How to answer cyber insurance application questions

The control areas carriers commonly ask about

Wording differs by carrier and changes from year to year, so read your actual form closely. These are the areas that come up most often, and how to answer each one.

1. Multifactor authentication (MFA)

• What it is really asking: Can a stolen password alone get someone into your email, your network from outside, or your admin accounts? Many forms ask about each separately.
• A defensible yes: MFA is enforced, not just available, for every user on email, for all remote access (VPN, remote desktop, remote support tools), and for every privileged or admin account, including cloud admin consoles.
• Evidence to keep: Screenshots of the enforcement policy, a list of any excluded accounts with the reason, and the date of your last review.
• Common trap: Answering yes because Microsoft 365 email has MFA, while the VPN, the firewall admin login, a backup console, or a service account does not. Legacy email protocols that bypass MFA are another quiet gap.

2. Endpoint detection and response (EDR)

• What it is really asking: Do you have software on your computers and servers that detects suspicious behavior, and is someone actually watching the alerts?
• A defensible yes: A named EDR product is deployed on all workstations and servers, and alerts go to a person or provider who responds, including nights and weekends if the form asks.
• Evidence to keep: A deployment report showing device coverage against your asset list, and a short note on who monitors alerts and how.
• Common trap: Calling traditional antivirus EDR, or answering "100 percent coverage" when servers, laptops that rarely connect, or a few machines at a second site were never enrolled.

3. Backups: offline or immutable, and tested

• What it is really asking: If ransomware encrypts everything an attacker can reach, do you still have a copy they cannot reach, and have you proven you can restore from it?
• A defensible yes: Critical systems are backed up to a copy that is offline, immutable, or otherwise separated from your normal admin credentials, and you have performed a real restore test recently.
• Evidence to keep: The backup schedule, a description of how the protected copy is separated, and a dated restore test record showing what was restored and how long it took.
• Common trap: Saying backups are tested because jobs report success. A successful job is not a restore test. Another trap is cloud sync, which can faithfully copy encrypted files.

4. Patching and end-of-life systems

• What it is really asking: How quickly do you apply critical updates, and are you running anything the vendor no longer supports?
• A defensible yes: A documented patch window for critical updates that you actually meet, and either no unsupported systems or a list of them with how each is isolated.
• Evidence to keep: Patch compliance reports from your MSP, and an inventory that flags operating system and firmware versions.
• Common trap: Forgetting the old server running one line-of-business application, a machine on the shop floor, or network equipment nobody patches because it "just works."

5. Privileged access

• What it is really asking: Who holds admin rights, are those rights separate from everyday accounts, and are they protected and reviewed?
• A defensible yes: Admins use separate accounts for admin work, users do not have local admin rights, shared admin passwords are stored in a vault, and the list of admins is reviewed on a schedule.
• Evidence to keep: A current list of privileged accounts with owners, and the date and result of the last access review.
• Common trap: Former employees or a previous IT provider still in the domain admin group, or an owner whose daily email account is also a global admin.

6. Email security and phishing training

• What it is really asking: Do you filter malicious email, protect your domain from spoofing, and train people to spot and report phishing?
• A defensible yes: Email filtering is in place, SPF, DKIM, and DMARC are configured for your domain, and everyone completes training with periodic phishing simulations.
• Evidence to keep: DNS records, training completion reports, and simulation results by date.
• Common trap: A DMARC record set to monitor only, or "annual training" that last ran two years ago and never reached new hires.

7. Incident response plan

• What it is really asking: If you were hit tomorrow, do you know who decides what, who you call first, and how you reach your carrier's breach hotline?
• A defensible yes: A written plan with named roles, contact details that work when email is down, and the carrier notification steps. Ideally it has been exercised in a tabletop exercise.
• Evidence to keep: The dated plan, its approval, and notes from the last exercise.
• Common trap: Pointing to your MSP's internal runbook. That covers their technical steps, not your business decisions, legal notifications, or carrier contact. Our incident response plan service exists for exactly this gap.

8. Vendor and remote access

• What it is really asking: Which outside parties can reach your systems, how, and is that access protected and limited?
• A defensible yes: You know every vendor with remote access, each uses named accounts with MFA, and access is turned off when not needed.
• Evidence to keep: A vendor access list with the tool each uses and the date it was last reviewed.
• Common trap: An equipment vendor or software support company with an always-on remote tool and a shared login that nobody remembers approving.

9. Wire transfer and funds verification

• What it is really asking: If someone emails a request to change bank details or send an urgent payment, does a human verify it through a separate channel before money moves?
• A defensible yes: A written procedure requiring a call-back to a known phone number (not one in the email) for any new payee or bank change, with dual approval above a set amount.
• Evidence to keep: The written procedure, staff acknowledgment, and a log or note showing it is followed.
• Common trap: "We always call" as an unwritten habit of one bookkeeper. This matters a lot in construction and real estate, where large payments to new parties are routine.