Preparing for a cyber insurance questionnaire

Cyber insurance has become a normal part of running a business, and so has the questionnaire that comes with it. The questions are technical, the form is long, and the answers matter: if a claim is made and the insurer finds an answer was wrong, they can refuse to pay. We help clients complete these accurately, and close the gaps the questions reveal.

What insurers ask about

The questions vary by insurer but cover the same ground. Multi-factor authentication: is it required for email, for remote access and for administrator accounts? Backups: are they taken regularly, kept separate from the network or made unchangeable, and tested? Endpoint protection: is there antivirus or endpoint detection on every computer, and is it managed? Email security: are there filters for phishing and malicious attachments? Updates: are systems patched promptly, and is any unsupported software still in use? Access: do staff have admin rights, and are leavers' accounts removed promptly? Training: do staff receive security awareness training? Incident response: is there a plan, and who is called?

Answer honestly, not hopefully

The temptation is to tick yes to everything. Do not. "Is MFA enforced for all users?" means all, including the owner's account and the shared mailbox nobody thinks about. If the honest answer is "most", say so, and ask us to close the gap before the policy starts. We would much rather you have a smaller discount than a declined claim.

How we help

Send us the questionnaire before you fill it in. We go through it with you, answer the technical questions from what we can see in your systems, and give you a short written note on each answer so you can show your broker where it came from. Where an answer is no, we tell you what it would take to make it yes and quote it if it is a project. Most of the controls insurers ask for, such as MFA, managed Defender, patched systems, separate backups and leavers removed the same day, are already part of a managed plan.

Keep the evidence

After a claim, insurers ask for proof. We keep records of update status, backup results and test restores for managed clients, and they appear on your monthly report. Keep your signed questionnaire and our notes together with the policy.

Renewals

Questionnaires get stricter each year. If you tell us when your renewal is due, we review the previous year's answers with you in advance so there are no surprises. Email hello@bitnode.tech to arrange it.