lock on your email and remote access?
- What the insurer asks
- Do you have endpoint detection and response (EDR)?
- What it means
- Do your computers have antivirus that watches for break-ins?
- What the insurer asks
- Do you keep offline or immutable backups?
- What it means
- Is there a copy of your files you can actually get back, kept where ransomware can't reach it?
- What the insurer asks
- Do you provide security awareness training?
- What it means
- Does your team know how to spot a fake email?
- What the insurer asks
- Are security patches applied promptly?
- What it means
- Are your computers and devices getting their updates?
- What the insurer asks
- Do you have an incident response plan?
- What it means
- Is there a written plan for who does what if you're hacked?
- What the insurer asks
- Do you restrict administrative privileges?
- What it means
- Do everyday accounts lack the power to install software or change settings?
- What the insurer asks
- Do you verify requests to change payment or bank details?
- What it means
- Do you call to confirm before sending money to a new account?
| What the insurer asks | What it means |
|---|---|
| Do you use multifactor authentication (MFA)? | Is there a second lock on your email and remote access? |
| Do you have endpoint detection and response (EDR)? | Do your computers have antivirus that watches for break-ins? |
| Do you keep offline or immutable backups? | Is there a copy of your files you can actually get back, kept where ransomware can't reach it? |
| Do you provide security awareness training? | Does your team know how to spot a fake email? |
| Are security patches applied promptly? | Are your computers and devices getting their updates? |
| Do you have an incident response plan? | Is there a written plan for who does what if you're hacked? |
| Do you restrict administrative privileges? | Do everyday accounts lack the power to install software or change settings? |
| Do you verify requests to change payment or bank details? | Do you call to confirm before sending money to a new account? |
How to answer accurately
- Start early. About 60 days before your renewal leaves time to fix gaps before the form is due.
- Check, don't guess. “I think we have that” isn't the same as confirming it's turned on for every account and computer.
- Write it down. Keep a short record of what's in place and when it was set up, so you have proof if your insurer asks.
- Ask your agent. If a question is unclear, your insurance agent can tell you what the insurer is looking for.
Want help with the form?
Cyber Insurance Ready walks through your questionnaire question by question, fixes what's within reach before renewal, and documents what's in place, for one fixed price after a free consultation.
This guide is general information, not insurance or legal advice. Coverage and pricing decisions belong to your insurer.