How to Answer Cyber Insurance Renewal Questions Without Voiding Your Policy
The cyber insurance renewal form arrives, and it is longer than last year’s. The questions are technical, the deadline is close, and the person who knows the answers is probably not the person filling it out. Answering carelessly can cause trouble later, when you need the policy most. This guide explains what the questions mean and how to answer them accurately. It is general information, not legal or insurance advice, so talk with your broker about your own policy.
Why the form got longer
Insurers have paid for a lot of ransomware and fraud claims, and they have learned which controls tend to separate businesses that recover from those that do not. The questions have become more specific as a result: not “do you have backups?” but “are they immutable, and when did you test a restore?” Insurers use the answers to price risk, to decide whether to offer coverage, and sometimes to decide whether a claim is covered.
The questions that matter most
Backups. Insurers want to know if backups exist, are separate from your main network, cannot be altered, and have been tested. See our post on what immutable backup means.
Multi-factor authentication. Expect separate questions for email, remote access, administrator accounts and sometimes backups. “We use MFA” is not enough. A yes should mean it is required for every user in those areas, with no exceptions for convenience. Which method matters too. See moving beyond text message codes.
Endpoint protection. Basic antivirus no longer satisfies many forms. They ask about endpoint detection and response (EDR), and some about managed detection and response (MDR), where a team watches the alerts for you. EDR is software that detects and can contain suspicious behavior on each computer. MDR adds people who respond around the clock.
Payment and wire controls. Insurers ask whether you verify payment requests and bank changes by a second channel before sending money, since fraud is a common claim. See our post on deepfake voice scams.
Patching and unsupported systems. How quickly you apply security updates, and whether you run software that no longer gets them, such as old versions of Windows.
Email security and training. Whether you filter email for phishing and whether staff receive regular awareness training.
Incident response and vendors. Whether you have a written plan and a contact list, and how you manage the risk from vendors and contractors who have access to your systems.
The mistake to avoid: answering optimistically
When a form asks whether MFA is enabled on all email accounts, it is tempting to answer yes because most accounts are protected. If one forgotten account is not, the answer is wrong. If an incident happens through that account, the insurer may use the incorrect answer to dispute the claim or, in some cases, to cancel the policy after the fact. Policies differ in how they handle this, which is why you should ask your broker.
The safer approach is to answer exactly, and where the honest answer is partial, say so and describe what is in progress. An accurate “partially, with completion by this date” is much easier to defend than an inaccurate “yes.”
A 30-day cyber insurance renewal checklist
- Get the form early, and ask your IT provider to review every technical question with you.
- Verify, do not assume. For each control, have someone confirm it in the system, not from memory.
- Check multi-factor authentication coverage across email, remote access and admin accounts, and fix gaps.
- Test a restore from backup and note the date and result.
- Confirm endpoint protection on every computer and server, and what monitors it.
- List unsupported systems and decide on a plan for each.
- Write down your incident response steps and contacts on one page.
- Keep evidence, such as screenshots, reports and dated test results, in one folder in case you are asked later.
- Have a second person read the final form before it is signed.
Our cyber insurance readiness service does this review with you, and our managed IT services include monitoring and patching that keep several of those controls running year-round. A free security review is a good way to find some of the gaps before the form does.
Frequently asked questions
What does rescission mean on a cyber insurance policy?
Rescission means the insurer cancels the policy as if it had never existed, usually because of a material misstatement on the application. Exact rules depend on the policy and state, so ask your broker how it applies to yours.
Will my cyber insurance be denied if I do not have MFA on everything?
Not necessarily, but missing MFA on key areas can raise your premium, limit coverage or lead to a refusal at renewal. Many insurers treat it as a basic requirement, so fixing gaps before you apply is wise.
What is the difference between EDR and MDR on an insurance application?
EDR is security software on each computer that detects and responds to threats. MDR is a service in which a security team monitors EDR alerts and responds, often 24/7. Many forms ask about both.
Why are cyber insurance renewal applications longer than they used to be?
Insurers have learned which controls matter most in claims, and they ask more detailed questions to price risk and to decide on coverage.
Can my cyber insurance claim be denied if I answered the application incorrectly?
It can be disputed. If an answer was materially wrong, the insurer may reduce or deny a claim or, in some cases, rescind the policy. This is why accurate answers matter more than convenient ones.
