The cyber insurance questionnaire: what it asks about your IT and how to answer truthfully

What the application is really asking

Cyber insurance applications and renewals commonly ask whether multi-factor authentication is turned on, how your data is backed up and whether those backups are protected and tested, and whether every computer runs managed endpoint protection. Answer each question only after confirming it with whoever manages your IT, and keep evidence of the answer. A claim can be denied if the application said a control was in place and it was not, so an honest no that you then fix is far safer than a hopeful yes. This is general information from the IT side; for what your policy covers, talk to a licensed insurance agent.

I am Anthony Omini, owner of Cross River Tech in Dallas. Helping clients with these questionnaires is part of our cybersecurity work: we review each control the application asks about, fix the gaps and document what is in place. This guide explains the questions in plain English so the owner signing the form knows what they are attesting to.

Why a wrong yes is worse than an honest no

The application is usually filled out by an owner or office manager in a hurry, often by checking yes on everything that sounds familiar. Multi-factor authentication? We have that on email, so yes. Backups? The server backs up every night, so yes. The trouble starts if there is ever a claim, because the insurer will look at what actually happened, and an attacker who got in through an account without multi-factor sign-in has just proven the answer wrong.

An honest no usually has a simple remedy: turn the control on, then answer yes truthfully. Most of the controls applications ask about cost little or nothing to enable. The expensive part is discovering after an incident that the form and the reality did not match.

Multi-factor authentication: the question with the most fine print

This is the question most often answered yes when the truthful answer is partly. Multi-factor authentication means a second proof beyond the password, usually a prompt on a phone, and the application often asks about it in several places separately: email, remote access to the office network, administrator accounts and sometimes business applications holding sensitive data. Having it on for most staff email is not the same as having it on everywhere the form asks.

When we roll it out, we go in that order: email first, then remote access, then administrator accounts, then the business applications. Look for the gaps that hide well, such as the owner's account that was exempted because it was inconvenient, a shared mailbox, an old administrator login, or a mail app using older sign-in methods that skip multi-factor checks. CISA notes that people who use multi-factor authentication are significantly less likely to get hacked, which is exactly why insurers ask.

Backups: separate, protected and tested

Backup questions tend to probe three things: whether backups exist for servers, computers and cloud email, whether at least one copy is kept separate from the network so ransomware cannot reach it, and whether restores are tested. Each part needs its own honest answer. A nightly backup to a drive plugged into the server is a backup, but it is not separate, and if nobody has restored from it, it is not tested. Check, too, whether Microsoft 365 or Google Workspace data is part of the backup, since many offices assume the platform covers it.

Our restore tests each produce a short note saying what was restored and how long it took, and those notes double as evidence for an insurer or a HIPAA risk assessment. If your current backup cannot produce something like that, it is worth fixing before renewal. I explain the most common gaps in the backup myths that leave small offices exposed.

Endpoint protection on every computer

The application may ask whether every computer and server runs endpoint protection, sometimes described as antivirus or endpoint detection and response. The honest answer depends on two details people rarely check: whether it is on every machine, including the old desktop in the back office and the owner's home laptop that reaches company email, and whether anyone is watching its alerts.

The protection we deploy is behavior-based rather than limited to known virus files, staff cannot switch it off, and it reports to a console we monitor. Built-in antivirus left unmanaged is only as good as the user's response to a warning on the screen. If you cannot produce a list of protected devices that matches your actual device list, the truthful answer is not yet yes.

Other questions you may see

Applications differ by carrier and change from year to year, so treat this as a list of topics to be ready for, not a copy of any particular form. Each one is easier to answer if your IT provider already documents it.

If a question uses a term you do not recognize, ask your agent or IT provider what it means before answering. Forms sometimes use specific language, such as endpoint detection and response or privileged access, that sounds like something you have and may not be. A two-minute clarification costs far less than a misstatement.

• How quickly security updates are installed on computers, servers and network equipment
• Whether email is filtered for phishing and whether your domain has SPF, DKIM and DMARC records
• Whether staff receive phishing awareness guidance, and how often
• Who has administrator access, and whether administrator accounts are separate from everyday ones
• How quickly former employees lose access to accounts and systems
• Whether you have a written incident response or disaster recovery plan
• How the firewall and remote access are configured

How to fill it out without guessing

Ask your agent for the application or renewal questionnaire as early as possible, weeks rather than days before it is due. Then work through it with your IT provider line by line, and do not sign until every answer is backed by something you could show someone.

Medical and dental offices will find a lot of overlap between the questionnaire and the technical safeguards HIPAA expects, such as access control, multi-factor sign-in, audit logging, encryption, patching and tested backups. We implement and document those safeguards, but no IT company can make a practice compliant on its own, because policies, training and staff habits are part of it too. The same documentation serves both purposes, which is one more reason to keep it current.

• Send the full questionnaire to whoever manages your IT and ask for a written answer to each technical question.
• For every yes, note the evidence: a settings report, a device list, a restore-test note, a written plan.
• For every no or partly, ask what it would take to fix and how long, then fix it before you sign if you can.
• If a gap cannot be closed in time, discuss it honestly with your agent rather than rounding up.
• Keep a copy of the signed application and the evidence together, and review it before next year's renewal.

What the policy covers is a conversation with your agent

The IT questions decide whether you can get coverage and on what terms. What the policy actually pays for is a separate question, and it is one for a licensed insurance professional, not your IT company. The FTC's guidance for small businesses describes first-party coverage, which protects your own data and covers costs such as recovering data, notifying customers, lost income and forensic investigation, and third-party coverage, which protects you when others bring claims against you. It also suggests asking whether the insurer will defend you in a lawsuit or regulatory investigation and whether it offers a breach hotline that operates around the clock.

If you are reviewing business coverage generally, a property and casualty insurance agent can talk through how a cyber policy fits alongside the rest of it. Bring the completed questionnaire to that conversation; it makes the discussion far more specific.

If something happens while the policy is active

Call the insurer's claims or breach line early, before you spend money on recovery, because many policies expect you to follow their process and may have vendors they want involved. Your IT provider's job is to contain the damage and preserve what the investigators need. Our ransomware response, for example, is to isolate the affected machines, find and close the entry point, restore from the copy the attacker could not reach, reset credentials and help you follow the insurer's incident process.

If the incident is a hacked mailbox rather than ransomware, the first steps are different, and money may be moving; see how to spot a compromised business email account and what to do first.

Getting the questionnaire right before renewal

If your renewal is coming up, or you are applying for the first time, send me the questionnaire. We will review each technical question against what is really in place, fix the gaps in order of importance and give you documentation to keep with the application. For managed clients across Dallas–Fort Worth this is part of the relationship; for everyone else, a one-time review can be quoted as a fixed project or done at our published hourly rate.

We do not sell insurance, and we do not run penetration tests or formal audits, though we can help you prepare for one. What we do is make sure that when you sign the form, every yes on it is true. If you are still choosing an IT provider, ask each one how they would handle this; it is a good test, and it belongs on my list of questions to ask an IT company before hiring.

Questions people ask me