A few years ago, a cyber insurance application was a page long. Today it's often a detailed questionnaire, and the answers decide whether you're covered, what you pay, and whether a claim gets paid. Insurers learned from ransomware losses, and they now ask about the specific controls that would have stopped them.
Every carrier's form is different, but these are the controls that show up on almost all of them.
1. Multi-factor authentication (MFA)
Expect questions about MFA on email, remote access (VPN and remote desktop), administrator accounts, and cloud apps. "We have MFA" isn't enough: insurers want it enforced for every user, with no exceptions for executives or shared accounts. Legacy sign-in methods that bypass MFA should be blocked.
2. Endpoint detection and response (EDR)
Traditional antivirus looks for known malware. EDR watches behaviour and can isolate a device during an attack. Many applications ask specifically for EDR on all endpoints and servers, and some ask whether it's monitored 24/7, which is what managed detection and response (MDR) provides.
3. Backups that ransomware can't reach
Insurers ask whether backups are offline, immutable or otherwise separated from your main network and accounts, how often they run, and when you last tested a restore. Backups stored on the same network with the same admin password are often the first thing ransomware deletes.
4. Patching and end-of-life systems
Expect questions about how quickly critical patches are applied and whether you run unsupported software. Windows 10 reached end of support in October 2025, so any remaining Windows 10 machines without extended security updates are now a red flag.
5. Email security
Phishing and business email compromise drive a large share of claims. Insurers look for advanced email filtering, link and attachment scanning, external sender warnings and DMARC on your domain.
6. Security awareness training
Regular training and simulated phishing for all staff. Some carriers ask how often it happens and whether you track results.
7. Privileged access
Separate admin accounts from everyday accounts, limit who has admin rights, and protect domain and Microsoft 365 global admin accounts with the strongest MFA available.
8. Payment verification procedures
Funds-transfer fraud coverage often depends on a written process for verifying changes to bank details out-of-band, such as a phone call to a known number.
9. An incident response plan
A written plan covering who to call, how to contain an incident and how to notify the insurer. Many policies require you to use the carrier's approved incident response firm, so know that before an incident.
Answer accurately
An incorrect answer on an application can give an insurer grounds to deny a claim. If you're not sure whether a control is fully in place, find out before you sign. We help clients answer these questionnaires accurately and back each answer with evidence. Start with a free assessment.