How can businesses prepare for cyber insurance requirements? Start by treating the application as a practical review of the safeguards you actually use, not a form to complete from memory. Insurers and policies differ, so verify the carrier’s questions with your broker and document what is in place, where coverage has limits, and who can confirm each answer.
Review your business IT security needs
What does a cyber insurance application ask you to show?
A questionnaire may ask about account security, endpoint protection, backups, email safeguards, incident response, and staff practices. Some applications use a yes-or-no question even when the real answer depends on which users, devices, or systems are covered. Before responding, get the complete application and any supplemental questions, then translate each item into something your team can verify.
For each question, record four things: the system or process in scope, the person who knows it, the evidence that supports the answer, and the date it was checked. Separate an active control from a planned project or a written policy. A policy describes what should happen; it does not by itself prove that a technical setting is enabled.
- Identity and access: Check whether multi-factor authentication (MFA) is enabled for email, remote access, administrators, and other important services. Confirm how new accounts are approved and how access is removed after a role change or departure.
- Devices and servers: Compare the device list with records for security protection and updates. Identify computers, servers, or other equipment that are missing from the inventory or outside the normal process.
- Backups and recovery: Define which information and services are included, how often copies are made, who can change them, and when restoration was last tested.
- Email and user reporting: Verify the safeguards in use and how employees report a suspicious message or unexpected sign-in prompt.
- Incident response: Identify who makes business decisions, who investigates technical issues, and where current response contacts and instructions are kept.
- Outside providers: Note which service providers store business information or have access to systems, and who is responsible for reviewing that access.
Do not assume that a control applies to everyone because it protects one important system. If MFA is enabled for remote access but not for every account, record that distinction. The same principle applies to backup scope, endpoint coverage, and staff procedures. Precise answers reveal both what is working and what needs attention.
How should you organize evidence before renewal?
Create a controlled evidence folder early, instead of searching through email just before the deadline. Keep it limited to information needed for the application, restrict access to appropriate staff, and do not store passwords or unnecessary sensitive data with the supporting documents. An index makes it easier to find the current item and replace it when a setting or process changes.
| Application area | Useful evidence to collect | Who should verify it |
|---|---|---|
| Accounts and MFA | Configuration record, coverage by user group, and administrator access review | IT administrator or service owner |
| Backups | Systems and data in scope, recent job status, and restore-test notes | IT and business continuity owner |
| Devices | Current inventory, security protection status, and update process | IT administrator |
| Incident response | Current contacts, escalation steps, and review or exercise notes | Business leadership and IT |
| Vendors and data | Key provider list, information handled, and access responsibilities | Operations or compliance owner |
Evidence can be straightforward: an accurate configuration record, written procedure, access review, backup report, or test result. Add the date and scope to each item so a reviewer can understand what it demonstrates. A screenshot of one account setting, for example, should not be presented as proof of organization-wide coverage. Remove or protect sensitive details before sharing documents with an insurer or broker.
Keep a short evidence index with the application question, evidence file name, owner, date checked, and any limitation. If the evidence is an export or screenshot, note which environment it came from. If it is a procedure, identify when staff last reviewed or used it. This small amount of context prevents a collection of files from becoming an unverified archive.
Which security controls should you check first?
Prioritize controls that protect access to important systems and make recovery possible. The list below is a sensible review order, not a guarantee that any insurer will accept one safeguard in place of another. Your application and policy determine what the carrier asks you to have.
- Map important accounts and MFA coverage. Start with business email, remote access, administrator accounts, and systems holding sensitive or business-critical information. Compare the account list with the settings, then document exceptions and who approved them. For a plain-language refresher on this control, see the guide to two-factor authentication.
- Review privileged access. Identify who has administrative rights, whether each person needs them, and whether accounts are shared. Confirm how access is reviewed and changed when responsibilities shift. Record the review date rather than relying on an old user list.
- Check backup scope and recovery. Match the backup configuration to the systems the business depends on. Review recent job results, then ask when a representative restore was last tested and what was included. A successful backup status is useful evidence, but it does not alone show that the business can restore the right data within its needs. The practical discussion of ransomware recovery and restoration can help teams think through recovery dependencies.
- Compare devices with protection and updates. Use an inventory as the starting point. Look for computers or servers that have not checked in, are missing protection, or are not receiving updates through the standard process. Assign an owner to investigate each exception.
- Make the incident process usable. Write down who can authorize containment steps, who contacts the insurer or broker, and how staff report a suspected incident. Confirm that contact details are current and available to the people who may need them.
- Review email and cloud services. Verify the protections that are actually configured in your environment, rather than assuming that a product or subscription name proves coverage. Businesses using Microsoft services can review the relevant Microsoft 365 support context while confirming their own settings.
For general cybersecurity resources, businesses can also consult the Cybersecurity and Infrastructure Security Agency (CISA). Use its guidance as a source for security practices, not as a substitute for the insurer’s application, broker advice, or the terms of your policy.
