A cyber insurance application reads like a quiz about your security. The questions differ between insurers, but most come back to the same handful of controls. Answer from what you believe and you can end up with the wrong price, the wrong exclusions, or an answer that turns out to be untrue when you make a claim.
Below are the topics applications commonly ask about, what each one is really checking, and how to confirm your answer before you sign.
This guide is general information, not insurance or legal advice. Your broker and your policy wording decide what is covered. Ask your broker how your insurer treats an answer that later turns out to be wrong.
The questions
1. Two-factor sign-in
What they are asking: Whether a password alone is enough to get into your email, remote access, admin accounts and cloud apps. Applications often ask about each of these separately.
How to check: List every way into the business: email, file storage, accounting, remote access, website admin, and any admin account. Check that each one asks for a second step, such as an app prompt, a passkey or a hardware key. One account without it can make the honest answer “partly”.
2. Backups
What they are asking: Whether you could recover if ransomware encrypted everything you can reach. Many forms ask whether a copy is kept offline or separate from your normal accounts, and whether you have tested a restore.
How to check: Find where the backups live and who can delete them. If the same login that can be stolen can also erase the backups, they are not separate. Then restore one real file or system and note the date. “We have backups” and “we have restored from them” are different answers.
3. Email security
What they are asking: Whether incoming mail is filtered, and whether your domain is protected from being impersonated. SPF, DKIM and DMARC are the records that do the second part.
How to check: Look up your domain’s SPF, DKIM and DMARC records, or ask whoever runs your email. A DMARC record set to “none” reports problems but does not stop impersonation.
4. Patching and updates
What they are asking: How quickly security updates reach computers, servers, websites and network equipment, and whether anything is too old to get updates at all.
How to check: Check that automatic updates are on for computers and phones, and list anything that no longer gets security updates: old Windows versions, old routers, an unmaintained website plugin.
5. Endpoint protection
What they are asking: What protects each computer from malware. Some forms ask specifically about endpoint detection and response (EDR), which watches for suspicious behavior rather than only known viruses.
How to check: Write down what is installed on each work computer, including personal ones used for work. If you are not sure whether yours counts as EDR, say so to your broker rather than guessing.
6. Admin access
What they are asking: How many people have administrator rights, and whether they use separate admin accounts for admin work.
How to check: Count the admins in your email, accounting and main business apps. Remove anyone who no longer needs it, including former staff and old contractors.
7. Payment fraud and wire transfers
What they are asking: Whether a fake email asking to change bank details or send a payment would be caught. This often decides whether social engineering or funds transfer fraud is covered.
How to check: Write down the rule, then follow it: any new or changed bank details are confirmed by phone, using a number you already had, never one from the email.
8. Staff training
What they are asking: Whether staff are taught to spot phishing and fake payment requests, and how often.
How to check: Keep a record of when training happened and who attended. A short session with a sign-in sheet is evidence; “we talk about it” is not.
9. Data you hold
What they are asking: How many records of personal information you hold, such as customer details, payment data or health information. This affects the price and the limits.
How to check: Estimate from your customer list, order history and employee records. Include old exports and spreadsheets that nobody has deleted.
10. Incident response plan
What they are asking: Whether you know what to do in the first hour of an incident, and who to call.
How to check: Write one page: who decides, who calls the insurer’s hotline, who can take systems offline, and where the backups are. Keep a printed copy, since your files may be unreachable when you need it.
11. Vendors and remote access
What they are asking: Who outside the business can reach your systems, such as an IT provider, a web developer or software vendors, and how.
How to check: List every outside party with a login. Remove old ones, and check that the rest use two-factor sign-in too.
If an honest answer is “no”
Say so, and say what you are doing about it. A clear “not yet, being turned on this month” is easier for a broker to work with than a yes that falls apart later. Two-factor sign-in and separate backups are often quick to close, and each one covers several questions at once.
Want the answers checked?
- Our security and IT assessment covers these topics and gives you a written report, so you answer the application from what we found. Fixed quote.
- Take the free AI risk check if your team uses AI tools. It asks about the same habits, applied to AI.