Cyber-insurance applications have become detailed security questionnaires. Insurers ask about specific controls because claims data shows which ones prevent or limit incidents. Answering accurately matters: an inaccurate answer can complicate a claim. Here’s what the most common questions mean in practice. Always check your own policy and application wording, which vary between insurers.
Multi-factor authentication (MFA)
What insurers usually ask: Is MFA enforced for email, remote access and administrative accounts?
What it means: Signing in needs a second factor — an authenticator app prompt or security key — as well as a password. “Enforced” means it’s required, not optional, and that older sign-in methods which bypass MFA are blocked.
Common gap: MFA enabled for most users but not for administrator accounts, shared mailboxes or the VPN.
Endpoint detection and response (EDR)
What insurers usually ask: Do you use EDR on all endpoints and servers?
What it means: EDR goes beyond traditional antivirus. It monitors behaviour on computers and servers, detects suspicious activity such as ransomware encrypting files, and can isolate a device. Someone also needs to respond to its alerts.
Common gap: Consumer or basic antivirus on some machines; servers left out.
Backups
What insurers usually ask: Are backups encrypted, stored off site or offline, and tested? Are they protected from deletion?
What it means: At least one copy should be separated from your network or immutable, so an attacker with admin access can’t destroy it. Restores should be tested and the results recorded.
Common gap: Backups to a network drive that ransomware can reach, and no record of a successful restore.
Patching and supported systems
What insurers usually ask: How quickly are critical patches applied? Do you run unsupported operating systems?
What it means: Security updates are applied on a defined schedule, and nothing in use is past its vendor’s end-of-support date — or, if it must be, it’s isolated.
Email security
What insurers usually ask: Do you filter inbound email? Do you use SPF, DKIM and DMARC?
What it means: Inbound mail is scanned for phishing and malware, and your domain publishes records that help receiving servers reject messages forged in your name.
Privileged access
What insurers usually ask: Are admin rights restricted? Do administrators use separate accounts?
What it means: Everyday user accounts don’t have admin rights, and IT administrators use a separate account for administrative work.
Security awareness training
What insurers usually ask: Do employees receive phishing awareness training?
What it means: Staff are trained to recognise phishing and payment fraud — and to verify bank-detail changes by phone.
How to approach the questionnaire
- Read each question carefully; “all users” and “all endpoints” mean all.
- Answer what’s true today, not what’s planned.
- Where you have gaps, close the high-impact ones — usually MFA, EDR and isolated backups — before renewal.
- Keep evidence: configuration screenshots, backup test logs and training records.
We help businesses understand what each question is asking, document the controls they have and implement the ones they don’t. Talk to us before your renewal.