Cyber Insurance
Cyber Insurance Application Guide
What Business Leaders Need to Know Before They Answer the Questions
Patrick M. Hayes
A practical guide by Patrick M. Hayes for understanding what cyber insurers are asking, who inside the organization should verify the answers, and what evidence can support them.
Why Cyber Insurance Applications Have Changed
What used to be a relatively simple questionnaire about firewalls, antivirus software and a handful of basic security practices has become a much more detailed look at how a business actually operates.
Insurers are not really trying to grade your cybersecurity program. They are trying to determine how likely your organization is to have a cyber event, what that event could cost and whether the business has the ability to limit the damage when something eventually goes wrong.
Insurers have learned from claims which conditions tend to make losses worse — weak access controls, poorly managed endpoints, untested backups, an incident-response plan that exists only as a document. The questions on the application are often trying to identify those conditions before the insurer agrees to take on the risk.
Don’t Just Forward the Application to IT
The answers provided on the application become representations about the business that an insurer may rely upon when deciding whether to provide coverage and under what terms. Those answers can influence:
- Premiums
- Deductibles or retentions
- Coverage limits
- Exclusions
- Other policy conditions
They can also become important after a loss, when the insurer compares the actual environment with what was represented during underwriting. Technical teams may provide many of the answers, but completing the application is ultimately broader than an IT questionnaire.
Knowing the Answer Is Different From Assuming the Answer
Someone completing the application asks IT whether the company uses multi-factor authentication and receives a quick “yes.” The box gets checked and everyone moves on. The problem is that the insurer may not have asked whether the company uses MFA somewhere. It may have asked whether MFA is required for:
- Remote access
- Administrative accounts
- Cloud applications
- Other environments represented by the question
The same thing happens with backups. A business may confidently answer that backups are performed every day without knowing whether those backups are separated from the production environment or whether anyone has successfully restored critical systems from them recently. A company may say endpoint protection is deployed without knowing whether every endpoint is actually covered.
The person completing the application does not need to become a cybersecurity expert. They do need to understand what is being represented and make sure the answer has been verified by someone who actually knows.
Stop Treating It as a Questionnaire
The easiest way to improve the application process is to stop treating it as a questionnaire and start treating it as a verification exercise. An important application question should trigger a simple process:
- What is the insurer asking?
- What is our actual answer?
- Who can verify it?
- What evidence supports it?
- When was it verified?
The point is not to create a huge collection of screenshots just to satisfy an insurer. The evidence should give the business reasonable confidence that the answer being submitted is actually correct. If nobody can find evidence supporting an answer, that is worth investigating before checking the box.
Cyber Insurance Underwriting Evidence — the deeper discussionFinding the Right Person Inside the Business
The person responsible for completing the application rarely has every answer. That is normal. Depending on the question, information may come from:
- IT
- Accounts, devices, networks, patching and backups.
- Cybersecurity or security providers
- Monitoring, endpoint protection, vulnerabilities and incident response.
- Human Resources
- Training, onboarding, background screening and termination practices.
- Finance
- Revenue, payment processes, business interruption and financial controls.
- Legal or Compliance
- Regulated information, contractual obligations, previous incidents and notification requirements.
- MSPs and other providers
- Controls operated on behalf of the organization.
Outsourcing a function does not eliminate the need to understand and verify what the provider actually does.
If a provider says it manages backups, endpoint security or MFA for the business, the organization should understand what is actually being provided and should be able to obtain evidence that supports the answer being given to the insurer.
Create an Underwriting Evidence File
For each material question, the business should be able to retain:
- Application Question
- Answer Submitted
- Who Verified the Answer
- Evidence Used
- When Verification Occurred
The evidence itself can then be retained with the application and policy documents. This creates a baseline for renewal — the business is not starting from scratch every year or trying to remember why someone answered a question a certain way twelve months earlier — and it helps leadership identify changes from year to year.
Cyber Insurance Underwriting EvidenceDo not upload sensitive underwriting evidence or organizational security information to the Integrated Assurance Academy or this website. Maintain completed records within your organization’s approved systems.
What If the Answer Is No?
