Cyber Insurance Questions: How to Answer Them Honestly

You open your cyber insurance renewal and the form is six pages long. Is multi-factor sign-in turned on for everyone? Are backups tested? Who can reach your systems from home? Many owners and office managers guess, check "yes," and move on.

That is a risky habit. If you ever file a claim, the insurer can compare your answers with what was really in place. This post explains what the questions usually cover and how to answer them with confidence.

Why insurers ask these questions

Cyber insurance helps pay for costs after an attack, such as recovery work, lost income and notifying customers. Insurers want to know how likely a claim is, so they ask about basic protections. Offices with better habits are a lower risk.

Every policy is different, so read your own form. But the same topics come up again and again.

The questions that come up most

Multi-factor sign-in (MFA). This means a password plus a second step, like a code on your phone. Insurers often ask whether it is on for email, remote access and administrator accounts. "Some of us use it" is not the same as "yes." Check that it is turned on for every person.

Backups. Expect questions about how often data is copied, whether one copy is kept away from your main network, and whether you have ever tested a restore. A backup you have never tested is a guess, not a plan.

Antivirus and updates. They want to know that every computer has protection and that Windows and other software are updated on a regular schedule. Include laptops and the older PC at the front desk.

Email protection. Most attacks start with a phishing email, which is a fake message that tricks someone into clicking or paying. Insurers ask whether you filter email and whether staff get training.

Remote access. If people work from home or a vendor connects to your systems, the form will ask how. Be ready to name the tools and say who has access.

Old accounts and devices. Some forms ask how you remove access when someone leaves. Others ask whether you still run software that no longer gets security updates.

How to prepare before the form arrives

A little homework makes the form much easier. Work through this list:

1. Make a list of everyone with an account. Include employees, part-timers, and outside vendors. Remove anyone who no longer needs access.
2. Check MFA account by account. In Microsoft 365, an administrator can see who has it turned on. Do not rely on memory.
3. Find your last backup test. Write down the date. If there has not been one, ask your IT provider to run a test restore of a few files.
4. List your computers. Note the age, the Windows version and whether it still gets updates. Replace or retire anything unsupported.
5. Write down how people connect from outside the office. Keep it to a short paragraph.
6. Keep a simple record of staff training. A date and a list of who took part is enough.

Save these notes in one folder. Next year, you only have to update them.

Answer honestly, and fix gaps instead of hiding them

It is tempting to say "yes" to everything so the premium stays low. Don't. A wrong answer can cause trouble at the worst moment, when you need the policy to pay.

If you find a gap, you have two good choices. Fix it before you submit the form, or answer truthfully and note that you are working on it. Most gaps are cheap and quick to close. Turning on MFA, for example, often takes an afternoon.

If you are not sure what a question means, ask your insurance agent or your IT provider. Asking is better than guessing.

Getting help

Technical questions are the hardest part for most offices. At Insation Technologies, we help clients fill in the technical sections of cyber insurance forms and provide evidence for the answers. If you would like to know where you stand first, we offer a free IT assessment that reviews backups, security, email and your network, with a plain-English report on what to fix first. You can request it at insationtech.com/assessment or call us at (508) 422-0477.

Whether or not you work with us, set aside an hour before your next renewal. Your answers should be ones you can stand behind.