Cyber Insurance Questionnaire: What Your IT Needs to Have in Place

A few years ago, getting cyber insurance for a small business meant filling out a short form. Today, insurers send detailed questionnaires about your security controls, and the answers can affect your premium, your coverage, or whether you're offered a policy at all.

The questions can feel technical, but most of them come down to a handful of basics. Here's what insurers commonly ask about, what each control means, and how to get ready.

Every insurer's questionnaire is different, and your broker is the best source on your specific policy. This guide covers the controls that come up most often.

1. Multi-factor authentication (MFA)

MFA is usually near the top of the list. Insurers typically want it on:

• Email, for every user
• Remote access to your network
• Admin accounts for your systems
• Cloud apps that hold sensitive data

MFA means a stolen password alone isn't enough to get in. For most staff it's a tap on a phone app. If you have to answer "partially," find out which accounts are missing it and close the gap.

2. Endpoint protection (EDR)

Insurers often ask whether every computer runs endpoint detection and response, sometimes called EDR, rather than basic antivirus alone. EDR watches for suspicious behavior and can isolate a machine if something looks wrong. The key question is usually whether it's installed on every device and whether someone is actually monitoring the alerts.

3. Backups

Expect several questions here:

• Do you back up critical data regularly?
• Are backups kept off-site or isolated from your network?
• Are backups protected from being deleted or encrypted by ransomware?
• Have you tested restoring from backup recently?

That last one trips up a lot of businesses. Having backups configured isn't the same as knowing they work. Keep a record of each test restore.

4. Email security

Many attacks start with an email. Insurers may ask about filtering for phishing and malware, and about domain protections, known as SPF, DKIM and DMARC, that make it harder for criminals to send email pretending to be you.

5. Patching and updates

How quickly do you install security updates on computers, servers and network equipment? Insurers want to see a regular process, not "whenever someone gets to it." Unsupported, out-of-date systems are a red flag.

6. Access control and offboarding

Do staff only have access to what they need? Are admin rights limited? Is access removed promptly when someone leaves? Shared logins and former employees who can still sign in are common gaps in small offices.

7. Security awareness training

Insurers often ask whether employees receive training on phishing and social engineering. It doesn't have to be elaborate. Practical, regular guidance on spotting suspicious emails and verifying payment requests goes a long way.

8. An incident response plan

If something goes wrong, who do you call, and what happens first? Some questionnaires ask whether you have a written plan. For a small office this can be short: who to contact, how to isolate affected systems, how to restore from backup and when to notify your insurer.

How to prepare for your renewal

1. Get the questionnaire early. Ask your broker for it well before your renewal date.
2. Answer honestly. Inaccurate answers can create problems if you ever need to file a claim.
3. Close the gaps. MFA and email filtering can often be put in place quickly. Backups and EDR may take a bit more planning.
4. Document everything. Keep a simple record of what controls you have, when they were implemented and when backups were last tested.
5. Review it every year. Questionnaires tend to get stricter over time.

You don't have to figure it out alone

If your questionnaire reads like a foreign language, that's normal. An IT provider can help you understand each question, put missing controls in place and give you documentation to support your answers. The same controls that satisfy your insurer also make it much less likely you'll ever need to file a claim.