There can be pressure during an insurance application to turn every answer into a “yes.” That is the wrong objective. The goal should be to provide an accurate answer and understand what the insurer considers important.
- Sometimes the accurate answer is No.
- Sometimes a control covers only part of the environment.
- Sometimes the organization needs clarification from its broker or insurer.
- Sometimes underwriting reveals something the organization can reasonably correct.
Finding a weakness during underwriting is usually much better than discovering it during a claim.
Make Renewal a Business Process
Cyber insurance renewal works better when it begins before the new application arrives. The organization can review:
- Previous application answers
- Supporting evidence
- Changes in technology
- Acquisitions
- Cloud migrations
- New vendors
- Remote access changes
- AI adoption
- Changes in how information is handled
The application provides leadership with a structured opportunity to compare what the organization believes about itself with what can actually be demonstrated. When those two things do not match, the business has learned something important.
What the guide covers
Nine Areas of Cyber Insurance Readiness
Most cyber insurance applications cover the same general areas even though the wording and level of detail vary between carriers. The guide walks through each area question by question — what the insurer is really trying to determine, why the answer matters, where the information can be found and what evidence should be collected before an answer is provided.
Access Control
These questions cover Single Sign-On, multi-factor authentication, internet exposure of business-critical technology, password controls, and need-to-know and least-privilege access. The words matter: all users, all technologies, enforce, only. A control that protects most of the organization may not support an unqualified “Yes.” Scope and enforcement are what the insurer is trying to understand.
Human Risk
Security awareness training and phishing simulations show whether employees are prepared to recognize the attacks that target people. There is an important difference between making training available and demonstrating participation: an annual presentation is not the same as a managed program with completion records, and a subscription to a phishing platform is not the same as conducting exercises.
Email Security
Email remains one of the easiest ways to reach someone inside a business. Using Microsoft 365, Google Workspace or another email service does not automatically answer the insurance question — the protections actually in use depend on licensing, configuration, additional security products and how the environment is managed.
Endpoint Security
Basic endpoint protections, Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) are not interchangeable. EDR is primarily the technology watching the devices; MDR is a service involving people who monitor, investigate and respond. A company can own detection technology without anyone being responsible for responding when it alerts.
Network Security
Firewall protection, network boundaries and guest-network separation determine how far an attacker can move after an initial compromise. Broad statements such as “all networks” require understanding the full scope of the business — every office, warehouse, retail location and remote environment the answer covers.
Patch Management
The insurer is asking whether the organization has a repeatable process for identifying and addressing critical vulnerabilities — not simply whether automatic updates exist somewhere. A written policy saying critical patches are applied within seven days establishes the expectation; a report showing the organization actually meets that expectation establishes what is happening in practice.
Data Backup
A successful backup report tells you that data was copied somewhere. It does not necessarily tell you that the business can recover from it. The useful questions are what is being backed up, where those backups are stored, whether an attacker could reach them and whether restoration has actually been tested. Recovery ultimately concerns restoring the business, not simply restoring files.
Incident Response
A documented incident-response plan is different from a plan that has been exercised. The insurer also wants to know whether incidents are logged and tracked through resolution, and whether the organization has a process for determining when insurers, counsel, regulators, authorities or other parties may need to become involved.
Personnel Security
Background screening addresses risk before access is granted; the termination process addresses what happens when that access should end. The business question from the guide is simple: after someone leaves, how do we know they can’t still get into anything?
You Don’t Need to Become the Technical Expert
An executive or financial leader does not need to personally inspect identity configuration, firewall rules, EDR consoles or backup infrastructure. They should understand:
- Who verified the answer?
- What evidence supports it?
- Does the evidence cover the scope represented in the application?
- Are important exceptions understood?
If the answer is “Yes, across all users” or “Yes, across all technologies,” someone should be able to demonstrate that coverage. If exceptions exist, they should be understood before the application is submitted.
Can We Insure This?
A cyber insurance application is not really asking whether the organization owns a collection of security products. Taken together, the questions create a picture of how prepared the business is when something goes wrong.
Being insurable and being survivable are not the same thing.
