Cyber insurance questions before renewal

A cyber-insurance renewal is a bad time to discover that “MFA everywhere” actually meant email for most employees, except two administrators and the old VPN. The technical work may be mostly sound, but an imprecise application can create a different problem.

Requirements vary by carrier, application, industry, policy, and year. This is an operational preparation guide, not legal advice or a prediction of coverage. Your broker and qualified counsel should interpret the application, policy, endorsements, exclusions, and incident-notice obligations.

Start with the exact application

Obtain the current form and renewal timeline from the broker rather than copying last year’s answers. Assign one business owner to coordinate IT, finance, legal, HR, and outside providers. Keep a dated copy of:

The questions and definitions supplied by the carrier
The answers submitted
Clarifications exchanged with the broker or underwriter
The evidence used to support each technical statement
The final policy, declarations, endorsements, and exclusions

Words such as “all,” “encrypted,” “offline,” “managed,” and “24/7” deserve special attention. Define the population behind an answer. “MFA covers 143 of 146 users; three kiosk accounts are blocked from interactive sign-in” is more useful than a broad yes that nobody verified.

Do not guess at an unclear question. Ask the broker or carrier to clarify it in writing.

Build a control-and-evidence matrix

For every security question, record the control owner, scope, exception, evidence location, and last verification date. The following areas commonly deserve a deliberate review even when the application phrases them differently.

Identity and privileged access

Measure MFA coverage for email, remote access, cloud administrators, domain administrators, backup consoles, security tools, and externally accessible business applications. Separate interactive users from service accounts and document compensating controls for exceptions.

Prefer phishing-resistant methods for privileged and high-risk users when the platform supports them. Our guide to phishing-resistant MFA for executives explains a practical rollout order.

Evidence might include sanitized policy exports, identity-provider reports, conditional-access configuration, and a dated exception list. Do not attach reusable recovery codes or screenshots containing secrets.

Endpoint security and patching

Reconcile the device inventory against endpoint protection or EDR enrollment. Identify stale agents, unsupported operating systems, unmanaged servers, and devices that have stopped checking in. A product license count is not proof that every endpoint is protected.

Document patch ownership, normal deployment windows, emergency handling for internet-facing systems, and exceptions. CISA’s Cybersecurity Performance Goals are a useful risk-reduction baseline for smaller organizations; they are not a substitute for the carrier’s definitions. Compare the evidence with an SMB endpoint-security baseline.

Backups and recovery

Write down which systems are protected, backup frequency, retention, isolation or immutability design, administrative access, monitoring, and the date of the last successful restore test. Do not describe a synchronized cloud folder as an offline backup.

Provide restore-test records, not just green job screenshots. A timed backup verification drill can expose missing scope, expired credentials, and recovery delays before the renewal answer is submitted. If the form asks about offline or immutable copies, document the actual architecture using precise language; these controls are not interchangeable.

Incident response and outside dependencies

Confirm the named incident lead, after-hours contacts, legal and broker contacts, forensic or response vendors, decision authority, and an alternate communication method. Check that the plan includes the cloud, payroll, hosted applications, and managed providers the business really depends on.

Record whether tabletop exercises or notification tests occurred and what changed afterward. A plan last opened three years ago is weaker evidence than a short exercise with assigned follow-up work.

Reconcile the answers with reality

Use three passes before submission:

Technical owner review: Administrators verify settings, coverage, and exceptions directly in the relevant consoles.
Business owner review: Leadership confirms the described processes, staffing, and recovery priorities match how the organization operates.
Broker or counsel review: Qualified advisers resolve ambiguous insurance language and explain policy implications.

An MSP can supply technical records and describe the services it operates. It should not certify controls outside its visibility or decide what an insurance question legally means. Likewise, a letter saying “client uses EDR” should state the covered device population and evidence date.

Store renewal artifacts in a restricted repository with version history. Preserve enough evidence to show what was true when the application was signed, without creating a treasure map of privileged credentials.

Review policy mechanics, not only the premium

Security controls are half of the renewal. Ask the broker to walk through limits, deductibles or retentions, sublimits, waiting periods, covered services, panel-vendor requirements, exclusions, and notice or consent requirements. Confirm who must be contacted first during a suspected incident and whether spending requires carrier approval.

The National Association of Insurance Commissioners’ 2024 cyber-insurance report notes that policy structures can include sublimits and exclusions, including some related to maintaining security standards. That is one more reason to have qualified advisers interpret the actual contract instead of relying on a generic checklist.

Coverage depends on the policy and facts of a claim. A control mentioned in an application is not a promise that a particular incident will be covered, and this article cannot determine that outcome.

Keep the evidence current after renewal

The signed application should become a set of operating checks. Track MFA and endpoint coverage, backup-test results, major environment changes, acquisitions, new public services, and material exceptions. When a represented control changes, involve the appropriate internal owner and adviser rather than waiting for the next questionnaire.

Keep the incident-notice instructions with the response plan and test that the listed phone numbers work. During a real event, preserve evidence and follow the policy’s reporting and consent process as advised; do not assume that submitting a ticket to the MSP notifies the carrier.

Bottom line

Prepare for renewal by proving scope, not polishing slogans. Use the carrier’s current form, answer defined questions accurately, document exceptions, preserve dated evidence, and have the policy language reviewed by the people qualified to interpret it. Cyber insurance can transfer some financial risk, but it does not replace MFA, managed endpoints, tested recovery, or an incident-response plan that the team can execute.