What does my cyber insurance application want me to have?
Updated October 30, 2026
Most cyber insurance applications ask for proof of the same handful of controls: multi-factor sign-in, endpoint protection (security software on each computer that watches for attacks), backups that are separate and tested, regular patching, email filtering, and staff training. Check each one system by system, answer truthfully, and ask your broker how your answers affect your coverage. Start weeks before the renewal, because gathering proof takes longer than reading the form.
Steps
- Get the application early and list the systems it asks about: email, remote access, administrator accounts, every computer and server, and cloud apps. Gathering proof takes weeks.
- Check multi-factor sign-in on each one. How to answer the MFA questions honestly walks through it.
- Check endpoint protection: which tool, which devices, and who watches the alerts. What EDR is, and whether you have it.
- Check your backups are separate, protected, and tested, and note the date of your last restore. How to answer the backup questions.
- Check updates: how patches are applied, and whether any software is too old to receive them.
- Check email security and training, and find the records. What counts for the phishing and email questions.
- Write a short incident plan with who to call first, including your insurer’s reporting line.
- Put the evidence in one folder, and ask your broker about anything you aren’t sure of before you sign.
Details
What insurers commonly ask
Requirements vary by insurer, but current applications commonly ask about the same controls:
- Multi-factor sign-in on email, remote access, and administrator accounts.
- Endpoint protection that detects and responds to attacks.
- Backups that are protected and tested.
- Regular patching, and software too old to receive updates.
- Email filtering and staff training.
- A written incident response plan, and who has administrator access.
Answer for every system, not just email
Each question is about every system it names, so a control that covers email but not remote access, or most computers but not the server, isn’t a full yes. Go system by system using the list from step 1, and note any gap next to the answer.
Why your answers matter
Your answers can matter when you make a claim, and a control you said was in place but wasn’t can cause trouble at the worst moment. Answer truthfully, and if you’re unsure, say so and find out first. Your broker and your policy wording decide how your answers affect your coverage. This isn’t insurance or legal advice.
When a control is only partly in place
Describe a partial control accurately and say when you’ll close the gap; that beats a hopeful yes. Multi-factor might cover email but not remote access, or endpoint protection might cover most computers but not servers. Ask your broker how the insurer treats partial controls, because the answer can affect both your premium and your coverage.
Evidence to gather
One dated folder of evidence answers most follow-up questions:
- A screenshot or report showing multi-factor sign-in is enforced.
- A list of devices covered by endpoint protection.
- The date and result of your last backup restore test. How should a small business back up its files? explains how to run one.
- A patching report, or a description of how updates are applied.
- Training completion records and practice phishing results.
- Your written incident plan, with contacts.
Keep the folder after you sign. Next year’s application will ask the same questions.
Working with your broker
Your broker can tell you which controls are required and which are only recommended. Also ask what evidence the insurer wants, when the application is due, whether the policy requires you to report incidents within a set time, and what a better answer would change in your premium or coverage.
Where doing it yourself gets risky
- Answering “yes” to a control you aren’t sure about.
- Controls that cover most computers but not all of them.
- Backups that use the same logins as everything else, so one compromised account can delete them.
- Having the control but no record that it was running or tested.
Signs it’s time for help
It’s time for help when an incident you can’t recover from, or a claim that’s denied, would cost more than putting the controls in place. Signs it would:
- Customer data, payments, or records you couldn’t replace sit on your systems.
- A few days offline would cost you jobs, invoices, or customers.
- A client contract requires proof of coverage, or you were declined or quoted a surcharge.
- The questionnaire asks things you can’t answer truthfully yet, and a renewal is close.
Open your current application, highlight every question you can’t answer with evidence today, and send that list to your broker. If the list is long, you don’t have to work through it alone.
Book a free 20-minute fit check