Cyber insurance applications now ask specific questions about multi-factor authentication, backups, and endpoint protection. Here is what they mean and how to prepare honest answers.
Why the application got longer
Insurers have paid out heavily on ransomware and email fraud, so applications that once asked a few yes-or-no questions now ask how your business is actually protected. Your answers can affect whether you are offered coverage and on what terms. Answer accurately: a claim can be disputed if the application said a control was in place and it was not.
Every insurer's form is different, and your broker is the authority on yours. These are the topics that come up most often.
The questions you are likely to see
- Multi-factor authentication. Is a second step required for email, remote access, and administrator accounts? This is frequently the first question.
- Backups. Are they taken regularly, stored separately from your network, and tested by restoring from them?
- Endpoint protection. Is security software with detection and response installed on every computer and server?
- Patching. How quickly are security updates applied?
- Email security. Do you filter phishing and malicious attachments?
- Staff training. Do employees receive security awareness training and phishing tests?
- Payment verification. Is there a procedure to confirm a change in bank details by phone before money is sent?
- Incident response. Is there a written plan for what to do and who to call?
How to prepare
Go through the list above and write down, for each item, whether it is fully in place, partly in place, or not in place. Partly usually means some accounts or some machines are covered and others are not. Insurers generally mean everywhere when they ask.
Close the gaps you can before you apply, starting with multi-factor authentication and tested backups. Keep evidence: screenshots of settings, backup reports, training records. If your IT is managed by an outside provider, ask them to help complete the technical sections.
The benefit beyond the policy
The controls insurers ask about are the same ones that prevent most incidents in the first place. A business that can answer yes to these questions is harder to attack, whether or not it ever files a claim.