In Ocean’s Eleven, the crew does not just walk into the vault. They study the guards, the cameras, and the schedule first. Cyber insurers do much the same thing, only in reverse. Before they cover your business, they study your defenses.
If you are applying for a policy or renewing one, expect a long questionnaire. This article explains what it covers and why.
What Cyber Insurance Covers
Cyber insurance helps cover the costs associated with a data breach or other cyber incident. Coverage typically includes the costs for:
- Incident Response and Forensic Work
- Data Restoration
- Legal Fees and Breach Notification
- Ransomware Negotiation and Payment
- Lost Business Income and Extra Expense
Coverage will help cover the costs associated with a cyber incident, but will not help improve the security and stability of your network.
Why Insurers Ask About Your Controls
Insurance companies evaluate risk, and the cost of ransomware claims has been increasing. Because of this, underwriters review how a company protects itself. The more protection and controls, the lower the cost of the policy, and more likely it is to be approved. Not having strong enough protection can lead to a higher cost of the policy, a lower limit, or a denial.
The questionnaire is not just busy work. It gives the insurance company a prediction of how a company would respond to a breach.
The Controls Insurers Ask About Most
Questions vary by carrier. These themes show up almost everywhere.
Multi-factor authentication (MFA). This is the most common requirement. Insurers want MFA on email, remote access, VPNs, and all admin accounts. Stolen passwords drive many breaches, and MFA blocks most of that path.
Endpoint detection and response (EDR). Basic antivirus is no longer enough. Underwriters want tools that watch devices for unusual behavior and respond fast. Many also ask who monitors the alerts, and whether that happens around the clock.
Backups. Insurers ask how often you back up, where copies live, and when you last tested a restore. Backups should be offline or immutable. If ransomware can reach your backups, they will not save you.
Patch management. Expect questions about how quickly you fix known flaws. Unpatched systems and unsupported software are red flags. Firewalls, VPN appliances, and servers get special attention.
Email security. Phishing remains a top entry point. Insurers look for spam filtering, link scanning, and attachment sandboxing. They also ask about staff training and phishing tests.
Network segmentation. A flat network lets an attacker move freely once inside. Segmentation limits the damage. Separating guest Wi-Fi, office systems, servers, and sensitive data makes a breach easier to contain.
Privileged access management. Fewer people should hold admin rights. Insurers ask how you grant, review, and remove them. They also ask whether service accounts and shared logins are controlled.
Logging and monitoring. If you cannot see an attack, you cannot stop it. Insurers want logs kept long enough to support an investigation. Central collection helps.
Incident response plan. You need a written plan with named roles and contacts. Insurers often ask whether you have tested it with a tabletop exercise.
The Multi-Site Problem
Companies that have more than one office are subject to greater inspection. Each office requires additional routers, switches, wireless access points, and local users. If one branch is poorly managed then the entire company is put at risk.
Underwriters usually want to know if the security settings are the same at all the sites and also whether the remote offices connect via secured tunnels and whether all the locations adhere to the same patching schedule. Network security when dealing with multiple sites can only be effective if shared standards are used rather than each office acting on its own.
Physical infrastructure is also a factor. The presence of old cabling, unmanaged switches, and devices whose details are not recorded makes it more difficult to carry out audits. A network that is well organised and properly documented is not only easier to defend but also simpler to explain to an underwriter.
Documentation Wins Deals
Just saying ‘yes’ when filling in a questionnaire isn’t sufficient. The companies now check the answers themselves and, in some cases, carry out external scans of your public systems before giving you a price quote.
Keep records of:
- Your asset inventory
- MFA coverage reports
- Patch and backup logs
- Policy documents
- Training records
A claim can be rejected if the answer given on the form is found to be false. What is important is accuracy rather than the application looking perfect.
A Mildly Unpopular Opinion
Many policyholders regard insurance as a substitute for security spending, but it isn’t. Insurance only covers the cost of a loss after the fact and cannot regain customer trust or take the place of weeks of disrupted operations.
The most useful way of looking at the questionnaire is to regard it as a free checklist; insurers have looked at thousands of claims and the controls which they inquire about are the ones that most frequently failed in actual incidents.
Where This Is Heading
The requirements are becoming more strict rather than less so. There will be more carriers requesting evidence of 24/7 monitoring, vendor risk assessments, and tested recovery plans. In some cases, premiums will be linked directly to live security ratings.
Firms which establish these habits from the start will find it easier to deal with renewal. Adhering to network security best practices and securing enterprise networks by using consistent standards will make both the coverage and the recovery processes simpler. A great many companies rely on managed IT services in order to run their business, particularly when their team is small.
Begin with the fundamentals. Enable MFA. Check your backups. Apply patches on schedule. Find out what’s on your network. All of these steps cost a lot less than making a claim and they make you a better risk in the eyes of any insurer.
