Cyber insurance: what your insurer will ask

Before offering cyber insurance, the insurer assesses the company's security level through a questionnaire. Your answers are binding: an inaccurate statement can cause problems when you make a claim.

The questions are often technical. It is better to prepare them with your IT provider than to fill them in from memory.

Questions that come up again and again

• Is multi-factor authentication enabled on e-mail, remote access and administrator accounts?
• Are backups separated from the network or immutable, and is restoring from them tested?
• Is EDR-type protection installed on every computer and server?
• Are security updates installed within a defined time frame?
• Are administrator accounts separate from everyday work accounts?
• Are any systems past their end of support still in use?
• Have staff received phishing awareness training?
• Is there an incident response plan and a payment approval procedure?

Answering honestly

• Describe the actual situation, not the planned one.
• Keep evidence: backup reports, records of restore tests, MFA status per user.
• If a measure is missing, schedule it and give the planned date: that is better than an inaccurate 'yes'.

What cyber insurance usually covers

Coverage varies between insurers. It often includes crisis management and investigation costs, restoring systems, business interruption, third-party liability and notification costs. Read the exclusions, deductibles and waiting periods carefully, ideally with your broker.

Insurance does not replace prevention

Insurance offsets part of the financial consequences. It does not give you your data back, shorten the interruption or restore customer trust. The measures insurers ask for are also the ones that reduce risk the most: they are worth having with or without a policy.

How we help

We prepare the technical part of the questionnaire with you, based on the actual state of your environment, and supply the available evidence; the answers remain your company's. If measures are missing, we propose a costed plan to put them in place.