Technical settings vary by environment and service plan. If a business uses Microsoft 365, for instance, check the actual configuration and the people or workloads it covers; a platform name alone does not establish that every relevant control is active. Keep a record of the check and any exceptions so the person completing the application can explain the scope accurately.
How do you answer the questionnaire accurately?
Choose one coordinator to manage the process, but have the people closest to each safeguard validate the answers. IT can confirm technical settings, operations can describe where information is used, and leadership can confirm decision authority. The coordinator’s role is to reconcile those perspectives, not to guess on behalf of a control owner.
A simple answer log helps:
- Copy the application question or identify its section.
- Write the verified answer in plain language and specify who or what is covered.
- Link the supporting evidence and state when it was checked.
- Record the control owner and any exception, planned change, or follow-up date.
If a question is unclear, ask the broker or insurer how it should be interpreted before submitting it. Save the submitted application and the evidence used to answer it. If the environment changes after submission—for example, a key system changes or an important safeguard is removed—ask the broker whether the policy requires an update or other action.
Be careful with broad statements such as “all systems are backed up” or “MFA is enabled everywhere.” Translate those claims into verifiable scope. Does “all systems” include cloud services? Does MFA cover every user, administrators, and remote access? If the answer is partial, explain that rather than converting a limited control into a universal claim.
For organizations that share IT responsibilities with an outside provider, identify who owns each answer. A co-managed IT arrangement may divide responsibilities between internal staff and an external team; the application coordinator should document who verifies settings, maintains evidence, and escalates a gap. Assign each safeguard one accountable owner even when several people contribute.
What should you do when you find a gap?
Record the gap in concrete terms. Note the affected system or people, the potential business impact, the current interim measure if any, the owner, and the target date for the next decision. Then rank the work by whether it affects a critical service, exposes sensitive information, or could prevent recovery. Do not describe a planned control as active.
For example, suppose the application asks whether MFA is enabled for all remote access, and the team verifies it for employees but finds an administrative account outside the same process. The accurate response is not a simple unqualified “yes.” Record the exception, identify its owner, determine the next action, and ask the broker how the insurer wants the present state reported. Once corrected, retain evidence that verifies the change.
Some gaps can be corrected through a configuration change; others require planning, licensing, testing, or a business decision. Make a short remediation plan with a responsible person and a check that will demonstrate completion. If a deadline arrives first, be transparent about the current state and ask the broker or insurer how to proceed. A dated plan is not proof that a safeguard has been implemented.
Use the same disciplined approach for backup and response weaknesses. If a restore has not been tested, schedule a test and record what was restored and what remains to be checked. If response contacts are missing, name the decision-maker and confirm a reachable backup contact. Businesses reviewing broader security responsibilities may find the cybersecurity services overview useful when deciding what technical support to discuss.
Discuss your IT security review with IGTech365
How can you keep preparation current between renewals?
Put the review on the calendar well before renewal, then revisit it after a meaningful change. Examples include adopting a new cloud service, changing remote access, adding or removing a business unit, changing key vendors, or moving responsibility for IT tasks. A previous year’s answers can be a useful starting point, but they are not evidence that the same controls remain in place.
Use a repeatable routine rather than a one-time scramble:
- Refresh the list of important systems, data, devices, and providers.
- Check high-priority account and endpoint settings against current records.
- Review backup scope and confirm when a restore was last tested.
- Verify incident contacts and staff reporting instructions.
- Update the evidence index and close, assign, or escalate open exceptions.
A business can also compare its preparation process with related governance work. For instance, the SOC 2 compliance checklist discusses evidence and control documentation in a different context; it does not establish that a company meets an insurer’s requirements. Keep those purposes distinct and follow the questions and obligations in the actual policy application.
Cyber insurance transfers some financial risk under the terms of a policy; it does not replace security controls or guarantee that every incident will be covered. Read the policy with your broker and pay attention to exclusions, limits, conditions, and notice duties. If ongoing IT oversight is part of the plan, review the scope and responsibilities of managed IT services so ownership of recurring checks is clear.
Call IGTech365 to discuss your IT security priorities
Frequently asked questions
Does every business need the same cyber insurance controls?
No. Applications and underwriting requirements vary by insurer, policy, business activity, and the systems or information involved. Use the specific application and your broker’s guidance to understand what applies to your business.
Are backups enough to meet a cyber insurance requirement?
Not necessarily. Confirm what is included, how backup copies are protected, and whether restoration has been tested. The insurer may ask about particular arrangements, so answer the questions asked rather than assuming that any backup is sufficient.
Can we submit an application while a safeguard is being implemented?
Ask the broker or insurer how to report the current state. Do not claim that a planned safeguard is active. Document the gap, the owner, and the expected next step, and keep evidence after implementation is verified.
When should we review our answers?
Review them before each renewal and after significant changes to systems, access, providers, or business operations. Recheck the supporting evidence instead of copying the previous year’s responses without validation.
Preparing early gives your team time to verify controls, clarify open questions, and submit answers that accurately reflect how the business operates.