← All guides
Owner guide
What your cyber insurance application is really asking
Every renewal, your cyber insurer asks a list of technical questions. Your answers set the premium, and a wrong one can give the insurer grounds to deny a claim later.
Why the answers matter
The application becomes part of your policy. If you answer "yes, we use MFA everywhere" and an attacker gets in through an account without it, the insurer can argue the policy was based on wrong information. Answer what is true today, not what you plan to do.
The questions you will almost always see
- Multi-factor authentication. On email, remote access, and every admin account? Partial MFA is the most common wrong answer. MFA in two minutes →
- Backups. Is a copy kept offline or separate from your network, and when did you last test a restore? A backup that has never been restored is a guess.
- Endpoint protection. Is modern antivirus or EDR on every computer and server, including the front desk PC?
- Email filtering. Do you filter incoming email for phishing and malware?
- Updates. Are systems patched promptly, and is any software past its end of support?
- Training. Do staff get regular phishing awareness training? Records help. Our training →
- Admin rights. Do everyday users log in without administrator access?
- Incident plan. Is there a written plan for what to do if you are attacked?
How to answer well
- Mark every question you cannot answer with confidence, and ask your IT support for evidence, not reassurance.
- Fix the gaps you can before the renewal date. MFA and tested backups move the needle most.
- Never guess. If the honest answer is "partly," say so and explain.
Our audit checks each of these on your actual systems, so you can answer with evidence.
Questions? Talk to us, or request a quote.