What Cyber Insurance Applications Actually Ask

Why this matters

A cyber insurance application looks like a form you fill in to get a quote. It is actually part of the policy. The answers you tick become the facts the insurer relied on when it agreed to cover you, and when a claim comes in, the claims adjuster reads them again against what the forensic investigator found. A "yes" that was hopeful rather than true is the most common reason a small business discovers, in the worst week it has had, that the policy it paid for may not respond. The fix is not a better answer. It is having the thing in place before you sign.

What the application is really asking

Questions vary by insurer and change every renewal cycle, so treat this list as current as of 2026 and re-read your own form each year. The core has been stable for several years because it tracks how small businesses actually get hit: stolen email logins, ransomware through remote access, and payments sent to the wrong account. The controls also line up closely with CISA's free Cyber Essentials guidance for small businesses, which is a sound place to start on any question you cannot yet answer yes to.

SECTION 3 - SECURITY CONTROLS          (Y / N)
3.1 Is MFA required for all remote access
    to your network and email?           [ ]
3.2 Is MFA required for all admin or
    privileged accounts?                 [ ]
3.3 Are backups kept offline or separate
    from the network, and tested in the
    past 12 months?                      [ ]
3.4 Do you use endpoint detection and
    response on all computers?           [ ]
3.5 Are critical patches applied within
    30 days of release?                  [ ]
3.6 Do employees complete security
    awareness training annually?         [ ]
3.7 Do you verify any change to vendor
    or payee bank details by calling a
    known number before paying?          [ ]
3.8 Approximate number of records
    containing personal information: ____

3.1 and 3.2: multifactor authentication (MFA), a second proof of identity beyond the password, usually a code or app approval. Read the word "all". It means every person and every path: the owner's email, the bookkeeper's remote connection, the office computer's remote-desktop access that the IT person set up, the payroll login. One account without it makes the answer "no".

3.3: backups that a ransomware infection cannot reach, and that someone has restored. "Offline or separate" means not on a drive plugged into the office computer and not on a share the office computer can write to without a separate login. "Tested" means a restore was actually done. A backup you have never restored is a belief, not a control.

3.4: endpoint detection and response (EDR), security software that watches for suspicious behavior on each computer and can isolate it, not just scan for known viruses. Many insurers now distinguish it from plain antivirus. If you are not sure which you have, the answer is probably antivirus; ask whoever installed it.

3.5: patching. Updates applied within a stated window. If a computer in the shop still runs an operating system its maker stopped updating, expect a separate question about end-of-life software.

3.6: training. Some forms also ask about phishing simulations. A short annual session plus a quarterly drill is usually what "yes" requires; check the wording. See related: Running a Phishing Drill for the Office.

3.7: payment verification. This is the one most shops answer "yes" to without a written procedure. It usually gates social engineering or funds transfer fraud coverage, which pays when the office is tricked into sending money. That coverage is often a sublimit (a smaller cap inside the policy) and frequently carries a condition that the verification callback was actually made. See related: The Verify-on-a-Second-Channel Rule.

3.8: the record count drives the price, because notification and credit monitoring costs scale with it. Count customers with a name plus anything sensitive (card data, bank details, a driver's license), employees, and job applicants. Overstating costs premium; understating can be the misrepresentation.

Why a wrong "yes" can sink a claim

Three mechanisms, and which one an insurer can use depends on the policy wording and on the law of your state.

• Misrepresentation in the application. Most policies incorporate the application. Where a material answer was untrue, an insurer may deny the claim or, in some cases, seek to rescind the policy (treat it as if it never existed and return the premium). States differ sharply on what the insurer has to show: some require only that the false answer was material to the decision to insure, others require that it was made with intent to deceive or that it contributed to the loss. That difference can decide a claim, and it is a question for your state's law, not for this card.
• Conditions and exclusions tied to controls. Some policies carry a clause excluding losses that arise from failing to maintain a control you said you had, or reducing coverage for incidents that start through an unprotected path. These work even where misrepresentation would be hard to prove.
• Sublimit conditions. Funds transfer and social engineering coverage often pays only if a stated verification step happened. No callback, no coverage, whatever the main policy says.

