The questionnaire has become a security baseline with a premium attached. The answers are a legal declaration, which makes optimistic ones expensive.
Cyber insurance used to be a form with a dozen questions and a price. Several years of substantial ransomware losses changed that. Insurers now underwrite on specific controls, verify some of them independently, and decline or load risks that do not meet a baseline.
For most mid-sized organisations this has turned out to be useful. The questionnaire has become, in effect, a published minimum security standard with a financial incentive attached, and it is the reason a lot of overdue work finally gets funded.
It has also made the application a document with legal weight, which is the part people underestimate.
The baseline
Four controls appear on effectively every questionnaire, and failing any of them will either decline the risk or price it out of reach.
MFA, with the scope being the interesting part. Everyone says yes to this. The question is usually more specific than it first appears: MFA on email, on all remote access, and on all administrative accounts. The common gap is administrative accounts, where an exception was made years ago for a service account or a legacy system. Answer accurately.
Backups that are offline or immutable, and tested. Ransomware operators target backups first, so a backup reachable with domain credentials is not considered a backup. Immutable storage or a genuinely separated copy, plus evidence of a tested restore with a date.
Endpoint detection and response. Signature-based antivirus is no longer sufficient for most underwriters. EDR, deployed across the estate, with someone looking at it.
A patching process with a stated timeframe. Typically critical patches within a defined number of days. They want the process and the evidence it runs, not an aspiration.
Verification has changed the game
Several insurers now run external scans of applicants and policyholders. They see your internet-facing services, your exposed administrative interfaces, your certificate hygiene and sometimes your presence in breach datasets.
Two implications. An answer contradicted by what they can see from outside is a problem immediately rather than at claim time. And this scanning continues during the policy term, so a service exposed in month four may generate a conversation.
Run the same check on yourself before you apply. An external attack surface scan is inexpensive and will tell you what the underwriter is about to see.
The accuracy point, stated plainly
The application is a declaration. If a control you declared was not in place and a loss occurs through the gap it would have covered, the insurer may decline or reduce the claim.
The failure mode is rarely dishonesty. It is that the form is completed by somebody who answers from what the policy documents say rather than from what is actually configured, often under time pressure, often without asking the person who would know.
The honest answer, with a remediation date attached, gets you cover. The optimistic answer gets you a policy that does not pay.
If a control is partial, say so and say what the plan is. Underwriters deal with partial all day. What they cannot deal with is being surprised during a claim.
Renewal as a project
The step with the best return is evidencing each control with a screenshot and a date. It takes a day, it makes the application defensible, and it doubles as most of an internal security review. Keep the pack: next year it is an update rather than a rebuild.
Briefing the broker properly is the second. A two-page document describing your controls, your recent improvements and your incident response arrangements gets meaningfully better terms than a form with ticks, because it gives the broker something to argue with on your behalf.
Read these clauses in your own policy
The notification deadline. Many policies require notification within a short window of discovery, sometimes seventy-two hours or less. Put this number in your incident response plan, on the page people will actually read.
Panel requirements. Many policies require you to use the insurer's approved incident response, legal and forensics firms. Engaging your own first can void cover for those costs. Know this before an incident, not during.
Social engineering and funds transfer. Business email compromise where somebody is tricked into making a payment is frequently covered under a separate sub-limit that is much smaller than the headline. For many businesses this is the most likely loss, so check the sub-limit specifically.
Dependent business interruption. Losses caused by your supplier's outage rather than your own. Increasingly relevant and not always included.
Waiting periods. Business interruption cover often has an initial period before it starts paying, and if that period is longer than your realistic outage, the cover does less than it appears to.
If you are starting from behind
Get MFA to full coverage, including the administrative exceptions. Get one immutable or offline backup copy and perform a restore so you have a date. Deploy EDR. Write the patching process down and record that it runs.
Those four, done properly, move you from uninsurable to insurable at most underwriters, and they are the same four things you would do anyway if nobody was asking. The insurance requirement is just the thing that finally gets them funded.
