Your cyber insurance renewal arrives with a questionnaire attached. You recognize some of the terms, but others raise questions. Does the security software on your computers count as the protection being requested? Does having backups mean you can confidently answer every question about recovery?
For a business without an internal IT team, completing the form takes some coordination. Your IT provider can verify the technical details, while your broker can clarify what the insurer needs. The aim is to describe the protections operating in your business today, including any exceptions. Here are the common areas to review and how to prepare reliable answers.
Understand what the questions are trying to establish
Insurers use claims experience, including ransomware losses, to inform their questions. Ransomware is malicious software that can make files unusable and support demands for payment. A questionnaire therefore looks at several stages: preventing unauthorized access, detecting trouble and recovering business operations.
Read each question closely. Words such as “all,” “required” and “monitored” can change the answer. A safeguard enabled for office employees may not cover remote contractors or accounts with special permissions. Different insurers may also define similar terms differently.
An inaccurate statement or significant omission may jeopardize coverage when you make a claim. The outcome depends on the policy and circumstances. Ask your broker how to disclose exceptions and handle wording that does not fit your situation. This article covers technical preparation; it is not legal or insurance advice. Your broker is the reference for questions about the application and coverage.
Check sign-ins, remote access and administrator accounts
Multi-factor authentication, or MFA, requires an additional proof of identity beyond a password, such as confirmation through an app. Insurers commonly ask about MFA for email, remote access and administrator accounts. Check each area individually rather than assuming that enabling it for email covers everything.
Administrator accounts can change important settings or give other people access. Confirm who has these permissions and whether separate accounts are used for everyday work.
- Check whether MFA is enforced, rather than simply available.
- Identify exempt accounts, shared accounts and unused access.
- Review emergency accounts and access used by outside providers.
- Confirm who approves and removes administrator permissions.
For remote work, a virtual private network, or VPN, provides a protected connection to the business network. Having a VPN does not establish that every remote connection uses it. Ask your provider to check for other routes, including Remote Desktop Protocol, or RDP, which lets someone operate a computer remotely. The questionnaire may specifically ask whether RDP is directly reachable from the internet.
Verify device protection and the update process
Endpoint detection and response, usually called EDR, looks for suspicious activity on devices and supports action when a threat is found. It is not automatically equivalent to a traditional antivirus product. Get the product name, a current coverage report and a list of devices that are missing protection.
Monitoring is a separate question. Software may generate alerts without someone consistently reviewing them. Establish who receives alerts, when they are reviewed and who can respond. Continuous monitoring and a help desk available during business hours describe different responsibilities.
For security updates, insurers may ask how quickly patches are applied and how completion is tracked. A patch is an update that fixes a software issue, which can include a security weakness. Describe your actual process, including failed installations and exceptions.
Check for end-of-life systems too: these no longer receive the manufacturer’s regular security updates. Include relevant computers, servers, applications and network equipment. A planned replacement does not remove an existing unsupported system from your answer.
Establish what your backups can actually restore
Backup questions often examine whether an attacker could destroy the copies along with the original data. Offline backups are disconnected from accessible systems. Immutable backups are designed to prevent changes or deletion for a defined period. Cloud storage alone does not establish either protection.
Ask your IT provider to document:
- which information is backed up, including data in cloud services;
- how often copies run and how long they are retained;
- what prevents unauthorized changes or deletion;
- whether backup access uses separate credentials and how those credentials are protected;
- when restoration was last tested, what was recovered and whether it worked.
A successful backup report confirms that a copy completed; it does not prove that recovery was tested. A restore test retrieves data and checks that it is usable. Recovering one file is useful evidence, but it does not establish that your entire business could resume operations. Match your answer to the scope of the test that actually took place.
Review email safeguards and staff training
Email questions may cover filtering, dangerous attachments, suspicious links and protection against messages impersonating your business domain. Ask which safeguards are enabled and which accounts they cover. A subscription that includes a security feature is not evidence that the feature has been configured.
Security awareness training and phishing simulations are also distinct activities. Phishing is an attempt to trick someone into sharing information or taking an unsafe action. A simulation uses a controlled imitation of that attempt to help people practise recognizing and reporting it.
If the form asks separately about training and simulations, completing one does not establish that you do both. Keep records of training dates, subjects and participation, plus simulation records if applicable. Check how new employees receive training and how staff report suspicious messages. Describe what your business currently does rather than what appears in an unfinished training plan.
Check the incident plan and outside access
An incident response plan sets out who does what when a security problem occurs. For a smaller business, it should provide clear responsibilities, contact details and practical instructions that people can find under pressure. Include the business decision-maker, IT provider, backups for key contacts and the reporting process specified in your policy.
Consider how you would reach these people if email were unavailable. Keep an accessible copy of the plan and identify who can authorize work. If the insurer asks whether the plan has been exercised, writing it is not the same as walking through a scenario with the people involved.
Outside providers need attention as well. List vendors with system access, why they need it and how that access is protected. Confirm how permissions are reviewed and removed. An old support account still counts as an access route, even if nobody expects the vendor to use it again.
Build an evidence file before renewal
Start early enough to obtain technical checks and ask your broker about unclear wording. Keep dated evidence for each answer: settings screenshots, device reports, restoration results, written procedures and training records. Restrict access to this file and leave passwords out of it.
Where implementation is partial, document the current coverage, exceptions and proposed work. If the form only permits “yes” or “no,” ask your broker how to attach an explanation. A target completion date should remain clearly identified as a plan until the work is finished and verified.
Use the preparation period to close straightforward gaps, such as removing unused accounts or completing a missing setting. Verify the results before updating your answers. Save the submitted questionnaire and supporting records for next year. At Evolute I.T., we help clients complete the technical sections of these questionnaires and address gaps beforehand.
A useful insurance file gives a clear picture of your current protections and makes future reviews easier. Your IT provider verifies the technology; your broker remains the reference for the insurer’s requirements and coverage questions.
To prepare for your next questionnaire, explore our managed IT services or contact us to discuss the technical details that need checking.
