On this page
Insurers don't publish one universal standard, but their applications ask about a familiar set of controls. Use the tool above as a quick cyber insurance requirements checklist, then work through this guide to make sure every Yes you give is accurate, specific and backed by evidence.
It's written for the people who actually sign these forms: owners, CFOs, practice managers and office managers across San Diego County, from biotech teams in Sorrento Valley to law firms Downtown and dental practices in North County. Requirements vary by insurer and policy, so treat it as preparation for the conversation with your broker, not a substitute for it.
How insurers evaluate your security
Underwriters are trying to judge how likely you are to have a claim and how large it could be. They can't inspect your systems directly, so they rely on what you tell them and sometimes on what they can see from outside your network.
Yes-or-no questions about MFA, backups, EDR and other controls, signed by someone at your company. Those answers become part of the record your policy is based on.
Some insurers add detailed forms on ransomware, remote access or backups. These tend to ask how a control works, not just whether you have it.
Some insurers review what your business exposes to the internet, such as open remote access ports or unpatched systems. Findings can lead to follow-up questions.
Past incidents, claims, your industry and the kind of data you hold all shape the decision. A dental practice and a software company may face different questions.
Expect the questions to come back at every renewal, sometimes with new ones added. A control that was optional on last year's form may be expected on this year's, which is why preparing early pays off.
Your cyber insurance requirements checklist, control by control
These are the controls insurers most often ask about, and the ones the readiness check above covers. For each, know what a confident Yes looks like and where businesses tend to fall short.
| Control | A confident Yes means | Where it often falls short |
|---|---|---|
| MFA | Required for email, remote access, cloud apps and every admin account, with no standing exceptions | Shared mailboxes, service accounts or a VPN that still accepts a password alone |
| EDR | Managed EDR on every laptop and server, with someone responsible for acting on alerts | Traditional antivirus only, or servers left out of the rollout |
| Immutable or offline backups | At least one copy that can't be altered or deleted, protected by separate credentials | Backups on a device on the same network, reachable with the same admin password |
| Restore testing | A recent, documented restore of a critical system, including how long it took | Restoring a single file and calling it a test |
| Patching | Critical updates applied on a defined schedule for computers, servers, firewalls and key software | Laptops that go months without restarting to finish updates |
| Security awareness training | Regular training plus phishing simulations, with completion records | A one-time video during onboarding |
| Incident response plan | A written plan with roles, contacts and first steps, reviewed recently | A plan that lists people who have left, or no plan at all |
| 24/7 monitoring | Security alerts reviewed by people around the clock, including weekends and holidays | Alerts that land in an inbox nobody reads after hours |
MFA: define everywhere
MFA questions are rarely just about email. Applications often ask separately about remote access, privileged accounts, cloud services and backup consoles. Before you answer, list every way someone can sign in to your systems and confirm each one requires a second factor. Our zero trust and identity security work starts with exactly that inventory.
EDR and monitoring: tools need people
Installing EDR answers half the question. Insurers also want to know who acts when it raises an alert, especially at night. Managed EDR paired with a human-staffed 24/7 SOC covers both halves: our analysts watch alerts around the clock, with an average first response under 15 minutes.
Backups: immutable, separate and tested
An immutable copy is locked against edits and deletion until its retention period ends, even for administrators. That only helps if the backup system has its own credentials and you've proven a restore works. We run immutable off-site backups with quarterly restore drills, and each drill leaves evidence you can show an insurer.
Training and response planning
Phishing simulations and awareness training produce records showing that people, not just tools, are part of your defense. An incident response plan shows you won't improvise on the worst day. If your policy includes an incident hotline or a list of approved response vendors, put those details in the plan so nobody has to search for them mid-incident.
Document the evidence before you need it
A Yes on an application is a statement of fact. If you ever make a claim, you may be asked to show that the controls you described were in place. Keep one evidence folder, owned by one person, and refresh it every quarter.
- MFA: a report or screenshot showing enforcement for all users and admin accounts, plus any exceptions and the reason for each
- EDR: a device list from the EDR console that matches your asset inventory
- Backups: retention and immutability settings, and where each copy is stored
- Restore tests: the date, the system restored, the time taken and who performed it
- Patching: a recent patch status report for computers, servers and network devices
- Training: completion records and phishing simulation results
- Incident response plan: the current version, its review date and notes from any tabletop exercise
- Monitoring: the service description or agreement showing who reviews alerts, and when
- Asset inventory: users, devices and key cloud services, updated as people join and leave
When controls are managed continuously, the reports come from tools you already run. That's how our compliance readiness work keeps an audit trail ready for auditors, insurers and customer questionnaires alike.
A renewal timeline that avoids the scramble
Most renewal stress comes from discovering a gap a week before the form is due. Treat the readiness check above as your cyber insurance requirements checklist for the year, and work back from your renewal date so you close gaps instead of explaining them.
- 90 days out: get the forms
Ask your broker for this year's application and any supplemental questionnaires. Compare them with last year's answers and flag anything new.
- 60 days out: find the gaps
Run the readiness check with whoever manages your IT. Turn every No or uncertain answer into a task with an owner and a date.
- 30 days out: close and document
Fix the quick gaps, such as MFA exceptions or devices missing EDR, and run a fresh restore test. Add the results to your evidence folder.
- Before you sign: review every answer
Have the person responsible for IT read the completed application. If the form allows comments, explain partial controls and when they will be finished.
- After binding: update your plan
Add the insurer's incident reporting steps and contacts to your incident response plan, and note any conditions attached to the policy.
How to answer applications accurately
Insurance forms favor short answers, but your systems are rarely that tidy. A few habits keep your answers honest without underselling the work you've done.
- Answer for the whole business. If MFA covers the main office but not the warehouse in Otay Mesa or a remote team, the honest answer is Partly.
- Read “all” literally. All users means interns, contractors and the shared front-desk login too.
- Don't round up. A control that is half deployed is a plan, not a Yes. Describe the plan and its completion date instead.
- Mention compensating controls. If one system can't support MFA, explain how access to it is restricted and monitored.
- Keep a copy of what you submitted. Next year's answers should build on this year's, and any differences should be explainable.
- Ask before you guess. If a question is unclear, ask your broker what the insurer means. A wrong guess is harder to fix later.
Common pitfalls to avoid
- Answering from memory instead of checking the actual settings
- Treating files synced to Drive or SharePoint as a backup
- Protecting the backup console with the same admin account as everything else
- Buying EDR without anyone assigned to respond to its alerts
- Letting the incident response plan go stale after staff changes
- Signing the application without the person who manages IT reviewing it
- Waiting for the renewal notice to arrive before starting
If a control is only partly in place, say so and give a date for finishing it. An optimistic answer can cause problems later if the insurer reviews a claim against what you told them.
Not sure where you stand? Start with our security health check for a broader view, then book a free 30-minute assessment. We'll map your gaps against the controls insurers commonly ask about and help you build the evidence, so your next renewal starts with answers instead of questions.
