Cyber insurance renewals stopped being a formality a few years ago. The questionnaire is now a security audit with a price attached, and the answers you give become part of the contract.
That last part is the one worth sitting with. A questionnaire is a representation. If you tick a box saying multi-factor authentication is enforced everywhere and it turns out to have been enforced on some things, an insurer looking at a claim has a reason to look harder. The wrong answer is not just expensive at renewal. It is expensive at exactly the moment you need the policy to work.
The rule for the whole form: answer what is true today, not what you intend to be true. A "no" with a plan beside it costs you a slightly higher premium. A "yes" that turns out to be a "mostly" can cost you the claim.
The questions that actually move the price
Is multi-factor authentication enforced on email, remote access and administrator accounts?
This is the big one, and the word doing the work is enforced. Available is not enforced. Enabled for most people is not enforced. A policy that exempts the three executives who found it annoying is not enforced, and those are precisely the accounts an attacker wants.
Check the actual state rather than the intent: how many accounts are exempt, what the exemptions are for, and whether the exemption list has been looked at since the day it was created.
Do you have endpoint detection and response, and is it monitored?
Insurers have learned to separate the software from the watching. EDR that nobody reads is a licence, not a control. Expect follow-up questions about who reviews alerts and how quickly, and be ready to say honestly whether that is a person or a hope.
Are backups tested, offline or immutable, and separately credentialed?
Three separate claims hiding in one question, and the reason for each is ransomware. Attackers now look for the backup system first and delete it with the credentials they already have. So insurers ask whether a copy exists that the compromised account cannot reach, and whether anyone has proved it restores.
The honest answer to "are backups tested" is usually no. Most businesses check that backups ran. Restoring something, on purpose, to see what actually comes back, is a different activity and a much smaller number of organisations do it. If you want one thing to fix before renewal, make it this one, because it is cheap and it is also the thing that saves you in a real incident.
How quickly do you patch, and what covers the things that cannot be patched?
They are asking two things: your normal cadence, and what you do about the machine that runs the equipment that runs the business and cannot be touched. Every business has one. Saying so, and describing how it is isolated, reads far better than implying it does not exist.
Do you have email filtering, and can staff spot a payment change request?
Business email compromise is where the money actually goes, and insurers know it. The technical half is filtering and authentication records. The human half is whether a changed bank detail gets verified by telephone on a number nobody in the email chain supplied. Write that procedure down. It is the cheapest control on this page and it stops the most expensive loss.
Do you have an incident response plan, and has anyone read it?
A one-page plan people have read beats forty pages nobody has opened. Who declares an incident, who calls the insurer, who calls the lawyer, who talks to staff, and where the phone numbers live when the network is down.
Before you fill in the form
- Count MFA exemptions. Actually count them.
- Restore one file from backup, this week, and note the date you did it.
- Confirm at least one backup copy cannot be deleted with everyday credentials.
- List the machines that cannot be patched, and write down what protects each.
- Write the payment-change verification rule on one page and send it to whoever pays invoices.
- Put the incident phone numbers on paper, somewhere that is not the network.
Notes for the form itself
Get the person who runs it to answer it. These questionnaires are frequently completed by an office manager reading terms they have not met before, ticking what sounds right. That is not dishonesty, but the signature is still yours.
Keep the evidence. Screenshots, a dated export, the restore test result. If a claim is ever examined, "we said yes and here is what we had at the time" is a much better position than a recollection.
Ask what a "no" costs. Sometimes the honest no changes the premium by a small amount and you fix it next quarter. Sometimes it excludes the exact cover you were buying the policy for. You cannot make that trade without asking.
Where we come in
For our managed clients we answer these questionnaires directly, with the evidence attached, because the answers come from systems we run and can prove. If you are not a client we will still tell you which answers on your form are currently wrong. That is usually a short conversation and occasionally an uncomfortable one, which is rather the point of it.
Renewal coming up?
Send us the questionnaire before you fill it in. We will tell you which answers you can honestly give today, which ones need a fix first, and roughly what each fix takes.
Get the questionnaire reviewedQuestions? Email info@enlightentechhi.com or call 808-451-3630.
This is practical guidance, not legal or insurance advice. Your broker and your policy wording govern what is actually covered.