An organization can have MFA, EDR, firewalls, backups, an incident-response plan and cyber insurance and still discover during an incident that the business cannot operate. Insurance can provide financial protection for covered losses, but it cannot operate the company while its systems are unavailable.
That brings us back to the question behind the book: if something happens, can the business survive it?
Explore Can We Insure This?Free guide · 44 pages
Download the Cyber Insurance Application Guide
What Business Leaders Need to Know Before They Answer the Questions
A practical guide for understanding common cyber insurance application questions, finding the right people inside the organization to verify the answers and identifying evidence that can support those answers.
- Read
Download the complete Cyber Insurance Application Guide.
- Listen
Listen to the Cyber Insurance Application Guide audiobook on Spotify.
No email address, Academy account or purchase is required.
Go Deeper With Can We Insure This?
The Application Guide focuses specifically on preparing for application and renewal questions. Can We Insure This? Second Edition explores the broader relationship among cyber risk, AI, insurance, recovery and business survivability.
Questions & Answers
What is a cyber insurance application?
It is the set of questions an insurer uses to understand how your business actually operates before deciding whether to offer coverage and on what terms. Applications have evolved from simple questions about firewalls and antivirus into a detailed examination of access control, employee awareness, email, endpoints, networks, patching, backups, incident response and personnel security.
Who should complete a cyber insurance application?
Not IT alone. The answers become representations about the business that can influence premiums, deductibles, coverage limits, exclusions and other policy conditions. Technical teams provide many of the answers, but completing the application is broader than an IT questionnaire — leadership should understand what is being represented.
What questions are commonly asked on cyber insurance applications?
Most applications cover the same general areas even though wording and detail vary between carriers: access control, human risk, email security, endpoint security, network security, patch management, data backup, incident response and personnel security.
Why do cyber insurers ask about MFA?
Because a stolen password by itself should not be enough to give an attacker access to an important system. The important word is usually enforce: having MFA available is not the same as requiring it, and MFA may exist in one part of the company — such as email — while remote access, administrative accounts or cloud applications remain uncovered.
What evidence should support cyber insurance application answers?
It depends on the question. An MFA answer might be supported by a configuration report from an identity system; an endpoint answer by a report showing enrolled devices; backup answers by backup reports and restoration test records; training answers by completion records. The evidence should give the business reasonable confidence that the answer being submitted is actually correct.
Who should verify technical answers?
Someone who actually knows. Depending on the question that may be IT, a security team or provider, human resources, finance, legal or compliance, or an MSP. The person completing the application does not need to become a cybersecurity expert — they need to make sure each answer has been verified by the right person.
What happens if the answer to an underwriting question is no?
Sometimes the accurate answer is No. Sometimes a control covers only part of the environment, and sometimes the organization needs clarification from its broker or insurer about what the question means. Underwriting may also reveal something the organization can reasonably correct. Finding a weakness during underwriting is usually much better than discovering it during a claim.
Why do cyber insurers ask about backups?
Because the length and cost of a cyber event can change dramatically depending on whether the business can recover its systems and information. A successful backup report tells you data was copied somewhere; it does not necessarily tell you the business can recover from it. Scope, separation from the production environment and restoration testing all matter.
What is the difference between EDR and MDR?
EDR — Endpoint Detection and Response — is primarily the technology watching devices for behavior that could indicate an attack. MDR — Managed Detection and Response — is a service involving people who monitor security information, investigate suspicious activity and respond. A company can have EDR without having MDR.
How should a business prepare for cyber insurance renewal?
Begin before the new application arrives. Review the previous year’s answers, confirm they are still accurate, update the supporting evidence and identify significant changes — new systems, acquisitions, cloud migrations, vendors, remote access, AI adoption and changes in how information is handled.
Do all insurers ask the same questions?
No. Applications, underwriting approaches and requirements vary by insurer. Most applications cover the same general areas, but the wording, level of detail, evidence expectations and follow-up questions can differ considerably between carriers.
This guide and related material are educational and informational and do not constitute legal, insurance, underwriting or coverage advice. Insurance applications, underwriting requirements and policy terms vary by insurer and policy.