Article · Security & Passwords
Cyber insurance questionnaires: how to answer them honestly
The security questions cyber insurers usually ask small businesses, what each one really means, and why an honest answer matters more than a perfect one.
More small businesses now get a long security questionnaire with their cyber insurance application or renewal. The questions can be confusing, and it’s tempting to check “yes” and move on. Don’t. If you have a claim and the insurer finds an answer wasn’t true, they may have grounds to deny it.
Here are the questions that come up most, what they’re really asking, and what a “yes” should mean.
The common questions
Do you require multi-factor authentication (MFA)? Usually asked separately for email, remote access, and admin accounts. “Yes” should mean every account, including the owner’s and any shared or service accounts, not just most people. See MFA for small businesses.
Do you back up your data, and are backups kept separate from your network? They want to know you can recover from ransomware without paying. “Separate” means an attacker who gets into your network can’t delete or encrypt the backups. Many forms also ask whether you test restores. See What a good small business backup plan looks like.
Do you use endpoint detection and response (EDR)? This is newer security software than traditional antivirus. It watches for suspicious behavior and can stop an attack in progress. Some insurers also ask whether someone monitors its alerts around the clock.
Do you filter email for phishing and malicious attachments? Most attacks start with an email. Microsoft 365 includes basic filtering, and many businesses add stronger protection.
Do you install security updates promptly? They may ask how quickly critical updates are applied, often within a set number of days, and whether you still run any unsupported software, like an old Windows version.
Do you train employees on security? Usually phishing awareness training, sometimes with simulated phishing tests.
Are admin rights limited? Everyday accounts shouldn’t have administrator access. Admin work should use separate accounts.
Do you have an incident response plan? A written plan for who to call and what to do in the first hours of an attack, including the insurer’s own hotline.
Do you verify payment changes? A process to confirm new or changed bank details by phone before sending money. Wire fraud is one of the most common small business claims.
How to answer well
- Answer what’s true today, not what you plan to do. If something’s in progress, say so in the notes.
- Ask what a term means if you’re not sure. Your broker or IT provider can help.
- Keep a copy of what you submitted. Next year’s renewal will ask again.
- Treat a “no” as a to-do list. Fixing gaps before renewal can mean better coverage or a better premium, and it makes the business genuinely safer.
Where your IT provider fits in
A good IT provider should be able to answer most of these questions for you, show proof, and help close the gaps. If yours can’t, that’s worth noticing. See 12 questions to ask before hiring a managed IT provider.
Have a questionnaire on your desk now? Learn more about our cybersecurity services. We help clients answer these every renewal.