None of this is a prediction that an insurer will deny you. Many claims with imperfect controls are paid. It is the reason the answer has to be true, because you do not get to pick which mechanism applies after the fact.

Worked example: an eleven-person shop at renewal

An eleven-person HVAC shop applies for cyber coverage. The owner fills in the form in twenty minutes, answering from memory:

Eight answers, and on a strict reading six are untrue or incomplete: 3.1, 3.3, 3.4, 3.5, 3.6 and 3.8. 3.2 is true. 3.7 is arguable at best.

The incident. Nine months later, ransomware locks the office computer and the shared drive. The forensic firm the insurer appoints finds the entry point: the remote desktop connection the outside bookkeeper uses, logged into with a reused password from a breach list. No MFA on that path.

How it reads at claim time. The adjuster compares the forensic report to the application. Question 3.1 said MFA was required on all remote access, and the attack came in through the one remote access path that did not have it. The backup, never tested, turns out to have been syncing encrypted files over the good ones for two days before anyone noticed, so 3.3 also failed in fact. The insurer reserves its rights, meaning it continues investigating while stating it may deny, and the shop is now paying for its own attorney to argue about the policy while the office is down.

What the owner should have done before signing, and what it cost. Not much, measured in hours. Turning on MFA for the bookkeeper's remote access was about one hour of the IT person's time. A restore test, two hours. Switching to EDR, a change of subscription and an afternoon. Annual training, one hour of everyone's time a year. A written callback rule, ten minutes. A real record count, half an hour with the customer export. Call it about a day of the IT person's and the office's time, plus one hour of training for each of the eleven people, against a claim that would have covered weeks of lost billing.

What would have changed the answer. If the owner had answered 3.1 "no", the quote would likely have come back higher, with a requirement to add MFA within a set period, or a decline. That is a worse quote and a true one, and the condition would have forced the fix that prevented the incident. Answering "no" honestly is always available; a broker can often find a carrier that will write the risk with a remediation plan.

Before you sign: the evidence file

For every "yes", keep one piece of proof dated within the policy year, in a folder the shop owns. It is what your broker asks for at renewal and what you hand an adjuster.

• MFA: a screenshot of each critical system's user list showing MFA enrolled, including remote access and any vendor accounts.
• Backups: the date and result of the last restore test, with what was restored. See related: Testing a Restore Before You Need One.
• EDR: the product's console showing each computer covered.
• Patching: the update status of each computer on one date.
• Training: attendance list and date; drill results if asked.
• Callback: the written procedure and two or three examples from the payables log of a callback recorded.
• Record count: the export counts and the date you ran them.

Most of this file falls out of the yearly review if the shop runs one. See related: The Annual Security Review SOP.

When to call the broker, and when to call a lawyer

Call your broker or agent before you answer any question you cannot answer "yes" to with evidence. Ask how the carrier reads the wording ("does 'all remote access' include a vendor's connection?"), whether a "no" with a remediation date is acceptable, and whether the policy has a failure-to-maintain clause. A good broker would rather fix an answer before binding than defend it after a loss.

Call a lawyer when an insurer reserves rights or denies. That is the fork past which this card stops being useful. Walk in with the application as submitted, the policy, the insurer's letters, the forensic report, and your evidence file. Whether a wrong answer lets this insurer deny this claim depends on your state's law on misrepresentation and on the policy language, and an attorney who handles insurance coverage disputes reads both. This is not legal advice.

If something changes mid-policy (you drop the EDR subscription, the IT person who managed backups leaves), check whether the policy requires you to notify the insurer of a material change. Many do, and the gap between what you told them and what is now true is the same gap, just later.

References

• CISA, Cyber Essentials for small businesses (cisa.gov), the controls these questions track
• See related: The Annual Security Review SOP
• See related: The Verify-on-a-Second-Channel Rule
• See related: Ransomware Locked the Office Computer